Re: [oauth] OAUTH Charter Proposal

Hi Chris, 

First, small typo: "OAuth consist of:" should be "OAuth consists of:"

[hannes] Thanks. Fixed.

Second, w/r/t to this:

	Furthermore, Oauth 1.0 defines three signature methods used to
protect requests, namely PLAINTEXT, HMAC-SHA1, and RSA-SHA1. The group
will work on new signature methods in case the existing mechanisms do
not fulfill the security requirements. 

Where are the "security requirements" coming from? Are these defined
separately? Whose are they?

[hannes] I think a pragmatic approach is sensible here: a document that
describes a new mechanism might want to say what requirements guided the
solution and thereby provide some motivation.  

I was not thinking of an independent requirements document. I don't
think that it is well spent time. 

Ciao
Hannes

Chris 

_______________________________________________
oauth mailing list
oauth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth