From nobody Fri Nov 6 13:46:34 2020 Return-Path: X-Original-To: oauth@ietfa.amsl.com Delivered-To: oauth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E8173A0D79 for ; Fri, 6 Nov 2020 13:46:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.846 X-Spam-Level: X-Spam-Status: No, score=-1.846 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_FONT_FACE_BAD=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9vu7iea-syib for ; Fri, 6 Nov 2020 13:46:30 -0800 (PST) Received: from mail-yb1-xb36.google.com (mail-yb1-xb36.google.com [IPv6:2607:f8b0:4864:20::b36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 93E843A0D73 for ; Fri, 6 Nov 2020 13:46:30 -0800 (PST) Received: by mail-yb1-xb36.google.com with SMTP id i193so2402332yba.1 for ; Fri, 06 Nov 2020 13:46:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=7zBNd/cZxXflq7PFSD7rwRABvysygC8BML4lUkkyTPI=; b=LdXt9nt7TDe2mNsUazuIeCCRv6kUYTAJr87vaF9KlPsN5rJN6knHzyfJDkFwnD6xBe oQy2y4ImPxyYRGMnq+b/JbT69P++0jU5BrJHn4yZRDdvVTJaCZV7L5PEfH8pfBTwWKxJ 9kHgnQkFOFqtJ84R5i7Y4hyga+3jABfHuAwFT72X1Ygjt0H2Z/5sif6SnlWz21sNrHrc 0/+vTE15E4zOCPYjVqHf1jndN7KH9RyxfIGjBimnjxTtFZZyqBZBW+lHr//N3s7Cn4v4 unWf7h77aVuAUb8VEvj81rohoBxlwLT6QdGAyNXYlaiuu2xvmx5DcoAoWRTatQqcmXsm G6xQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7zBNd/cZxXflq7PFSD7rwRABvysygC8BML4lUkkyTPI=; b=Zwo1h+ARHPCfM0TwkZl1zYnBHUACniRcj38pMGQ3Puj0/iS+EjlIPZyqlB98Oxla51 fJAXZR82M3DJg4JVcorC28J6U0RAEXeszMFIrQ80uxIggK8OvNWa/9F4I1JuX3t8APNf ZGs/2GzFKhynfRfXVSngfkURrtTHtH/2OZc93p0lElxNIkbgiUiaox8iWnOAcbpT3Rts 0sKksV7Rs287HzPOxO58KxxkaVSBpEXwFeYwTG4D9FZ2Q+JtH2IgLEmQryT/GyOCV7wh ld8INulKNYaxUmEqd4BqVWF7Fe/CJzEwdj4SnZF6T8+NAAdu48MqTTPjVCCbVxKuNWut pgyA== X-Gm-Message-State: AOAM531BvQsGMPW/ZrCiQQuWn48bxFRpttJUMDY7XY6OtuEZVwrJII9W IFWfzLS+Yi4M5is8x37mPSSRmzYo+dN3u4+7Q67cu+lx X-Google-Smtp-Source: ABdhPJzXivHUEnuLYeY8h1UD+ujmd4OLsEVipWGRF2Ztc7HQNCtzGcKUHSxPaDjZcYHOLk+Vnbp6M5QMM4t6kbPyX8U= X-Received: by 2002:a25:900b:: with SMTP id s11mr5945396ybl.468.1604699189621; Fri, 06 Nov 2020 13:46:29 -0800 (PST) MIME-Version: 1.0 References: <160430230298.9780.18195581822860811409@ietfa.amsl.com> In-Reply-To: From: Pretty Little Wife Date: Fri, 6 Nov 2020 14:46:19 -0700 Message-ID: To: Karsten Meyer zu Selhausen Cc: oauth@ietf.org Content-Type: multipart/alternative; boundary="0000000000002b375905b377259f" Archived-At: Subject: Re: [OAUTH-WG] Fwd: New Version Notification for draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt X-BeenThere: oauth@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OAUTH WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Nov 2020 21:46:33 -0000 --0000000000002b375905b377259f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Karsten, I'm not sure why I'm on this email chain. Would you kindly remove my email= ? Thanks, Kristen On Mon, Nov 2, 2020, 12:54 AM Karsten Meyer zu Selhausen < karsten.meyerzuselhausen@hackmanit.de> wrote: > Hi all, > > Daniel and I published a new version of the "iss" response parameter draf= t > to address the feedback from the WG. > > Changes in -01: > > - Incorporated first WG feedback > - Clarifications for use with OIDC > - Added note that clients supporting just one AS are not vulnerable > - Renamed metadata parameter > - Various editorial changes > > > We would like to ask you for further feedback and comments on the new > draft version. > > Best regards, > Karsten > > -------- Forwarded Message -------- > Subject: New Version Notification for > draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt > Date: Sun, 01 Nov 2020 23:31:42 -0800 > From: internet-drafts@ietf.org > To: Karsten Meyer zu Selhausen > , Karsten zu Selhausen > > , Daniel Fett > > > > A new version of I-D, draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt > has been successfully submitted by Karsten Meyer zu Selhausen and posted > to the > IETF repository. > > Name: draft-meyerzuselhausen-oauth-iss-auth-resp > Revision: 01 > Title: OAuth 2.0 Authorization Server Issuer Identifier in Authorization > Response > Document date: 2020-11-01 > Group: Individual Submission > Pages: 10 > URL: > https://www.ietf.org/archive/id/draft-meyerzuselhausen-oauth-iss-auth-res= p-01.txt > Status: > https://datatracker.ietf.org/doc/draft-meyerzuselhausen-oauth-iss-auth-re= sp/ > Html: > https://www.ietf.org/archive/id/draft-meyerzuselhausen-oauth-iss-auth-res= p-01.html > Htmlized: > https://tools.ietf.org/html/draft-meyerzuselhausen-oauth-iss-auth-resp-01 > Diff: > https://www.ietf.org/rfcdiff?url2=3Ddraft-meyerzuselhausen-oauth-iss-auth= -resp-01 > > Abstract: > This document specifies a new parameter "iss" that is used to > explicitly include the issuer identifier of the authorization server > in the authorization response of an OAuth authorization flow. If > implemented correctly, the "iss" parameter serves as an effective > countermeasure to "mix-up attacks". > > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > The IETF Secretariat > > > -- > Karsten Meyer zu Selhausen > IT Security Consultant > Phone: +49 (0)234 / 54456499 > Web: https://hackmanit.de | IT Security Consulting, Penetration Testing, = Security Training > > Does your OAuth or OpenID Connect implementation use PKCE to strengthen t= he security? Learn more about the procetion PKCE provides and its limitatio= ns in our new blog post:https://www.hackmanit.de/en/blog-en/123-when-pkce-c= annot-protect-your-confidential-oauth-client > > Hackmanit GmbH > Universit=C3=A4tsstra=C3=9Fe 60 (Exzenterhaus) > 44789 Bochum > > Registergericht: Amtsgericht Bochum, HRB 14896 > Gesch=C3=A4ftsf=C3=BChrer: Prof. Dr. J=C3=B6rg Schwenk, Prof. Dr. Juraj S= omorovsky, Dr. Christian Mainka, Dr. Marcus Niemietz > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth > --0000000000002b375905b377259f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi=C2=A0Karsten,

