Re: [OAUTH-WG] proposed resolution for PKCE in OAuth 2.1
Aaron Parecki <aaron@parecki.com> Mon, 11 May 2020 23:55 UTC
Return-Path: <aaron@parecki.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3084C3A0DBD for <oauth@ietfa.amsl.com>; Mon, 11 May 2020 16:55:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=parecki-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n2VplESQic2K for <oauth@ietfa.amsl.com>; Mon, 11 May 2020 16:55:31 -0700 (PDT)
Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4B6C3A0DAC for <oauth@ietf.org>; Mon, 11 May 2020 16:55:30 -0700 (PDT)
Received: by mail-io1-xd36.google.com with SMTP id j8so11893167iog.13 for <oauth@ietf.org>; Mon, 11 May 2020 16:55:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=parecki-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=UUArDRNV9aOiFwwf7Y/KEBQcUpga9QNHY09JfObMtqg=; b=cscjbaGwav4hW5fsVLCnutlN3KU6NhaZqKHBeKcrHhL9XwJcUVku/8io7A1zHR4o/0 EVXMM7Yuz90Urbo25Z3UhvY2FPYa2iKIlMkQvUfF9fvWvaBgCJWeRVWFAxu1MlB78lUJ Q91sRVgF004IJIOlEkXprqxxpz2f8R4zdTexW87wd0ZRgIFFEbCUgJfbx3IwQf8NT8BP J4l2ipa6J7gs3p21SGj6NTmQ4GOF2ectyrWGuSnL8XdfWFRfW5UzTu4XD6D50yPFgl7L 0eHGAzQOPwWIzsCoot+wcjcMCg03b3dnKMj63g7ziLU187krpFEtuuZyaQhoPTCYlmCk pQRw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=UUArDRNV9aOiFwwf7Y/KEBQcUpga9QNHY09JfObMtqg=; b=Ra2cCFQSPy8MXlMQRH28+g6X4vspcz29Gi5Mp+eigqet+NyRP1TJfBu6a1X931syrb PhpDPK+y21yoAODv3hQya687XtT/+nmg6QtQp7lTnWEqwH9yULa6IxU9eo85xcpI9GA1 BLp0O9SUIH+opMa78f8kU9uusglVOwAXdkgZwcUah1TcpSRC4kdyWw2UBAoG3uhabld2 2ND36U5kXEEpoVdIz+oO2iuQYrcaJvmWnsqMG04rUnXm4MafHTH8igkjPJIMbmDwZqFo puZNnDR9O4f12J98eJ2eUCxRgI5GV5DrDHrG2Ew/3k+YeJcT7oBmkTWb10+VamQJtASY sm5g==
X-Gm-Message-State: AGi0PuZSfafPrZrXZbJIA/NFptAbMdROQ1SXfuD8qMcmVbRTRRjAOezC 9/PuiPaZtakR1Ijb5DrJUrSkP51Ven0=
X-Google-Smtp-Source: APiQypJpv8DRYmdiHMHFaxnNKPevf8K1hADXCvxQokn9B2cpOhcbqOx8TdLkFiNBbyl0nBcc6ijrsg==
X-Received: by 2002:a05:6602:164c:: with SMTP id y12mr17085631iow.138.1589241329521; Mon, 11 May 2020 16:55:29 -0700 (PDT)
Received: from mail-io1-f44.google.com (mail-io1-f44.google.com. [209.85.166.44]) by smtp.gmail.com with ESMTPSA id e13sm2643409ils.27.2020.05.11.16.55.28 for <oauth@ietf.org> (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 11 May 2020 16:55:28 -0700 (PDT)
Received: by mail-io1-f44.google.com with SMTP id d7so11937887ioq.5 for <oauth@ietf.org>; Mon, 11 May 2020 16:55:28 -0700 (PDT)
X-Received: by 2002:a6b:ea11:: with SMTP id m17mr11754763ioc.149.1589241328136; Mon, 11 May 2020 16:55:28 -0700 (PDT)
MIME-Version: 1.0
References: <CAGBSGjpRr=pHcX=ppHJygCC25ZZ8xVQztrviDyYq4yvG6KJ7YA@mail.gmail.com> <450592A8-C609-424D-B321-F9CD3DBAEFB0@forgerock.com>
In-Reply-To: <450592A8-C609-424D-B321-F9CD3DBAEFB0@forgerock.com>
From: Aaron Parecki <aaron@parecki.com>
Date: Mon, 11 May 2020 16:55:17 -0700
X-Gmail-Original-Message-ID: <CAGBSGjqCAVe8BfkZevda0uTLHDj2DB+QJRw6TE=RHtBXFOVgbw@mail.gmail.com>
Message-ID: <CAGBSGjqCAVe8BfkZevda0uTLHDj2DB+QJRw6TE=RHtBXFOVgbw@mail.gmail.com>
To: OAuth WG <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000d3838905a56814f9"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/Rf5vlpMVIKVgCIeMGJz5IfPFBTI>
Subject: Re: [OAUTH-WG] proposed resolution for PKCE in OAuth 2.1
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 11 May 2020 23:55:33 -0000
