Re: [OAUTH-WG] DPoP followup III: client auth

[Filip Skokan <[e-mail]>]

🤫, better not open up the possibility of thinking of DPoP Proof keys as
pre-registered (i.e. not "ephemeral").

Best,
*Filip*


On Wed, 2 Dec 2020 at 23:30, Brian Campbell <bcampbell=
[e-mail]> wrote:

> There were a few items discussed somewhat during the recent interim
> <https://datatracker.ietf.org/meeting/interim-2020-oauth-16/session/oauth>
> that I committed to bringing back to the list. The slide below (also
> available with a few extra spelling errors as slide #19 from the interim
> presentation
> <https://datatracker.ietf.org/meeting/interim-2020-oauth-16/materials/slides-interim-2020-oauth-16-sessa-dpop-01.pdf>)
> is the last of them.
>
> To summarize, I'm wondering if there's WG interest in working to formalize
> a client-to-AS authentication mechanism based on DPoP. I think it
> potentially would be problematic to put into the current document (for a
> number of reasons) so am preemptively ruling out that option. Thus,
> basically, I'm asking the WG if there is some/much interest in the idea? In
> which case I'll find some time (at some point) to write up an I-D for it
> and bring that back to the group for consideration. Or if I should, as the
> slide says, "shut up and never speak of this again"?
>
> [image: Slide19.jpeg]
>
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited.
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*_______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>