Re: [OAUTH-WG] Shepherd Writeup for draft-ietf-oauth-spop-06.txt

Hannes Tschofenig <hannes.tschofenig@gmx.net> Wed, 18 February 2015 17:33 UTC

Return-Path: <hannes.tschofenig@gmx.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30C321A8A91 for <oauth@ietfa.amsl.com>; Wed, 18 Feb 2015 09:33:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level:
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r9vR7A5J2riu for <oauth@ietfa.amsl.com>; Wed, 18 Feb 2015 09:33:42 -0800 (PST)
Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96F3A1A88E0 for <oauth@ietf.org>; Wed, 18 Feb 2015 09:33:24 -0800 (PST)
Received: from [192.168.131.129] ([80.92.119.127]) by mail.gmx.com (mrgmx103) with ESMTPSA (Nemesis) id 0Lcjdr-1Xfl7n1hrj-00k47b; Wed, 18 Feb 2015 18:33:20 +0100
Message-ID: <54E4CCDD.6010709@gmx.net>
Date: Wed, 18 Feb 2015 18:33:17 +0100
From: Hannes Tschofenig <hannes.tschofenig@gmx.net>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Brian Campbell <bcampbell@pingidentity.com>
References: <54C7BBA4.4030702@gmx.net> <CA+k3eCQCPiAR0s1cX5mC=h2O-5ptVTVq6=cVKHFKu_Adq8bJTg@mail.gmail.com> <2E3D2EE7-8F5F-452D-880A-D62A513AC853@lodderstedt.net> <54E370F9.8060209@gmx.net> <17faabb6e724fb54f3cb8060a3d9cb08@lodderstedt.net> <54E4B0AD.10801@gmx.net> <CA+k3eCThg3TxRtCuEwGGWG07yWZD82i87fUQjDrKs3sMmd5frg@mail.gmail.com>
In-Reply-To: <CA+k3eCThg3TxRtCuEwGGWG07yWZD82i87fUQjDrKs3sMmd5frg@mail.gmail.com>
OpenPGP: id=4D776BC9
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="CKvBJIBeNrICBFhEUAGIcpisiocFQ6Fuu"
X-Provags-ID: V03:K0:2e21g9h0eKZ2ZnbYDxAS+Lo5nxtqt8F82lRGaAk8rL55ZNf5dYO wqtWDY5agyJui+HVhkH/azBIGVWw84gTgfn/8LJNBcpGOk5VYSrxWfgXiVOSM/y/2aYX4HC B4n5Wx9vowUVyy7PPoP4pX34GZpILY8dYS2pYl5BtcPqCpEND/9Io20Velr+zwb/nKubPT4 YT7GX2k3H9wKmcfLQFc0Q==
X-UI-Out-Filterresults: notjunk:1;
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/jRVpERpVIQNW2UNBAKTwUUeSJ_w>
Cc: oauth <oauth@ietf.org>, "naa@google.com >> Naveen Agarwal" <naa@google.com>
Subject: Re: [OAUTH-WG] Shepherd Writeup for draft-ietf-oauth-spop-06.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Feb 2015 17:33:44 -0000

Thanks Brian for pointing me to Section 4.4.1 and to the MTI for "S256".
While this is good from a security point of view I am wondering whether
anyone is actually compliant to the specification. Neither PingIdentity
nor DT implements the S256 transform, if I understood that correctly.
Are you guys going planning to update your implementations?

Ciao
Hannes

On 02/18/2015 05:45 PM, Brian Campbell wrote:
> There's a bit of MTI talk tucked into
> https://tools.ietf.org/html/draft-ietf-oauth-spop-10#section-4.4.1 that
> perhaps needs to be expanded and/or placed somewhere else.
> 
> On Wed, Feb 18, 2015 at 8:33 AM, Hannes Tschofenig
> <hannes.tschofenig@gmx.net <mailto:hannes.tschofenig@gmx.net>> wrote:
> 
>     Thanks for the info, Torsten.
> 
>     Your feedback raises an interesting question, namely what functionality
>     the parties have to implement to claim conformance to the specification.
> 
>     Quickly scanning through the specification didn't tell me whether it is
>     OK to just implement the plain mode or whether both modes are
>     mandatory-to-implement. We have to say something about this.
> 
>     Ciao
>     Hannes
> 
> 
>     On 02/18/2015 02:16 PM, torsten@lodderstedt.net
>     <mailto:torsten@lodderstedt.net> wrote:
>     > Hi Hannes,
>     >
>     > our implementation supports the "plain" mode only. We just verified
>     > compliance of our implementation with the current spec. As the only
>     > deviation, we do not enforce the minimum length of 43 characters
>     of the
>     > code verifier.
>     >
>     > kind regards,
>     > Torsten.
>     >
>     > Am 17.02.2015 17:48, schrieb Hannes Tschofenig:
>     >> Hi Torsten,
>     >>
>     >> does this mean that your implementation is not compliant with the
>     >> current version anymore or that you haven't had time to verify
>     whether
>     >> there are differences to the earlier version?
>     >>
>     >> Ciao
>     >> Hannes
>     >>
>     >>
>     >> On 01/31/2015 05:34 PM, Torsten Lodderstedt wrote:
>     >>> Deutsche Telekom also implemented an early version of the draft last
>     >>> year.
>     >>>
>     >>>
>     >>>
>     >>> Am 30.01.2015 um 18:50 schrieb Brian Campbell
>     >>> <bcampbell@pingidentity.com <mailto:bcampbell@pingidentity.com>
>     <mailto:bcampbell@pingidentity.com
>     <mailto:bcampbell@pingidentity.com>>>:
>     >>>
>     >>>>
>     >>>> On Tue, Jan 27, 2015 at 9:24 AM, Hannes Tschofenig
>     >>>> <hannes.tschofenig@gmx.net <mailto:hannes.tschofenig@gmx.net>
>     <mailto:hannes.tschofenig@gmx.net
>     <mailto:hannes.tschofenig@gmx.net>>> wrote:
>     >>>>
>     >>>>
>     >>>>     1) What implementations of the spec are you aware of?
>     >>>>
>     >>>>
>     >>>> We have an AS side implementation of an earlier draft that was
>     >>>> released in June of last year:
>     >>>>
>     http://documentation.pingidentity.com/pages/viewpage.action?pageId=26706844
>     >>>>
>     >>>> _______________________________________________
>     >>>> OAuth mailing list
>     >>>> OAuth@ietf.org <mailto:OAuth@ietf.org> <mailto:OAuth@ietf.org
>     <mailto:OAuth@ietf.org>>
>     >>>> https://www.ietf.org/mailman/listinfo/oauth
> 
>