Re: [OAUTH-WG] PoP Key Distribution

[Ludwig Seitz <[e-mail]>]

On 2018-07-03 21:46, Hannes Tschofenig wrote:
> Hi all,
> 
...
> Where should the parameters needed for PoP key distribution should be 
> defined? Currently, they are defined in two places -- in 
> https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-13 and also in 
> https://tools.ietf.org/html/draft-ietf-oauth-pop-key-distribution-03. In 
> particular, the audience and the token_type parameters are defined in 
> both specs.
> 
> IMHO it appears that OAuth would be the best place to define the 
> HTTP-based parameters. ACE could define the IoT-based protocols, such as 
> CoAP, MQTT, and alike. Of course, this is subject for discussion, 
> particularly if there is no interest in doing so in the OAuth working 
> group.
> 

I fully agree that OAuth would be the best place. I've only drawn some 
of these parameters into draft-ietf-ace-oauth-authz because the work on
draft-ietf-oauth-pop-key-distribution seemed to have been discontinued 
(it expired August 2017).
That said, I'd hate to introduce a normative dependency into 
draft-ietf-ace-oauth-authz on a document that will not move forward or 
only move very slowly. What are the prospects of going forward quickly 
with draft-ietf-oauth-pop-key-distribution?

> There is also a misalignment in terms of the content.. 
> draft-ietf-oauth-pop-key-distribution defined an 'alg' parameter, which 
> does not exist in the draft-ietf-ace-oauth-authz document. The 
> draft-ietf-ace-oauth-authz document does, however, have a profile 
> parameter, which does not exist in 
> draft-ietf-oauth-pop-key-distribution. Some alignment is therefore 
> needed. In the meanwhile the work on OAuth meta has been finalized and 

It seems indeed that 'alg' and 'profile' parameters have some overlap, 
although 'alg' seemed a bit more narrow to me (which is why I created 
'profile').  If we could extend the definition of 'alg' a bit, I'd be OK
to remove 'profile' from the ACE draft (provided the OAuth draft moves 
forward in a timely manner).


/Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE SICS
Phone [phone]