Re: [OAUTH-WG] New OAuth DPoP and Security BCP drafts

Hello Daniel, everyone,

I don't know if this belongs to the DPoP document itself or each respective
BCP (especially Browser-Based Apps), but one of the documents should give
recommendation to implementers on how to

   1. generate the unique private keys per installation / browser session
   2. platform specific storage for them (e.g. in between browser
   navigation / app launches)

I come asking for this guidance especially for the Browser-Based App use
case. I think the clear recommendation is to use the Web Cryptography API
<https://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-generateKey> (with
extractable: false) for (1) and IndexedDB API
<https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API> for (2),
but the more important question is how to deal with lack of those APIs in
browsers that are known to not support them or be buggy (see data in
https://caniuse.com), so

   - is it ok to use other means of generating the key when webcrypto is
   not available?
   - is it ok to generate keys through webcrypto (or other means) that are
   extractable and store them via other means than IndexedDB when indexed DB
   is not available, such as cookie or localstorage.

Best,
*Filip*

On Mon, 8 Jul 2019 at 15:30, Daniel Fett <danielf+oauth@yes.com> wrote:

> All,
>
> In preparation for the meeting in Montreal, I just uploaded a new version
> of the DPoP draft:
> https://tools.ietf.org/html/draft-fett-oauth-dpop-02
>
> Please have a look and let me know what you think. We should make this a
> working group item soon.
>
> As you might have noticed, there is also a new version of the Security
> Best Current Practice draft:
> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13
>
> -Daniel
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>