Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-mac-03.txt
William Mills <wmills_92105@yahoo.com> Thu, 28 February 2013 17:49 UTC
Return-Path: <wmills_92105@yahoo.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 995B521F8C3D for <oauth@ietfa.amsl.com>; Thu, 28 Feb 2013 09:49:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.351
X-Spam-Level:
X-Spam-Status: No, score=-2.351 tagged_above=-999 required=5 tests=[AWL=0.247, BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GWCWYfDm8yqb for <oauth@ietfa.amsl.com>; Thu, 28 Feb 2013 09:49:05 -0800 (PST)
Received: from nm23-vm3.bullet.mail.ne1.yahoo.com (nm23-vm3.bullet.mail.ne1.yahoo.com [98.138.91.153]) by ietfa.amsl.com (Postfix) with ESMTP id 1CFF721F8C1E for <oauth@ietf.org>; Thu, 28 Feb 2013 09:49:05 -0800 (PST)
Received: from [98.138.226.179] by nm23.bullet.mail.ne1.yahoo.com with NNFMP; 28 Feb 2013 17:49:04 -0000
Received: from [98.138.89.249] by tm14.bullet.mail.ne1.yahoo.com with NNFMP; 28 Feb 2013 17:49:04 -0000
Received: from [127.0.0.1] by omp1041.mail.ne1.yahoo.com with NNFMP; 28 Feb 2013 17:49:04 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 479363.66503.bm@omp1041.mail.ne1.yahoo.com
Received: (qmail 16724 invoked by uid 60001); 28 Feb 2013 17:49:04 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1362073744; bh=mrYomm8vFQW2hD3V7yfztnCCG1bIqPyW9zBJ7g9mptU=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=umapFkEeTwJLhQ5lRFWomxGqOhIiMjMPjToIuzQeXl8M1b0Aj5v7eoVuPa/Nls0oqRR/5GgjSHjfUMHLPoPFzXABk9Zqqn7nooAR1nBSBki/PeX+d3/La81TqlAOe1zdRiteiE0NcpQpKOv7PgbPhsI5ifoMhpn/IbSeQs+MnGY=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=jXhvUnMU0cxVRZQJWzPeFfju54ldJuVGJjG3S2rJ2dNDWxIAEzuxXE7v4cVtQIQeh4ybHJRHauo6lAnB9d97RKuqSadfsbX6fk6CN17XL97FZ+FYaNrljJti44+DUoTLUTklGhN2cIHO3HwcEmRKlZHVV1FKvEz/kvpK4WJnCoM=;
X-YMail-OSG: eA1c8oQVM1mwMzlttLvZTR1eTlAVgD1UjikSmyR6fjnyw0B zorWI_FPnbSeMsPfZiWbNA6OdUSoKucxDnwMxB.lWVew9xqqGwPypd7qtWTj 3x1_FMXdZs0jknTv1GMtrYVNUxhycn8fob5.Ne_EpL_IwzmmGvUZAqc4jFFb YmNGdtQp89p8ixyVQzYbrrtPtPAieqXNsFcU41eJmIZPxFr8XVVMwdTa0Prg Qe3IEswwhV1bZfoeO6sv6foceqvSYIjFC30ASDbyGGbT0F91_xXHX3l2LOiR hCmFqb7L4pVuUJv9s02qdkI83HTxvWWlhOdUnnyLu2AtA4rc.16jcu_2ua4O myUmxEpNJ9TF2ereZLC0h66Xf5GCHMNB_yVrGuVgcJHKvrcNLtLvZzJ2DdIE dUBW7Ms1UOAp3k_Ag7xbJboL7bLdJGzDEXTh1wY4sGW6balhqiHHnDVTzkjO ZoadyoMbwVvjIjFJgvdvdMYg_NDQZlyzonyH2HIvJCGWUbEisv9nxIWy9NyZ nIlHHsVzVysWfA2bSqCWjZwEAhUa53kXu8znH8eFEA9iGJHISck9wwhGHRsZ d
Received: from [209.131.62.115] by web31802.mail.mud.yahoo.com via HTTP; Thu, 28 Feb 2013 09:49:03 PST
X-Rocket-MIMEInfo: 001.001, VGhlIEpXVCByZXBsYWNlcyB0aGUgb2F1dGhfdG9rZW4gZGF0YSBlbGVtZW50IGluIHRoZSBvbGQgTUFDIHN0dWZmLiDCoEkganVzdCB3YW50IHRvIHRha2UgYWxsIHRoZSBvdGhlciBvYXV0aF8qIHZhcmlhYmxlcyBhbmQgc3R1ZmYgdGhlbSBpbiBhIHNlcGFyYXRlIEpTT04gb2JqZWN0IGFuZCBjb21wbGV0ZWx5IGtpbGwgdGhlICJmdW4gd2l0aCBzb3J0aW5nIHZhcmlhYmxlcyIgd2hlbiB0aGUgb2F1dGhfKiB0aGluZ3MgY2FuIGJlIGNhcnJpZWQgaW4gdGhlIHF1ZXJ5IHN0cmluZyBvciBoZWFkZXIgb3IgcG8BMAEBAQE-
X-Mailer: YahooMailWebService/0.8.135.514
References: <20130225124642.7425.65145.idtracker@ietfa.amsl.com> <1361956373.9883.YahooMailNeo@web31807.mail.mud.yahoo.com> <21030204-8EA7-4FB0-9DD3-2B6C8CA57E02@gmx.net> <1362057295.36069.YahooMailNeo@web31809.mail.mud.yahoo.com> <512F8E1D.2060408@gmail.com>
Message-ID: <1362073743.15800.YahooMailNeo@web31802.mail.mud.yahoo.com>
Date: Thu, 28 Feb 2013 09:49:03 -0800
From: William Mills <wmills_92105@yahoo.com>
To: Sergey Beryozkin <sberyozkin@gmail.com>, "oauth@ietf.org" <oauth@ietf.org>
In-Reply-To: <512F8E1D.2060408@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-1036955950-98993306-1362073743=:15800"
Subject: Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-mac-03.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: William Mills <wmills_92105@yahoo.com>
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Feb 2013 17:49:06 -0000
The JWT replaces the oauth_token data element in the old MAC stuff. I just want to take all the other oauth_* variables and stuff them in a separate JSON object and completely kill the "fun with sorting variables" when the oauth_* things can be carried in the query string or header or post body. ________________________________ From: Sergey Beryozkin <sberyozkin@gmail.com> To: oauth@ietf.org Sent: Thursday, February 28, 2013 9:04 AM Subject: Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-mac-03.txt Hi On 28/02/13 13:14, William Mills wrote: > I'm actually advocating that we change MAC to be a JWT extension. IMHO, having a simpler option, plus, going forward, a possible JWT profile (client to RS path) would work better - Why would JWT completely take over ? May be it should be possible indeed to have it as a JWT extension - should it be part of the relevant JWT assertion spec, where JWT is used as a possible grant ? Thanks, Sergey > > ------------------------------------------------------------------------ > *From:* Hannes Tschofenig <hannes.tschofenig@gmx.net> > *To:* William Mills <wmills_92105@yahoo.com> > *Cc:* Hannes Tschofenig <hannes.tschofenig@gmx.net>; "oauth@ietf.org" > <oauth@ietf.org> > *Sent:* Thursday, February 28, 2013 2:28 AM > *Subject:* Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-mac-03.txt > > Hi Bill, > > I believe you are misreading the document. In > draft-ietf-oauth-v2-http-mac the client still uses the MAC when it > accesses a protected resource. > The only place where the JWT comes into the picture is with the > description of the access token. This matters from a key distribution > point of view. The session key for the MAC is included in the encrypted > JWT. The JWT is encrypted by the authorization server and decrypted by > the resource server. > > Information about how header fields get included in the MAC is described > in Section 5. > > The nonce isn't killed it is just called differently: seq-nr. The stuff > in the original MAC specification actually wasn't a nonce (from the > semantic point of view). > The extension parameter is there implicitly by allowing additional > header fields to be included in the MAC computation. > > I need to look at the port number field again. > > Ciao > Hannes > > On Feb 27, 2013, at 11:12 AM, William Mills wrote: > > > Just read the draft quickly. > > > > Since we're now leaning on JWT do we need to include the token in > this? Why not just make an additional "Envelope MAC" thing and have the > signature include the 3 JWT parts in the signature base string? That > object then just becomes a JSON container for the kid, timestamp, > signature method, signature etc. That thing then is a 4th base64 encoded > JSON thing in the auth header. > > > > How header fields get included in the signature needs definition. > > > > Why did you kill the port number, nonce, and extension parameter out > of the signature base string? > > > > The BNF appears to have no separators between values. > > > > -bill > > > > > > From: "internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>" > <internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>> > > To: i-d-announce@ietf.org <mailto:i-d-announce@ietf.org> > > Cc: oauth@ietf.org <mailto:oauth@ietf.org> > > Sent: Monday, February 25, 2013 4:46 AM > > Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-mac-03.txt > > > > > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > > This draft is a work item of the Web Authorization Protocol Working > Group of the IETF. > > > > Title : OAuth 2.0 Message Authentication Code (MAC) Tokens > > Author(s) : Justin Richer > > William Mills > > Hannes Tschofenig > > Filename : draft-ietf-oauth-v2-http-mac-03.txt > > Pages : 26 > > Date : 2013-02-25 > > > > Abstract: > > This specification describes how to use MAC Tokens in HTTP requests > > to access OAuth 2.0 protected resources. An OAuth client willing to > > access a protected resource needs to demonstrate possession of a > > crytographic key by using it with a keyed message digest function to > > the request. > > > > The document also defines a key distribution protocol for obtaining a > > fresh session key. > > > > > > The IETF datatracker status page for this draft is: > > https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-http-mac > > > > There's also a htmlized version available at: > > http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-03 > > > > A diff from the previous version is available at: > > http://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-v2-http-mac-03 > > > > > > Internet-Drafts are also available by anonymous FTP at: > > ftp://ftp.ietf.org/internet-drafts/ > > > > _______________________________________________ > > OAuth mailing list > > OAuth@ietf.org <mailto:OAuth@ietf.org> > > https://www.ietf.org/mailman/listinfo/oauth > > > > > > > > > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
- [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-m… internet-drafts
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… William Mills
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… William Mills
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Hannes Tschofenig
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Antonio Sanso
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… William Mills
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Sergey Beryozkin
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Justin Richer
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… John Bradley
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Sergey Beryozkin
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… William Mills
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… William Mills
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Justin Richer
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Sergey Beryozkin
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… William Mills
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Phil Hunt
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Sergey Beryozkin
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… William Mills
- Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-ht… Sergey Beryozkin