Re: [OAUTH-WG] Auth Server / Resource Server Coordination

> With asymmetric keys you won't have these problems. The RS would only
need to have a copy of the public AS key to verify the tokens.

That's an excellent point I had considered.

-ofer

On Tue, Oct 13, 2015 at 4:40 AM, Vladimir Dzhuvinov <vladimir@connect2id.com
> wrote:

>
>
> On 13.10.2015 07:37, Ofer Nave wrote:
> >> You do have decisions to make on whether you use symmetric crypto or PK
> > there.
> >
> > That's another thing I was pondering -- simple shared secret, or require
> > generated a private/public key pair.
> >
> > The asymetric form is a little more complicated in terms of the user
> > experience.  Is there a practical reason to prefer it?
>
> If the AS and the Resource Servers (RS) share a secret, there is a risk
> of an RS impersonating authorised clients by creating valid tokens to
> access other RSs.
>
> You may prevent this by making sure every RS gets its own secret, but in
> that case you cannot issue tokens with multiple RS audiences.
>
> With asymmetric keys you won't have these problems. The RS would only
> need to have a copy of the public AS key to verify the tokens.
>
>
> Vladimir
>
> --
> Vladimir Dzhuvinov
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>