Re: [OAUTH-WG] Shepherd Writeup for draft-ietf-oauth-spop-06.txt

Torsten Lodderstedt <torsten@lodderstedt.net> Wed, 18 February 2015 20:16 UTC

Return-Path: <torsten@lodderstedt.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 512271A0378 for <oauth@ietfa.amsl.com>; Wed, 18 Feb 2015 12:16:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.551
X-Spam-Level:
X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rsbqVhYqhimp for <oauth@ietfa.amsl.com>; Wed, 18 Feb 2015 12:16:00 -0800 (PST)
Received: from smtprelay03.ispgateway.de (smtprelay03.ispgateway.de [80.67.18.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFA9D1A02F1 for <oauth@ietf.org>; Wed, 18 Feb 2015 12:15:59 -0800 (PST)
Received: from [79.253.34.96] (helo=android-6af638abbd217564.speedport.ip) by smtprelay03.ispgateway.de with esmtpsa (TLSv1.2:DHE-RSA-AES256-SHA:256) (Exim 4.84) (envelope-from <torsten@lodderstedt.net>) id 1YOB2M-0003Xq-5B; Wed, 18 Feb 2015 21:15:58 +0100
User-Agent: K-9 Mail for Android
In-Reply-To: <54E4CCDD.6010709@gmx.net>
References: <54C7BBA4.4030702@gmx.net> <CA+k3eCQCPiAR0s1cX5mC=h2O-5ptVTVq6=cVKHFKu_Adq8bJTg@mail.gmail.com> <2E3D2EE7-8F5F-452D-880A-D62A513AC853@lodderstedt.net> <54E370F9.8060209@gmx.net> <17faabb6e724fb54f3cb8060a3d9cb08@lodderstedt.net> <54E4B0AD.10801@gmx.net> <CA+k3eCThg3TxRtCuEwGGWG07yWZD82i87fUQjDrKs3sMmd5frg@mail.gmail.com> <54E4CCDD.6010709@gmx.net>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----77J7C8ZENUURQJSLPRX13CCV40RG3X"
Content-Transfer-Encoding: 8bit
From: Torsten Lodderstedt <torsten@lodderstedt.net>
Date: Wed, 18 Feb 2015 21:15:52 +0100
To: Hannes Tschofenig <hannes.tschofenig@gmx.net>, Brian Campbell <bcampbell@pingidentity.com>
Message-ID: <06989626-BCCD-443B-AD5F-98436D681DB2@lodderstedt.net>
X-Df-Sender: dG9yc3RlbkBsb2RkZXJzdGVkdC5uZXQ=
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/VL1YvmIQ8AwIgKxva8R-_aOrnyo>
Cc: oauth <oauth@ietf.org>, "naa@google.com >> Naveen Agarwal" <naa@google.com>
Subject: Re: [OAUTH-WG] Shepherd Writeup for draft-ietf-oauth-spop-06.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Feb 2015 20:16:03 -0000

We don't plan to support s256 

Basically, I don't see a need to. Plain already mitigates the threat, spop/tcse had been designed to mitigate - an app intercepting the code response of a public client.

Am 18. Februar 2015 18:33:17 MEZ, schrieb Hannes Tschofenig <hannes.tschofenig@gmx.net>et>:
>Thanks Brian for pointing me to Section 4.4.1 and to the MTI for
>"S256".
>While this is good from a security point of view I am wondering whether
>anyone is actually compliant to the specification. Neither PingIdentity
>nor DT implements the S256 transform, if I understood that correctly.
>Are you guys going planning to update your implementations?
>
>Ciao
>Hannes
>
>On 02/18/2015 05:45 PM, Brian Campbell wrote:
>> There's a bit of MTI talk tucked into
>> https://tools.ietf.org/html/draft-ietf-oauth-spop-10#section-4.4.1
>that
>> perhaps needs to be expanded and/or placed somewhere else.
>> 
>> On Wed, Feb 18, 2015 at 8:33 AM, Hannes Tschofenig
>> <hannes.tschofenig@gmx.net <mailto:hannes.tschofenig@gmx.net>> wrote:
>> 
>>     Thanks for the info, Torsten.
>> 
>>     Your feedback raises an interesting question, namely what
>functionality
>>     the parties have to implement to claim conformance to the
>specification.
>> 
>>     Quickly scanning through the specification didn't tell me whether
>it is
>>     OK to just implement the plain mode or whether both modes are
>>     mandatory-to-implement. We have to say something about this.
>> 
>>     Ciao
>>     Hannes
>> 
>> 
>>     On 02/18/2015 02:16 PM, torsten@lodderstedt.net
>>     <mailto:torsten@lodderstedt.net> wrote:
>>     > Hi Hannes,
>>     >
>>     > our implementation supports the "plain" mode only. We just
>verified
>>     > compliance of our implementation with the current spec. As the
>only
>>     > deviation, we do not enforce the minimum length of 43
>characters
>>     of the
>>     > code verifier.
>>     >
>>     > kind regards,
>>     > Torsten.
>>     >
>>     > Am 17.02.2015 17:48, schrieb Hannes Tschofenig:
>>     >> Hi Torsten,
>>     >>
>>     >> does this mean that your implementation is not compliant with
>the
>>     >> current version anymore or that you haven't had time to verify
>>     whether
>>     >> there are differences to the earlier version?
>>     >>
>>     >> Ciao
>>     >> Hannes
>>     >>
>>     >>
>>     >> On 01/31/2015 05:34 PM, Torsten Lodderstedt wrote:
>>     >>> Deutsche Telekom also implemented an early version of the
>draft last
>>     >>> year.
>>     >>>
>>     >>>
>>     >>>
>>     >>> Am 30.01.2015 um 18:50 schrieb Brian Campbell
>>     >>> <bcampbell@pingidentity.com
><mailto:bcampbell@pingidentity.com>
>>     <mailto:bcampbell@pingidentity.com
>>     <mailto:bcampbell@pingidentity.com>>>:
>>     >>>
>>     >>>>
>>     >>>> On Tue, Jan 27, 2015 at 9:24 AM, Hannes Tschofenig
>>     >>>> <hannes.tschofenig@gmx.net
><mailto:hannes.tschofenig@gmx.net>
>>     <mailto:hannes.tschofenig@gmx.net
>>     <mailto:hannes.tschofenig@gmx.net>>> wrote:
>>     >>>>
>>     >>>>
>>     >>>>     1) What implementations of the spec are you aware of?
>>     >>>>
>>     >>>>
>>     >>>> We have an AS side implementation of an earlier draft that
>was
>>     >>>> released in June of last year:
>>     >>>>
>>    
>http://documentation.pingidentity.com/pages/viewpage.action?pageId=26706844
>>     >>>>
>>     >>>> _______________________________________________
>>     >>>> OAuth mailing list
>>     >>>> OAuth@ietf.org <mailto:OAuth@ietf.org>
><mailto:OAuth@ietf.org
>>     <mailto:OAuth@ietf.org>>
>>     >>>> https://www.ietf.org/mailman/listinfo/oauth
>> 
>> 

-- 
Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet.