To: Michael Richardson <mcr+ietf@sandelman.ca>
References: <56B31FEB.4010204@sics.se> <16330.1454596303@obiwan.sandelman.ca>
From: Ludwig Seitz <ludwig@sics.se>
Message-ID: <56B36703.8060305@sics.se>
Date: Thu, 4 Feb 2016 15:58:11 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.5.0
MIME-Version: 1.0
In-Reply-To: <16330.1454596303@obiwan.sandelman.ca>
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
 micalg=sha-256; boundary="------------ms080207050001000001060200"
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/_r32D6jt3BuINA84fi-nzuOUSuk>
Cc: oauth@ietf.org, ace@ietf.org
Subject: Re: [OAUTH-WG] [Ace] Questions about OAuth and DTLS
Precedence: list

This is a cryptographically signed message in MIME format.

--------------ms080207050001000001060200
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: quoted-printable

Thank you Michael! Comments inline.

/Ludwig

On 02/04/2016 03:31 PM, Michael Richardson wrote:
>
> Ludwig Seitz <ludwig@sics.se> wrote:
>      > Assuming we are using (D)TLS to secure the connection between C =
and RS,
>      > assuming further that we are using proof-of-possession tokens [2=
],
>      > i.e. tokens linked to a key, of which the client needs to prove =
possession in
>      > order for the RS to accept the token.
>
>      > Do we need to support cases, where the type of key used with DTL=
S does not
>      > match the type of key in the PoP-token?
>
>      > Example:
>
>      > The client uses its raw public key as proof of possession, but t=
he DTLS
>      > connection C - RS is secured with a pre-shared symmetric key.
>
>      > Is that a realistic use case?
>
> Before I agree that it's unrealistic, I think it's worth going out of c=
harter
> scope and ask how much these two credentials were created/distributed.
>
> I think that in this case, the pre-shared symmetric key is initialized
> through some out-of-band (perhaps human mediated?) process, while the r=
aw
> public key did not need any other pre-arrangement.

Actually even the raw public key needs to be provisioned out-of-band to=20
those supposed to trust it for authentication.

>
> So my question is then: could the out-of-band process have pre-exchange=
d the
> raw public key (and the RS's key/certificate!) as well?
>

Short answer: Yes but only to the AS not to the client(s).

Long answer: I am laboring under the assumption that the AS not only=20
provides the OAuth token and the corresponding PoP key to the client,=20
but also some information on the communication security protocols that=20
the RS supports. Furthermore the AS facilitates the establishment of a=20
security context between client and RS by providing things such as a=20
(D)TLS-PSK or the RS's raw public key, depending on the (D)TLS mode that =

the RS is going to support. Thus individual clients would not,=20
a-priori, know the raw public key of a RS, but would be able to get that =

information from the AS.

--=20
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelev=E4gen 17
SE-223 70 Lund

