Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-mac-03.txt

On 28/02/13 17:04, Sergey Beryozkin wrote:
> Hi
> On 28/02/13 13:14, William Mills wrote:
>> I'm actually advocating that we change MAC to be a JWT extension.
> IMHO, having a simpler option, plus, going forward, a possible JWT
> profile (client to RS path) would work better -
>
> Why would JWT completely take over ? May be it should be possible indeed
> to have it as a JWT extension - should it be part of the relevant JWT
> assertion spec, where JWT is used as a possible grant ?
We are talking about access tokens here I've just realized, looking at 
other emails...still may be JWT assertion spec may be expanded in 
principle...

Sergey


>
> Thanks, Sergey
>>
>> ------------------------------------------------------------------------
>> *From:* Hannes Tschofenig <hannes.tschofenig@gmx.net>
>> *To:* William Mills <wmills_92105@yahoo.com>
>> *Cc:* Hannes Tschofenig <hannes.tschofenig@gmx.net>; "oauth@ietf.org"
>> <oauth@ietf.org>
>> *Sent:* Thursday, February 28, 2013 2:28 AM
>> *Subject:* Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-mac-03.txt
>>
>> Hi Bill,
>>
>> I believe you are misreading the document. In
>> draft-ietf-oauth-v2-http-mac the client still uses the MAC when it
>> accesses a protected resource.
>> The only place where the JWT comes into the picture is with the
>> description of the access token. This matters from a key distribution
>> point of view. The session key for the MAC is included in the encrypted
>> JWT. The JWT is encrypted by the authorization server and decrypted by
>> the resource server.
>>
>> Information about how header fields get included in the MAC is described
>> in Section 5.
>>
>> The nonce isn't killed it is just called differently: seq-nr. The stuff
>> in the original MAC specification actually wasn't a nonce (from the
>> semantic point of view).
>> The extension parameter is there implicitly by allowing additional
>> header fields to be included in the MAC computation.
>>
>> I need to look at the port number field again.
>>
>> Ciao
>> Hannes
>>
>> On Feb 27, 2013, at 11:12 AM, William Mills wrote:
>>
>> > Just read the draft quickly.
>> >
>> > Since we're now leaning on JWT do we need to include the token in
>> this? Why not just make an additional "Envelope MAC" thing and have the
>> signature include the 3 JWT parts in the signature base string? That
>> object then just becomes a JSON container for the kid, timestamp,
>> signature method, signature etc. That thing then is a 4th base64 encoded
>> JSON thing in the auth header.
>> >
>> > How header fields get included in the signature needs definition.
>> >
>> > Why did you kill the port number, nonce, and extension parameter out
>> of the signature base string?
>> >
>> > The BNF appears to have no separators between values.
>> >
>> > -bill
>> >
>> >
>> > From: "internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>"
>> <internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>>
>> > To: i-d-announce@ietf.org <mailto:i-d-announce@ietf.org>
>> > Cc: oauth@ietf.org <mailto:oauth@ietf.org>
>> > Sent: Monday, February 25, 2013 4:46 AM
>> > Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-mac-03.txt
>> >
>> >
>> > A New Internet-Draft is available from the on-line Internet-Drafts
>> directories.
>> > This draft is a work item of the Web Authorization Protocol Working
>> Group of the IETF.
>> >
>> > Title : OAuth 2.0 Message Authentication Code (MAC) Tokens
>> > Author(s) : Justin Richer
>> > William Mills
>> > Hannes Tschofenig
>> > Filename : draft-ietf-oauth-v2-http-mac-03.txt
>> > Pages : 26
>> > Date : 2013-02-25
>> >
>> > Abstract:
>> > This specification describes how to use MAC Tokens in HTTP requests
>> > to access OAuth 2.0 protected resources. An OAuth client willing to
>> > access a protected resource needs to demonstrate possession of a
>> > crytographic key by using it with a keyed message digest function to
>> > the request.
>> >
>> > The document also defines a key distribution protocol for obtaining a
>> > fresh session key.
>> >
>> >
>> > The IETF datatracker status page for this draft is:
>> > https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-http-mac
>> >
>> > There's also a htmlized version available at:
>> > http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-03
>> >
>> > A diff from the previous version is available at:
>> > http://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-v2-http-mac-03
>> >
>> >
>> > Internet-Drafts are also available by anonymous FTP at:
>> > ftp://ftp.ietf.org/internet-drafts/
>> >
>> > _______________________________________________
>> > OAuth mailing list
>> > OAuth@ietf.org <mailto:OAuth@ietf.org>
>> > https://www.ietf.org/mailman/listinfo/oauth
>> >
>> >
>>
>>
>>
>>
>>
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>
>