Re: [oauth] OAUTH Charter Proposal

What about the following text: 

"
Furthermore, OAuth 1.0 defines three signature methods used to protect
requests, namely PLAINTEXT, HMAC-SHA1, and RSA-SHA1. The group will work
on new signature methods and will describe the environments where
additional security requirements justify their usage. Existing signature
methods will not be modified but may be dropped as part of the backwards
compatible profiling activity.
"

Ciao
Hannes

PS: There are lots of people out there who have a strong opinion about
different algorithms and usage modes. I wouldn't be surprised to spend
some time discussing different algorithms. 

________________________________

	From: ext Chris Messina [mailto:chris.messina@gmail.com] 
	Sent: 02 February, 2009 10:24
	To: Tschofenig, Hannes (NSN - FI/Espoo)
	Cc: oauth@ietf.org
	Subject: Re: [oauth] OAUTH Charter Proposal

	On Sun, Feb 1, 2009 at 11:00 PM, Tschofenig, Hannes (NSN -
FI/Espoo) <hannes.tschofenig@nsn.com> wrote:

		Second, w/r/t to this:

		       Furthermore, Oauth 1.0 defines three signature
methods used to
		protect requests, namely PLAINTEXT, HMAC-SHA1, and
RSA-SHA1. The group
		will work on new signature methods in case the existing
mechanisms do
		not fulfill the security requirements.

		Where are the "security requirements" coming from? Are
these defined
		separately? Whose are they?

		[hannes] I think a pragmatic approach is sensible here:
a document that
		describes a new mechanism might want to say what
requirements guided the
		solution and thereby provide some motivation.

		I was not thinking of an independent requirements
document. I don't
		think that it is well spent time.

	I agree.

	Maybe it was just the wording -- it sounded like there were some
definitive "security requirements" (or else you wouldn't be able to tell
if they were fulfilled!) but perhaps that's not what's intended there.

	I think I understand now: if you propose new security methods or
signing mechanisms, the document will describe why to use them in
situations with different security requirements. Ok.

	Thanks,

	Chris 

	-- 
	Chris Messina
	Citizen-Participant &
	 Open Web Advocate-at-Large

	factoryjoe.com # diso-project.org
	citizenagency.com # vidoop.com
	This email is:   [ ] bloggable    [X] ask first   [ ] private

_______________________________________________
oauth mailing list
oauth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth