Re: [OAUTH-WG] Operations Directorate Review of draft-ietf-oauth-v2-threatmodel-06

["Romascanu, Dan (Dan)" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of
> Barry Leiba
> Sent: Sunday, July 08, 2012 6:37 PM
> To: Romascanu, Dan (Dan)
> Cc: [e-mail]; [e-mail];
> [e-mail]; [e-mail]; [e-mail]
> Subject: Re: Operations Directorate Review of draft-ietf-oauth-v2-
> threatmodel-06
> 
> > 1. The relation between this document, OAuth 1.0 (RFC 5849) and
OAuth
> > 2.0 is not clear. In the Introduction we find:
> >
> >    This document gives additional security considerations for OAuth,
> >    beyond those in the OAuth specification, based on a comprehensive
> >    threat model for the OAuth 2.0 Protocol [I-D.ietf-oauth-v2].
> >
> > (would be good to provide a referent for the 'OAuth specification' -
> > probably RFC 5489)
> 
> It does have a citation, right there: [I-D.ietf-oauth-v2].  That is
> the OAuth specification.  I suppose we could move the citation to be
> after the word "specification", though no one else has been confused
> by this.
> 
> > but then says the document
> >
> >       - Gives a comprehensive threat model for OAuth and describes
the
> >       respective counter measures to thwart those threats.
> >
> > So is the scope of the document the threats beyond what is described
> in
> > OAuth 1.0, or all the threats?
> 
> It has nothing to do with OAuth 1.0, and I don't think it says that
> anywhere.  It's OAuth 2.0, as noted in the citation.  It expands on
> what's in the Security Considerations of the OAuth spec, and covers
> threats that are not described there as well.  The OAuth spec has an
> informative reference to this document.

Barry,

I believe that the words 'additional' and 'beyond' create in the first
quoted paragraph create the confusion. Saying ' This document gives
additional security considerations for OAuth, beyond those in the OAuth
specification ' is not the same as saying ' This document gives security
considerations for OAuth based on the OAuth specification (and by the
way, when we say this we mean OAuth 2.0 and nothing else)'.

Regards,

Dan