Re: [OAUTH-WG] MAC Tokens body hash

"William J. Mills" <> Mon, 01 August 2011 16:06 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 1F2FB11E80E4 for <>; Mon, 1 Aug 2011 09:06:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -17.04
X-Spam-Status: No, score=-17.04 tagged_above=-999 required=5 tests=[AWL=0.558, BAYES_00=-2.599, HTML_MESSAGE=0.001, USER_IN_DEF_WHITELIST=-15]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id DUfzkOTlw857 for <>; Mon, 1 Aug 2011 09:06:41 -0700 (PDT)
Received: from ( []) by (Postfix) with SMTP id 1B18611E8077 for <>; Mon, 1 Aug 2011 09:06:41 -0700 (PDT)
Received: from [] by with NNFMP; 01 Aug 2011 16:06:44 -0000
Received: from [] by with NNFMP; 01 Aug 2011 16:06:44 -0000
Received: from [] by with NNFMP; 01 Aug 2011 16:06:44 -0000
X-Yahoo-Newman-Property: ymail-3
Received: (qmail 27093 invoked by uid 60001); 1 Aug 2011 16:06:43 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=ginc1024; t=1312214803; bh=alNCX0aB7rbtB67GpUlB5L1Ple/JpnHXzpysbkHQwIE=; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=Zs+eA8ufyilWxh96+hXlBBFIF67/6/ckQPye0/IpsEHIRHfplyTFFzCb0uwZL0QrKTnYou0njTOk25C4Ce7VYMPyr7Hf7t0jb20hyohU61Kk+IP4iXlcz7hQ6nkfby4Cp9ewBvn+luFCfQGX98RxBtJSZe50UZZib9uRT+LyovI=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024;; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=qBGM+FH2QGTdAzTWVTk54ymNAgGBe4CoQ40orNQeauOICiF1H2nCf0BG+vbg0tflraHHUvVAZ0HorSbVj3yCPPZ9xlJpiNGzrxYKPKzzFKMR9uCOQ0KkDrY6diJ0+NSuqfLRlIpEIiyxZv3LC2+J8hKKT+IKvt3Mt5G6Fn45ITw=;
X-YMail-OSG: LB8cbdQVM1k0kHbVMUT6oUY3PijOR7sYK5fMfmLuUNwyc5x Gdg.QxxOZYsznFAZKp4KN4efZ4p67m6iICVxfpnO83eaj5uVSSA_A.PepsQX AfA95aWsdx67s5MYQvD5X0FWWiS.Out7Hu92QOi_zjuIkZuAdbOvEvNkSSi7 Bx4iFLT99khLVMxe0Oi4Ng2.FZv_mdr83UZ7QIVFO5fjVdJFc9c6e6zlGS6. UROHS.1ZmkBl6J1wAq63A3OgFBnxmo_pHxFjsydyjp48isdD.2yLgqIwVZbx .ZzBiWe1WDBZAYGZlb5wVny_2Jt38_3JcywcuTGp4tFSH7RGqO6cDY6CqWC2 R6NnWQBDekVTX
Received: from [] by via HTTP; Mon, 01 Aug 2011 09:06:43 PDT
X-RocketYMMF: william_john_mills
X-Mailer: YahooMailWebService/
References: <90C41DD21FB7C64BB94121FBBC2E723450245F611B@P3PW5EX1MB01.EX1.SECURESERVER.NET> <> <90C41DD21FB7C64BB94121FBBC2E723450245F61F2@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Message-ID: <>
Date: Mon, 01 Aug 2011 09:06:43 -0700
From: "William J. Mills" <>
To: Eran Hammer-Lahav <>, OAuth WG <>
In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E723450245F61F2@P3PW5EX1MB01.EX1.SECURESERVER.NET>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1385684489-1312214803=:15068"
Cc: Ben Adida <>, "'Adam Barth ('" <>
Subject: Re: [OAUTH-WG] MAC Tokens body hash
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: "William J. Mills" <>
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 01 Aug 2011 16:06:42 -0000

I think the extended parameter still has use if someone extends the MAC stuff specifically, whcih the additional hash is useful for a data signature, that's off the cuff though without implementing somethign to try it out.

From: Eran Hammer-Lahav <>
To: William J. Mills <>; OAuth WG <>
Cc: Ben Adida <>; "'Adam Barth ('" <>
Sent: Monday, August 1, 2011 8:59 AM
Subject: RE: [OAUTH-WG] MAC Tokens body hash

Would you still like to see both such app-specific payload hash AND the ext parameter? I’m thinking of taking your idea and dropping ext. This way, the application can define anything they want to put in the payload hash.
From:William J. Mills [] 
Sent: Monday, August 01, 2011 8:41 AM
To: Eran Hammer-Lahav; OAuth WG
Cc: Ben Adida; 'Adam Barth ('
Subject: Re: [OAUTH-WG] MAC Tokens body hash
Instead of "body" hash why not make it a payload hash or additional hash.  The app can include a hash of data there as defined by the app, and you've reserved a spot for that.


From:Eran Hammer-Lahav <>
To: OAuth WG <>
Cc: Ben Adida <>; "'Adam Barth ('" <>
Sent: Friday, July 29, 2011 6:43 PM
Subject: [OAUTH-WG] MAC Tokens body hash
I plan to drop support for the bodyhash parameter in the next draft based on bad implementation experience. Even with simple text body, UTF encoding has introduced significant issues for us. The current draft does not work using simple JS code between a browser and node.js even when both use the same v8 engine due to differences in the body encoding. Basically, the JS string used to send a request from the browser is not the actual string sent on the wire.
To fix that, we need to force UTF-8 encoding on both sides. However, that is very much application specific. This will not work for non-text bodies. Instead, the specification should offer a simple way to use the ext parameter for such needs, including singing headers. And by offer I mean give examples, but leave it application specific for now.
I am open to suggestions but so far all the solutions I came up with will introduce unacceptable complexity that will basically make this work useless.

OAuth mailing list