I'm not sure why I'm on this email chain.=C2=A0 Would you kind= ly remove my email?

Than= ks,
Kristen

On Mon, Nov 2, 2020, 12:54 AM Karst= en Meyer zu Selhausen <karsten.meyerzuselhausen@hackmanit.de> wrote:
=20 =20 =20

Hi all,

Daniel and I published a new version of the "iss" response parameter draft to address = the feedback from the WG.

Changes in -01:

  • Incorporated first WG feedback
  • Clarifications for use wit= h OIDC
  • Added note that clients supporting just one AS are not vulnerable
  • Renamed metadata parameter=
  • Various editorial changes<= br>

We would like to ask you for further feedback and comments on the new draft version.

Best regards,
Karsten

-------- Forwarded Message --------
Subject: New Version Notification for draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt
Date: Sun, 01 Nov 2020 23:31:42 -0800
From: internet-drafts@ietf.org
To: Karsten Meyer zu Selhausen <karsten.meyerzuselhausen@hackmanit.de&= gt;, Karsten zu Selhausen <karsten.meyerzuselhausen@hac= kmanit.de>, Daniel Fett <mail@danielfett.de>



A new version of I-D, draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt
has been successfully submitted by Karsten Meyer zu Selhausen and posted to the
IETF repository.

Name: draft-meyerzuselhausen-oauth-iss-auth-resp
Revision: 01
Title: OAuth 2.0 Authorization Server Issuer Identifier in Authorization Response
Document date: 2020-11-01
Group: Individual Submission
Pages: 10
URL: https://www.ietf.or= g/archive/id/draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt
Status: https://datatracker.ietf= .org/doc/draft-meyerzuselhausen-oauth-iss-auth-resp/
Html: https://www.ietf.o= rg/archive/id/draft-meyerzuselhausen-oauth-iss-auth-resp-01.html
Htmlized: https://tools.ietf.org/html= /draft-meyerzuselhausen-oauth-iss-auth-resp-01
Diff: https://www.ietf.or= g/rfcdiff?url2=3Ddraft-meyerzuselhausen-oauth-iss-auth-resp-01

Abstract:
This document specifies a new parameter "iss" that is used = to
explicitly include the issuer identifier of the authorization server
in the authorization response of an OAuth authorization flow. If
implemented correctly, the "iss" parameter serves as an eff= ective
countermeasure to "mix-up attacks".



Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--=20
Karsten Meyer zu Selhausen
IT Security Consultant
Phone:	+49 (0)234 / 54456499
Web:	=
https://hackmanit.de | IT Security Consulting, Penetration Testing, Sec=
urity Training

Does your OAuth or OpenID Connect implementation use PKCE to strengthen the=
 security? Learn more about the procetion PKCE provides and its limitations=
 in our new blog post:
https=
://www.hackmanit.de/en/blog-en/123-when-pkce-cannot-protect-your-confidenti=
al-oauth-client

Hackmanit GmbH
Universit=C3=A4tsstra=C3=9Fe 60 (Exzenterhaus)
44789 Bochum

Registergericht: Amtsgericht Bochum, HRB 14896
Gesch=C3=A4ftsf=C3=BChrer: Prof. Dr. J=C3=B6rg Schwenk, Prof. Dr. Juraj Som=
orovsky, Dr. Christian Mainka, Dr. Marcus Niemietz
_______________________________________________
OAuth mailing list
OAut= h@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
--0000000000002b375905b377259f--