Re: [OAUTH-WG] Fwd: HTTP protocol version in MAC signatures

[Hannes Tschofenig <[e-mail]>]

Hi Phil,
Hi Blair,

this is a good point. I also don't see a reason why the HTTP protocol
version should be included in the keyed message digest (from a security
point of view).

It might, however, be worthwhile to point out that we are exploring
different solution directions, as described in this slide deck
http://www.tschofenig.priv.at/oauth/IETF-OAuth-PoP.pptx

For this reason it might be interesting to know what AWS implements. Do
you guys have a reference?

Ciao
Hannes


On 05/09/2014 05:47 AM, Phil Hunt wrote:
> Fyi
> 
> Phil
> 
> Begin forwarded message:
> 
>> *From:* Blair Strang <[e-mail]
>> <mailto:[e-mail]>>
>> *Date:* May 8, 2014 at 18:47:58 PDT
>> *Resent-To:* [e-mail]
>> <mailto:[e-mail]>, [e-mail]
>> <mailto:[e-mail]>, [e-mail]
>> <mailto:[e-mail]>, [e-mail]
>> <mailto:[e-mail]>
>> *To:* [e-mail]
>> <mailto:[e-mail]>
>> *Subject:* *HTTP protocol version in MAC signatures*
>>
>> Hi,
>>
>> [Not sure if this is the right address to submit this feedback to]
>>
>> Looking
>> over http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-05 section 5.2.
>> "MAC Input String", it seems that the HTTP request line is used
>> verbatim during the construction of MAC tokens.
>>
>> Since this includes the transport (HTTP/1.1 versus say HTTP/1.0) it
>> seems that HTTP proxies which run different protocol versions on each
>> leg will break signatures. 
>>
>> I would recommend removing the HTTP version from the MAC. The
>> transport is inherently a "per hop" type of thing, while request
>> signatures are conceptually "end to end".
>>
>> I am not aware of any specific security benefits derived from
>> including the HTTP protocol version in the MAC input string. This may
>> be why AWS version 2 and AWS version 4 signatures do not include it.
>>
>> Thanks and regards,
>>
>>     Blair.
>>
> 
> 
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>