Re: [OAUTH-WG] DPoP followup III: client auth

Neil Madden <> Thu, 03 December 2020 11:03 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 022213A003E for <>; Thu, 3 Dec 2020 03:03:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ZImE2dBGZVz6 for <>; Thu, 3 Dec 2020 03:03:21 -0800 (PST)
Received: from ( [IPv6:2a00:1450:4864:20::535]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 215B93A0062 for <>; Thu, 3 Dec 2020 03:03:20 -0800 (PST)
Received: by with SMTP id d18so1618949edt.7 for <>; Thu, 03 Dec 2020 03:03:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=FnrBdrJbc/sTiMV+o9hnqSeJEh+KoWtYqn/BBmrupLk=; b=boXfo0N37RcAO5hUb4re8ZQwOlxo+rH5lqPo5xFKdl5XVSRKC1QJJEQU6sDKFjRaKI SfJwGVSoHo2UXuzPS9f8/802bjRvq1LO/qSH2uJrAB8R8V3HOVnhN61QpqRp5+P+b/1r O6S2Wr+jpLw428bRcyMTKEMFmFdCjb/1OpIH0=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=FnrBdrJbc/sTiMV+o9hnqSeJEh+KoWtYqn/BBmrupLk=; b=R+6vYP+KYBBz4GeeW3nZ74fJjlKZTKAaNkGQKhFP1lK1bdNN+yOsLMS+JxcqWc2u98 CuxlZvcrzJTjgfuD7xlO076TuvuSk/HfQye7x/7zAuo5NcXy6kZqYpy9674/XVcQNtjt /mcVsELqJrmBqkq6Jdz5wuDG5CQEXSbG6vY2NORLGkXI52y2s5m+ljij3bcLXuphhRsw tDbeGY1QZYYN8pIrYyLahH+gbDuAoZH0HtOoiv2BnPYBTp/Km1favNSCSi3azkFh899P lD6evv5cddcfqy9BV5YaVskpj7g10j4jpT4UaqyV7Xdw0zSFkEFEqxicpdoP3LrNAOC4 TtUw==
X-Gm-Message-State: AOAM531cICihN4R78/b2icQs4hJL3JRfxTlO7aE4Cj+94FTMXd1AkWsJ 9J4B3hGg/j12MmQ9ncp+W/EgUlzu4rMADp0DIulwG8QaczO9IXoigCIqnHjZaGNogrRGRkqAXY7 XvDpPDw==
X-Google-Smtp-Source: ABdhPJzXyZWM1kEP2SLAOSsXjoaZ3BX8Htd/Uo27mTstqfw/oCMqaTUQzS44xl3g9VJiyoLBJIgEOA==
X-Received: by 2002:a50:875b:: with SMTP id 27mr2358188edv.24.1606993399344; Thu, 03 Dec 2020 03:03:19 -0800 (PST)
Received: from [] ([]) by with ESMTPSA id qu21sm573218ejb.95.2020. (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 03 Dec 2020 03:03:18 -0800 (PST)
From: Neil Madden <>
Message-Id: <>
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.\))
Date: Thu, 03 Dec 2020 11:03:14 +0000
In-Reply-To: <>
Cc: oauth <>
To: Brian Campbell <>
References: <>
X-Mailer: Apple Mail (2.3608.
Content-Type: multipart/alternative; boundary="Apple-Mail=_7DE1598E-51C3-4ABC-B444-94D5D7B81B41"
Archived-At: <>
Subject: Re: [OAUTH-WG] DPoP followup III: client auth
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 03 Dec 2020 11:03:23 -0000

I like the last option :-)

> On 2 Dec 2020, at 22:29, Brian Campbell <> wrote:
> There were a few items discussed somewhat during the recent interim <> that I committed to bringing back to the list. The slide below (also available with a few extra spelling errors as slide #19 from the interim presentation <>) is the last of them.
> To summarize, I'm wondering if there's WG interest in working to formalize a client-to-AS authentication mechanism based on DPoP. I think it potentially would be problematic to put into the current document (for a number of reasons) so am preemptively ruling out that option. Thus, basically, I'm asking the WG if there is some/much interest in the idea? In which case I'll find some time (at some point) to write up an I-D for it and bring that back to the group for consideration. Or if I should, as the slide says, "shut up and never speak of this again"?
> <Slide19.jpeg>
> CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._______________________________________________
> OAuth mailing list

ForgeRock values your Privacy <>