Phone +46(0)70 349 9251
http://www.sics.se


--------------ms080207050001000001060200
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
CtEwggTnMIIDz6ADAgECAhAfP2QWc8z7Bo71GhHCZ7DdMA0GCSqGSIb3DQEBCwUAMHUxCzAJ
BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD
ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll
bnQgQ0EwHhcNMTYwMTA3MTE1NzM3WhcNMTcwMTA3MTE1NzM3WjA4MRcwFQYDVQQDDA5sdWR3
aWdAc2ljcy5zZTEdMBsGCSqGSIb3DQEJARYObHVkd2lnQHNpY3Muc2UwggEiMA0GCSqGSIb3
DQEBAQUAA4IBDwAwggEKAoIBAQCiG5fxnXbdU0+3qInGZloXB0zZLM6XAu0EmTuCsWOU8eXN
lCe37PTURORfLc3te4gCDcG1GrI2AuWR9MvlcYddMZt5y0T5BVWIu534vVJtG3QCuEYRJOTW
B6RWQfK+dIPpZsNhgEQkYLjTHYoCu58gP0pfxNie1X7D+RxeQcq+ynNmyFdsxc2mI+dQqBKq
4zTsCNP4/jpSuovXTn8hEbbR8zkVQ2v/Gx+EO8oMIvkIEUYzkMxe3E9A7dq5DwotRDzP+y3g
C4DCtI0tfIUtFjx18Pb5UMNUKZjitrOpXfheEz/igxziydri8bYpx4qGU9CNX+MvQG7Ogqju
XKfQhUTTAgMBAAGjggGuMIIBqjALBgNVHQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIG
CCsGAQUFBwMEMAkGA1UdEwQCMAAwHQYDVR0OBBYEFBMb8zf+BJ13fxqEl9gYiwxZ4hpmMB8G
A1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJKLUnSG1oMG8GCCsGAQUFBwEBBGMwYTAkBggrBgEF
BQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlh
LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50MS5jcnQwOAYDVR0fBDEwLzAtoCugKYYn
aHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVudDEuY3JsMBkGA1UdEQQSMBCBDmx1
ZHdpZ0BzaWNzLnNlMCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNV
HSAEPzA9MDsGCysGAQQBgbU3AQIEMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRz
c2wuY29tL3BvbGljeTANBgkqhkiG9w0BAQsFAAOCAQEAbgRzIj1s9U5kpXodti5kdj3ztjPb
oz4pz8zNwn3qPUW8c3Zd40IFe+R5hRDuIm2aa//fmwop2mLM3+5/LnSnacaDnRfE7pP3NgqX
XUuuZf9TtMLU6RUh2Z9JKs0IzWKALPhoLgnCsbtYDrF4QAoVqeNV79Lb6a3r6KdB/xFErbee
OkZk/iw9HCr/jnvysYjfFQcBounseJS3JG4RNIuDpfsWPupQSAhl4s0akaakiwqOHCU7x0Ra
rbCN+bg+6R5FEtSouIh53Z04JmI7LU3leo/AseQiUpJ6HqQNJYjnsCw8DDbijNhH41ZZKrvB
rKMfVvlCH9VqrKW4kPGajKMEJDCCBeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJ
KoZIhvcNAQELBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzAp
BgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0
YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIx
NjAxMDAwNVowdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNV
BAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENv
bSBDbGFzcyAxIENsaWVudCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL19
2vfDon2D9luC/dtbX64eG3XAtRmvmCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk
9dEDBlmixEd8QiLkUfvHpJX/xKnmVkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89V
LnUztRr2cgmCfyO9Otrh7LJDPG+4D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZ
ZGxPwSkzK3WIN+VKNdkiwTubW5PIdopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8U
lVS8pkIsoGGJtMuWjLL4tq2hYQuuN0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4G
A1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/
BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9z
ZnNjYS5jcmwwZgYIKwYBBQUHAQEEWjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFy
dHNzbC5jb20wMAYIKwYBBQUHMAKGJGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2Nh
LmNydDAdBgNVHQ4EFgQUJIFsOWG+SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRA
W6UXaYcwyjRoQ9BBrvIwPwYDVR0gBDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6
Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4St
DwECW5zhIycjBL008HACblIf26HY0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y
5uzSns1lZwh7sG96bYBZpcGzGxpFNjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bj
yOngCIVeC/GmsmtbuLOzJ606tEc9uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfC
BJb+e29bLafgu6JqjOUJ9eXXj20p6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSi
F3YPhKGAWUxKPMAVGgcYoXzWydOvZ3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odh
QJmi7Eh5TbxI40kDGcBOBHhwnaOumZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfr
Bzez76xtDsK0KfUDHt1/q59BvDI7RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4W
VWAiJKnSYaWDjdA70qHX4mq9MIjO/ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9Vyrw
MdLcusP7HJgRdAGKpkR2I9U4zEsNJQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2de
oprGevfnxWB+vHNQiu85o6MxggPMMIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UE
ChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRo
b3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhAfP2QWc8z7Bo71
GhHCZ7DdMA0GCWCGSAFlAwQCAQUAoIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwG
CSqGSIb3DQEJBTEPFw0xNjAyMDQxNDU4MTFaMC8GCSqGSIb3DQEJBDEiBCD72uL/Mu+gSutw
pHXSnrOchormeDxSNm46uOVXY+o5yDBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjAL
BglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFA
MAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UE
BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRp
ZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBD
QQIQHz9kFnPM+waO9RoRwmew3TCBnAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMC
SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj
YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQ
Hz9kFnPM+waO9RoRwmew3TANBgkqhkiG9w0BAQEFAASCAQBdF/wHMJ9JREH7cBlZjOHSaliB
h/eGZXfAzLUQg4NNAT2uU6V2tbyFflIVjumd0SHl265q/rZWRNReBZGQfqMDoqALzYEE2qcF
rDQonp+gSbalwuEK5x21f7mBjfsaCiHMFAhP8TW48KMUpyPSBRP3xduy81lmRA4KZZmpaKrm
V6R1PGRfiiZxY8ls2VAOE6ZO1tJKEYI8TsZXHJpRAnbI5laQiQYgctlXJ92DfEJx8Ob0Hq/g
ggqzV/hGbk9y4sxxfmwHX5ApnLF6xp2jXkxCWpUJqtsPdPEg/+w5FRDK4HyuUzag9iyhTqza
RdPw02CnaGCFFXFBAPYYpqwsqUQ+AAAAAAAA
--------------ms080207050001000001060200--