Re: [OAUTH-WG] draft-hammer-oauth-v2-mac-token-02

Yeah...

I struggled with that. There is no reason to include the body hash with the request other than to indicate a body hash is included in the normalized request string. It's just that an attribute like 'bodyhash=true' is so ugly...

I'm still thinking about this.

EHL

> -----Original Message-----
> From: Skylar Woodward [mailto:skylar@kiva.org]
> Sent: Monday, February 07, 2011 9:25 AM
> To: Eran Hammer-Lahav; OAuth WG
> Subject: Re: [OAUTH-WG] draft-hammer-oauth-v2-mac-token-02
> 
> On body-hash...
> 
> Having completed a trial implementation, it seems redundant, and
> potentially problematic, to include the body-hash in the Authentication
> header. The danger is that implementors may neglect to recalculate the hash
> themselves, reusing the value (even if incorrect) provided by the client. Why
> not just require the provider to calculate this and validate it by comparing the
> final signature? This way it's clearer for everyone what the expectations are
> in validating the signature.
> 
> I propose either a flag (eg, usebodyhash="1") or an algorithm
> (bodyhashalgorithm="sha1"). If this parameter was provided, the correct
> hash would be added to the base string for signing. If omitted (or set false?)
> then an empty string is used for base string element #4.
> 
> 
> On including parameters for signing...
> 
> I'd retract my suggestion that we'd include parameter-hash in the header.
> Instead, I would suggest making parameters optional in calculating the
> signature using a flag as with bodyhash. Providers could require including
> parameters if so desired. Parameters could be included as currently defined,
> or with a hash method similar to entity-body (which I find both simpler and
> more congruent).
> 
> Again, the goal in making query parameters optional is to allow providers to
> make signature calculation as simple as possible for clients (so much as it is in
> line with the security requirements of the provider) and avoid complexities in
> implementation such as those that tripped up OAuth 1.
> 
> 
> 
> On Jan 22, 2011, at 2:09 AM, Eran Hammer-Lahav wrote:
> 
> > http://tools.ietf.org/html/draft-hammer-oauth-v2-mac-token-02
> >
> > New version includes the following changes:
> >
> >    o  Added body-hash support.
> >    o  Updated OAuth 2.0 reference to -12 and added token type registration
> template.
> >    o  Removed error and error URI attributes (codes were just a duplication
> of the HTTP status codes).
> >
> > Feedback would be greatly appreciated.
> >
> > EHL
> >
> >
> > _______________________________________________
> > OAuth mailing list
> > OAuth@ietf.org
> > https://www.ietf.org/mailman/listinfo/oauth