IETF Logo Mail Archive

Re: [OAUTH-WG] AD review of Draft-ietf-dyn-reg

John Bradley <ve7jtb@ve7jtb.com> Wed, 18 February 2015 15:08 UTC

Return-Path: <ve7jtb@ve7jtb.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 578211A893E for <oauth@ietfa.amsl.com>; Wed, 18 Feb 2015 07:08:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, J_CHICKENPOX_62=0.6, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h5KgtGZheiQM for <oauth@ietfa.amsl.com>; Wed, 18 Feb 2015 07:08:16 -0800 (PST)
Received: from mail-pd0-f180.google.com (mail-pd0-f180.google.com [209.85.192.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07E831A923D for <oauth@ietf.org>; Wed, 18 Feb 2015 07:08:15 -0800 (PST)
Received: by pdjz10 with SMTP id z10so1748767pdj.0 for <oauth@ietf.org>; Wed, 18 Feb 2015 07:08:15 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=1g9ba2c3VEyzPtkc+bHty54xHwn8YKh4NDbNGymt6Ms=; b=JAwMCMLFvSn/F+DBOR3Sjkzo+d0+6dQBESGYF0FuigaCWcm188QOqoaMfXY3qQCJwN FyhNgXtRClzPz2VyJJBSckWggAR0DgBm0Kvs7/8+EWOADDPyF4Qeto9J3jzHB4GWkkCG 70nVKc7dKg44rtWHQLMiIBr53u8EN1tcXzPHylH94PGLvusZKt9+NP0QQfGkFE/m219m HgYV4aRKURHJWtaQhI9MovXEerlR3siE0dYOHaQTrJ+tOIBGjrktXttAEW1JAAEuVe2E CKE+aR7KBTyAs666zkZPboSXYUnOichdM83G8P0M1DeDZrL1EY99fEt+czjtNAL4rovB U7Hw==
X-Gm-Message-State: ALoCoQmunOTNq3Ure9vlLF6C1PIOR2iF+V8MFv47qg+n1JY5/4xsWWOVRLDwwDO1kiO3LP6Yw2B0
X-Received: by 10.70.61.130 with SMTP id p2mr59987645pdr.0.1424272094675; Wed, 18 Feb 2015 07:08:14 -0800 (PST)
Received: from [10.1.1.16] (75-149-33-126-SFBA.hfc.comcastbusiness.net. [75.149.33.126]) by mx.google.com with ESMTPSA id gi6sm20826744pbd.93.2015.02.18.07.08.12 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 18 Feb 2015 07:08:13 -0800 (PST)
Content-Type: multipart/signed; boundary="Apple-Mail=_12E6CA57-8905-4D03-A769-924BF9CE8B6E"; protocol="application/pkcs7-signature"; micalg="sha1"
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2070.6\))
From: John Bradley <ve7jtb@ve7jtb.com>
In-Reply-To: <CAHbuEH5NUcQ5Q30yj80OSBe4epaarpkFroyM_Yfp5-thkMJBgA@mail.gmail.com>
Date: Wed, 18 Feb 2015 07:07:57 -0800
Message-Id: <1766F429-C82D-471D-BCE9-F8E5F234CE3C@ve7jtb.com>
References: <CAHbuEH587HcqaqTMrmLPXQimRAaS2j1Uv+BC-0UHeyBwC8+3Uw@mail.gmail.com> <54DC2CB1.8090400@mit.edu> <D3644538-EF35-476B-8158-270C8FC21647@oracle.com> <4E1F6AAD24975D4BA5B1680429673943A222C933@TK5EX14MBXC290.redmond.corp.microsoft.com> <CAHbuEH5NUcQ5Q30yj80OSBe4epaarpkFroyM_Yfp5-thkMJBgA@mail.gmail.com>
To: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
X-Mailer: Apple Mail (2.2070.6)
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/UphrGZgsbaJiDNyyIVRXvFtX8IM>
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] AD review of Draft-ietf-dyn-reg
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Feb 2015 15:08:19 -0000

snip
> On Feb 18, 2015, at 6:46 AM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:
> 
> > The client_id *could* be short lived, but they usually aren't. I don't see any particular logging or tracking concerns using a dynamic OAuth client above using any other piece of software, ever. As such, I don't think it requires special calling out here.
> 
> Help me understand why there should not be text that shows this is not an issue or please propose some text.  This is bound to come up in IESG reviews if not addressed up front. 
> 

The client_id is used to communicate to the Authorization server to get a code or refresh token.  Those tokens uniquely identify the user from a privacy perspective. 
It is the access tokens that are sent to the RS and those can and should be rotated, but the client)id is not sent to the RS in OAuth as part of the spec. 

If you did rotate the client_id then the AS would track it across rotations, so it wouldn’t really achieve anything.

One thing we don’t do is allow the client to specify the client_id, that could allow correlation of the client across multiple AS and that might be a privacy issue, but we don’t allow it.

John B.

v2.19.0 | Report a Bug | By Email