Re: [OAUTH-WG] Secdir last call review of draft-ietf-oauth-iss-auth-resp-02

Karsten Meyer zu Selhausen <> Mon, 15 November 2021 15:00 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 4B55E3A0DCE for <>; Mon, 15 Nov 2021 07:00:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.95
X-Spam-Status: No, score=-3.95 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-1.852, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Lp7YR3cCb5tO for <>; Mon, 15 Nov 2021 07:00:24 -0800 (PST)
Received: from ( [IPv6:2a00:1450:4864:20::52d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id C647F3A0FE5 for <>; Mon, 15 Nov 2021 07:00:03 -0800 (PST)
Received: by with SMTP id z5so13327517edd.3 for <>; Mon, 15 Nov 2021 07:00:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=google; h=message-id:date:mime-version:user-agent:subject:content-language:to :cc:references:from:in-reply-to; bh=a5MNx1HQ3iIZwnVAD8+fk+au55T8VD8VFiN9WjVuud4=; b=nVTgCCZUP64/ezxc8onmdYpo7tTPhKHd/Kw9lzuHMyuVVUgoDZjaPZuo1rLIi8qzL6 Kv01ByN8tZaQVJLdFzoNQTYGn+03wEl44O2hfvDiRB+xzEKlMXqUUpHJO9+li/7M/dtm dH7IGroZhHE0Pr0i2cOtdJt/PmQa/ecFRATD0=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to; bh=a5MNx1HQ3iIZwnVAD8+fk+au55T8VD8VFiN9WjVuud4=; b=FBF622W6Sp0DdQNDUF5P4T0mFr5WkdjE7L+2hR9YuMCGNCAdqItQG2EzSEagQHOU7T TbDpJN7DidLDGjfl5ErzbpllyoyvoJpg9M8ZzljsPMG7nQbHI9uffEvVsehZFGOlMjaa 9zBEW/pelJAGbzyfIrh0OEOWSTsU/nrlyn4fUCqvmGBaejnipRfJCJxukEQoUBXnmUMP sOfCe3nTBEzglcfpLkHX02YYY0zidalHBOf+FZuj94etxuXuCcC+NQvj9Z9L4rJmCCCC y1GPHehFmt0wF9VTyj6VBfkCHE6JtoWQB80f7h5Y+BREjivPxGy+1C7FfCbgnsF2bFpp Gesg==
X-Gm-Message-State: AOAM532Vt4MhUJouJ5NnOexr295eaXDfSSnebx57CVxakVIxWLkRr+6b rcBlNqPK6zbehGF6QX5RUJHmZg==
X-Google-Smtp-Source: ABdhPJwXsFqsgHB5tIKNIYF1pZOfri8f5nyWPdomrrjuPTIKwxxodbtfWoAYfIACVGtmosGKKC1+ZA==
X-Received: by 2002:a17:906:270e:: with SMTP id z14mr50425727ejc.414.1636988400552; Mon, 15 Nov 2021 07:00:00 -0800 (PST)
Received: from [] ( []) by with ESMTPSA id m25sm5756706edj.80.2021. (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 15 Nov 2021 06:59:59 -0800 (PST)
Message-ID: <>
Date: Mon, 15 Nov 2021 15:59:59 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.3.0
Content-Language: en-US
To: Yoav Nir <>,
References: <>
From: Karsten Meyer zu Selhausen <>
In-Reply-To: <>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="------------YKuBJaS0bhNCFV6aSZ3n7EBR"
Archived-At: <>
Subject: Re: [OAUTH-WG] Secdir last call review of draft-ietf-oauth-iss-auth-resp-02
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 15 Nov 2021 15:00:33 -0000

Hi Yoav,

thank you for your suggestion. We think its a valid point and followed 
it in a local branch.

Best regards,

On 06.11.2021 23:06, Yoav Nir via Datatracker wrote:
> Reviewer: Yoav Nir
> Review result: Ready
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area directors.
>   Document editors and WG chairs should treat these comments just like any other
> last call comments.
> The draft is clear and well-written. The Security Considerations section
> specifically is comprehensive and clear.
> My one suggestion would be to move the first paragraph in the Security
> Considerations section to the Introduction. It is about the attack and about
> the protocol in the document being effective against the attack. It's not
> really a consideration in the way that the rest of the section is.
Karsten Meyer zu Selhausen
Senior IT Security Consultant
Phone:	+49 (0)234 / 54456499
Web:  | IT Security Consulting, Penetration Testing, Security Training

Is your OAuth or OpenID Connect application vulnerable to mix-up attacks? Find out more on our blog:

Hackmanit GmbH
Universitätsstraße 60 (Exzenterhaus)
44789 Bochum

Registergericht: Amtsgericht Bochum, HRB 14896
Geschäftsführer: Prof. Dr. Jörg Schwenk, Prof. Dr. Juraj Somorovsky, Dr. Christian Mainka, Prof. Dr. Marcus Niemietz