IETF Logo Mail Archive

[OAUTH-WG] Re: [Audit] OAUTH record formats & the AUDIT BoF

Mohamad Khalil Yossif <mohamad@yuthent.com> Tue, 10 November 2026 07:00 UTC

Received: from out-2uec-a88.jellyfish.systems (out-2uec-a88.jellyfish.systems [63.250.43.88]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mx.ietf.org (Postfix) with ESMTPS id B2F8A46 for <oauth@ietf.org>; Tue, 10 Nov 2026 07:00:57 +0000 (UTC)
Authentication-Results: mx.ietf.org; dkim=pass header.d=yuthent.com header.s=default header.b=c36TH4NU; spf=pass (mx.ietf.org: domain of mohamad@yuthent.com designates 63.250.43.88 as permitted sender) smtp.mailfrom=mohamad@yuthent.com; dmarc=pass (policy=reject) header.from=yuthent.com
Received: from mail.privateemail.com (unknown [147.235.221.250]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail.privateemail.com (Postfix) with ESMTPSA id 4jNyGd2yb7zyNc; Tue, 10 Nov 2026 07:00:41 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yuthent.com; s=default; t=1794294043; bh=BHU6uKXEbWdRDBLflgPRH5BmpuDiWht29HOAik2Kcd0=; h=From:Subject:Date:To:From; b=c36TH4NU38y1kwzpqUJWgsUOJbITDsLmAzj9sy4c0LrO7w5L4kP/Gl+PRfCiFZ+0/ 23nww/5iXTvm7TyzhrNZ1LPJx9plgU81GsrPyJsVqhlgoICf9EywKZ7uvHNOL4hg3Y 7I6ANzye5NeUR2/Sa8srTVPKIeDNpxbhkXi3nZE4dMYVGq5+V3Pird9VXhXhgNSc2n tKqbDWvOdWxkmTr8NXUbWZ/lDgrk4BjRjvFsNHSX2kS7b5yOIvxn4TAxW7ncQIhZca 8odtLAKOw039/lS02lAwHtU5OoNtaDhHZN3V8MEaqsVlEumJYxb1piaanZAtKURqN2 Z41zPXFmwvHog==
From: Mohamad Khalil Yossif <mohamad@yuthent.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_1A6866A6-CC40-4CD3-8764-3E60F5CCB3A0"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3901.200.71.1.16\))
Message-Id: <852FD00A-316A-400D-A77C-A349C09189AA@yuthent.com>
Date: Tue, 10 Nov 2026 09:00:30 +0200
To: audit@ietf.org, oauth@ietf.org
X-Mailer: Apple Mail (2.3901.200.71.1.16)
X-Envelope-From: mohamad@yuthent.com
X-Spamd-Bar: ---------
Message-ID-Hash: 5CLNRZIO72UIP6OR2V3VOPRDZIMSHDIX
X-Message-ID-Hash: 5CLNRZIO72UIP6OR2V3VOPRDZIMSHDIX
X-MailFrom: mohamad@yuthent.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-oauth.ietf.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.10
Precedence: list
Subject: [OAUTH-WG] Re: [Audit] OAUTH record formats & the AUDIT BoF
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/eF1vdEFtTTEe1AWPPIWHswsKezM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

> Henk,
> 
> One piece already exists as a record outside OAuth: the person's own
> signature on a specific action. draft-yossif-psea is an EAT profile in
> RATS. The approver's enrolled authenticator signs, after user
> verification, over the SHA-256 of the RFC 8785 form of the action, and
> one independent verifier reproduces the published cases.
> 
> It is meant to be cited rather than embedded.
> draft-liu-oauth-authorization-evidence records the AS's view of the
> approval in RAR and recommends approver-side signatures in 9.4, and
> Konrad Gruszka's decision receipts leave that same signature open.
> 
> So for reuse, the split could be the one Mirja described for vCon: the
> AS record in OAuth, the approver's signature in RATS, and AUDIT
> profiling how a record references both.
> 
> Mohamad

v2.46.0 | Report a Bug | By Email | System Status