IETF Logo Mail Archive

Re: [OAUTH-WG] Holder-of-the-Key for OAuth

Anthony Nadalin <tonynad@microsoft.com> Mon, 09 July 2012 18:57 UTC

Return-Path: <tonynad@microsoft.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56A0421F8848 for <oauth@ietfa.amsl.com>; Mon, 9 Jul 2012 11:57:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.681
X-Spam-Level:
X-Spam-Status: No, score=-0.681 tagged_above=-999 required=5 tests=[AWL=-0.214, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, UNRESOLVED_TEMPLATE=3.132]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EtUxJPwbwYO9 for <oauth@ietfa.amsl.com>; Mon, 9 Jul 2012 11:57:11 -0700 (PDT)
Received: from co1outboundpool.messaging.microsoft.com (co1ehsobe003.messaging.microsoft.com [216.32.180.186]) by ietfa.amsl.com (Postfix) with ESMTP id DA5D821F8842 for <oauth@ietf.org>; Mon, 9 Jul 2012 11:57:11 -0700 (PDT)
Received: from mail177-co1-R.bigfish.com (10.243.78.229) by CO1EHSOBE013.bigfish.com (10.243.66.76) with Microsoft SMTP Server id 14.1.225.23; Mon, 9 Jul 2012 18:55:20 +0000
Received: from mail177-co1 (localhost [127.0.0.1]) by mail177-co1-R.bigfish.com (Postfix) with ESMTP id 0ADD8CC0108 for <oauth@ietf.org>; Mon, 9 Jul 2012 18:55:20 +0000 (UTC)
X-Forefront-Antispam-Report: CIP:131.107.125.8; KIP:(null); UIP:(null); IPV:NLI; H:TK5EX14MLTC101.redmond.corp.microsoft.com; RD:none; EFVD:NLI
X-SpamScore: -18
X-BigFish: VS-18(z1725nz9371I148cI542Mzz1202h1082kzz1033IL8275dhz2fh2a8h683h839h944hd25hf0ah107ah)
Received-SPF: pass (mail177-co1: domain of microsoft.com designates 131.107.125.8 as permitted sender) client-ip=131.107.125.8; envelope-from=tonynad@microsoft.com; helo=TK5EX14MLTC101.redmond.corp.microsoft.com ; icrosoft.com ;
X-Forefront-Antispam-Report-Untrusted: CIP:157.56.240.21; KIP:(null); UIP:(null); (null); H:BL2PRD0310HT001.namprd03.prod.outlook.com; R:internal; EFV:INT
Received: from mail177-co1 (localhost.localdomain [127.0.0.1]) by mail177-co1 (MessageSwitch) id 1341860117717249_14890; Mon, 9 Jul 2012 18:55:17 +0000 (UTC)
Received: from CO1EHSMHS002.bigfish.com (unknown [10.243.78.243]) by mail177-co1.bigfish.com (Postfix) with ESMTP id A3460480067 for <oauth@ietf.org>; Mon, 9 Jul 2012 18:55:17 +0000 (UTC)
Received: from TK5EX14MLTC101.redmond.corp.microsoft.com (131.107.125.8) by CO1EHSMHS002.bigfish.com (10.243.66.12) with Microsoft SMTP Server (TLS) id 14.1.225.23; Mon, 9 Jul 2012 18:55:16 +0000
Received: from va3outboundpool.messaging.microsoft.com (157.54.51.81) by mail.microsoft.com (157.54.79.178) with Microsoft SMTP Server (TLS) id 14.2.298.5; Mon, 9 Jul 2012 18:57:32 +0000
Received: from mail270-va3-R.bigfish.com (10.7.14.243) by VA3EHSOBE009.bigfish.com (10.7.40.29) with Microsoft SMTP Server id 14.1.225.23; Mon, 9 Jul 2012 18:55:14 +0000
Received: from mail270-va3 (localhost [127.0.0.1]) by mail270-va3-R.bigfish.com (Postfix) with ESMTP id 570782400B5 for <oauth@ietf.org.FOPE.CONNECTOR.OVERRIDE>; Mon, 9 Jul 2012 18:55:14 +0000 (UTC)
Received: from mail270-va3 (localhost.localdomain [127.0.0.1]) by mail270-va3 (MessageSwitch) id 1341860112697964_9653; Mon, 9 Jul 2012 18:55:12 +0000 (UTC)
Received: from VA3EHSMHS042.bigfish.com (unknown [10.7.14.236]) by mail270-va3.bigfish.com (Postfix) with ESMTP id A8D14380047; Mon, 9 Jul 2012 18:55:12 +0000 (UTC)
Received: from BL2PRD0310HT001.namprd03.prod.outlook.com (157.56.240.21) by VA3EHSMHS042.bigfish.com (10.7.99.52) with Microsoft SMTP Server (TLS) id 14.1.225.23; Mon, 9 Jul 2012 18:55:12 +0000
Received: from BL2PRD0310MB362.namprd03.prod.outlook.com ([169.254.12.220]) by BL2PRD0310HT001.namprd03.prod.outlook.com ([10.255.97.36]) with mapi id 14.16.0164.004; Mon, 9 Jul 2012 18:57:28 +0000
From: Anthony Nadalin <tonynad@microsoft.com>
To: Hannes Tschofenig <hannes.tschofenig@gmx.net>, OAuth WG <oauth@ietf.org>
Thread-Topic: [OAUTH-WG] Holder-of-the-Key for OAuth
Thread-Index: AQHNXf7R8o8oKGDddUekOoP+IJtc+pchTCgQ
Date: Mon, 09 Jul 2012 18:57:28 +0000
Message-ID: <B26C1EF377CB694EAB6BDDC8E624B6E74F979CF1@BL2PRD0310MB362.namprd03.prod.outlook.com>
References: <8FB1BC31-D183-47A0-9792-4FDF460AFAA1@gmx.net>
In-Reply-To: <8FB1BC31-D183-47A0-9792-4FDF460AFAA1@gmx.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [131.107.174.57]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OrganizationHeadersPreserved: BL2PRD0310HT001.namprd03.prod.outlook.com
X-FOPE-CONNECTOR: Id%0$Dn%*$RO%0$TLS%0$FQDN%$TlsDn%
X-FOPE-CONNECTOR: Id%59$Dn%GMX.NET$RO%2$TLS%6$FQDN%131.107.125.5$TlsDn%
X-FOPE-CONNECTOR: Id%59$Dn%IETF.ORG$RO%2$TLS%6$FQDN%131.107.125.5$TlsDn%
X-CrossPremisesHeadersPromoted: TK5EX14MLTC101.redmond.corp.microsoft.com
X-CrossPremisesHeadersFiltered: TK5EX14MLTC101.redmond.corp.microsoft.com
X-OriginatorOrg: microsoft.com
Subject: Re: [OAUTH-WG] Holder-of-the-Key for OAuth
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Jul 2012 18:57:12 -0000

Hannes, thanks for drafting this, couple of comments:

1. HOK is one of Proof of Possession methods, should we consider others?
2. This seems just to handle asymmetric keys, need to also handle symmetric keys


-----Original Message-----
From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of Hannes Tschofenig
Sent: Monday, July 09, 2012 11:15 AM
To: OAuth WG
Subject: [OAUTH-WG] Holder-of-the-Key for OAuth

Hi guys, 

today I submitted a short document that illustrates the concept of holder-of-the-key for OAuth. 
Here is the document: 
https://datatracker.ietf.org/doc/draft-tschofenig-oauth-hotk

Your feedback is welcome 

Ciao
Hannes

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email