Thank you Neil. To address Mike's concerns in the previous threads, I would like to also update section 9.7 with the following text: Clients MUST prevent injection (replay) of authorization codes into the authorization response by attackers. The use of the `code_challenge` parameter is RECOMMENDED to this end. For confidential clients, the OpenID Connect `nonce` parameter and ID Token Claim {{OpenID}} MAY be used instead of or in addition to the `code_challenge` parameter for this purpose. The `code_challenge` or OpenID Connect `nonce` value MUST be transaction-specific and securely bound to the client and the user agent in which the transaction was started. This change better clarifies the specific circumstances under which the "nonce" parameter is sufficient to protect against authorization code injection. Aaron Parecki On Mon, May 11, 2020 at 11:55 AM Neil Madden <neil.madden@forgerock.com> wrote: > I am happy with this proposed wording. Thanks for updating it. > > — Neil > > On 11 May 2020, at 19:52, Aaron Parecki <aaron@parecki.com> wrote: > > Thanks for the lively discussion around PKCE in OAuth 2.1 everyone! > > We would like to propose the following text, which is a slight variation > from the text Neil proposed. This would replace the paragraph in 4.1.2.1 ( > https://tools.ietf.org/html/draft-parecki-oauth-v2-1-02#section-4.1.2.1) > that begins with "If the client does not send the "code_challenge" in the > request..." > > "An AS MUST reject requests without a code_challenge from public clients, > and MUST reject such requests from other clients unless there is reasonable > assurance that the client mitigates authorization code injection in other > ways. See section 9.7 for details." > > Section 9.7 is where the nuances of PKCE vs nonce are described. > > As Neil described, we believe this will allow ASs to support both OAuth > 2.0 and 2.1 clients simultaneously. The change from Neil's text is the > clarification of which threats, and changing to MUST instead of SHOULD. The > "MUST...unless" is more specific than "SHOULD", and since we are already > describing the explicit exception to the rule, it's more clear as a MUST > here. > > Aaron Parecki > > > > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth > > >
- [OAUTH-WG] proposed resolution for PKCE in OAuth … Aaron Parecki
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Neil Madden
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Aaron Parecki
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Mike Jones
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Torsten Lodderstedt
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Nov Matake
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Torsten Lodderstedt
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Nov Matake
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Mike Jones
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Aaron Parecki
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Nov Matake
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Daniel Fett
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Torsten Lodderstedt
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Nov Matake
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Daniel Fett
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Nov Matake
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Mike Jones
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Nov Matake
- Re: [OAUTH-WG] proposed resolution for PKCE in OA… Aaron Parecki
- Re: [OAUTH-WG] [EXTERNAL] Re: proposed resolution… Mike Jones
- Re: [OAUTH-WG] [EXTERNAL] Re: proposed resolution… Dick Hardt