Re: [OAUTH-WG] OAuth Signature Draft Pre 00
Dirk Balfanz <balfanz@google.com> Mon, 27 September 2010 16:12 UTC
Return-Path: <balfanz@google.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B48013A6D79 for <oauth@core3.amsl.com>; Mon, 27 Sep 2010 09:12:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.643
X-Spam-Level:
X-Spam-Status: No, score=-104.643 tagged_above=-999 required=5 tests=[AWL=1.333, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SySOLDhvFiAy for <oauth@core3.amsl.com>; Mon, 27 Sep 2010 09:12:36 -0700 (PDT)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.35]) by core3.amsl.com (Postfix) with ESMTP id 25A543A69B7 for <oauth@ietf.org>; Mon, 27 Sep 2010 09:12:35 -0700 (PDT)
Received: from wpaz21.hot.corp.google.com (wpaz21.hot.corp.google.com [172.24.198.85]) by smtp-out.google.com with ESMTP id o8RGDDgk026611 for <oauth@ietf.org>; Mon, 27 Sep 2010 09:13:13 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1285603994; bh=cUWbBR+B9NVaSoGgEXV/fEt2Mu4=; h=MIME-Version:In-Reply-To:References:Date:Message-ID:Subject:From: To:Cc:Content-Type; b=dh3sH+Qhp9h2TUdcbCLM2HNi5IABbkNpi+g/P4NFPxnf2Bp5pYCuK4/SMKXY2+VbS rCxBC1XglP4THAFeI26Cw==
Received: from pwi10 (pwi10.prod.google.com [10.241.219.10]) by wpaz21.hot.corp.google.com with ESMTP id o8RGDBxu017291 for <oauth@ietf.org>; Mon, 27 Sep 2010 09:13:12 -0700
Received: by pwi10 with SMTP id 10so1536421pwi.20 for <oauth@ietf.org>; Mon, 27 Sep 2010 09:13:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=urYmg+SaiZRnPr0HAoKTiSfXk/xOsnjauMlUAQbK/nE=; b=VqD7V7iksdyyvE/njkB4MJABT6zpJloQqcAnzM4Vv2zNkWTeMseMjEKaFKRnxjAk3M 8EKTADE9DJ/s0/Hd9rCg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=CRCUbTzgi/luh+2GWezwbsQB4Z3ly2hwyedpX9YJro6vAxPKpP55l25KOjoJQxtXpa aOY1XpR75aOC4jgymJVw==
MIME-Version: 1.0
Received: by 10.114.38.8 with SMTP id l8mr8791777wal.85.1285603989320; Mon, 27 Sep 2010 09:13:09 -0700 (PDT)
Received: by 10.231.130.9 with HTTP; Mon, 27 Sep 2010 09:13:08 -0700 (PDT)
In-Reply-To: <AANLkTinZbFmWcuALHnd5NFik8HRkKgH0AgMzFMgarrYX@mail.gmail.com>
References: <AANLkTikSKX8jisucEbZOUnkGYUz0DnBSB_KWXGM3bJcS@mail.gmail.com> <7C01E631FF4B654FA1E783F1C0265F8C62D263BB@TK5EX14MBXC111.redmond.corp.microsoft.com> <AANLkTinZbFmWcuALHnd5NFik8HRkKgH0AgMzFMgarrYX@mail.gmail.com>
Date: Mon, 27 Sep 2010 09:13:08 -0700
Message-ID: <AANLkTikhsE=Pcep09K7j=6Q0hbJMsssjf66ep103n9Oj@mail.gmail.com>
From: Dirk Balfanz <balfanz@google.com>
To: David Recordon <recordond@gmail.com>
Content-Type: multipart/alternative; boundary="00163645928c1bba26049140017f"
X-System-Of-Record: true
Cc: oauth <oauth@ietf.org>
Subject: Re: [OAUTH-WG] OAuth Signature Draft Pre 00
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 27 Sep 2010 16:12:39 -0000
I'm just as confused :-) I think what happened is that I posted a signature draft and then didn't follow up. Nat then very kindly agreed to help and put out a draft, but that also didn't get much momentum. So I went back and re-did my drafts. Also, somewhere along the way, Yoran wrote a draft. At least that's what it looks like from where I'm sitting. I might be getting it wrong (maybe Yoran's draft represents a merge of his and Nat's thinking? - I'm not sure). At any rate, of course we need to end up with one proposal in the end. I'm fairly agnostic about the details, but I believe the following should be true about any merged proposal: - very limited number of options for signature algorithms, key representations (should not require more than 10..20 lines of code in your given platform, without any additional library, to implement signature and key parsing). - must support both public and symmetric keys. - should not have security flaws Dirk. On Mon, Sep 27, 2010 at 6:59 AM, David Recordon <recordond@gmail.com> wrote: > I'm a bit confused between the relationship of Nat's I-D and the documents > you and Mike recently posted. Is the goal to have one I-D? Nat's seems to > have fewer options and different modes which makes it easier to read and > understand. > > > On Mon, Aug 30, 2010 at 11:47 AM, Yaron Goland <yarong@microsoft.com>wrote: > >> BTW, Nat and I, as mentioned below, are talking. Here is my current >> draft. Please keep in mind that it's really just a set of notes trying to >> capture all the issues involved in creating a secure token format so it's a >> bit dense. My hope is that once all the issues are captured it can be >> completely re-written to be in something that looks more like English and is >> easier for actual implementers to follow. But for now I think it gives a >> good sense of the some of the security challenges in creating a secure token >> format. >> >> Yaron >> >> >> >> *From:* oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] *On Behalf >> Of *Nat Sakimura >> *Sent:* Tuesday, August 24, 2010 6:50 AM >> *To:* oauth >> *Subject:* [OAUTH-WG] OAuth Signature Draft Pre 00 >> >> >> >> Hi. >> >> >> >> It has been a few weeks since then I volunteered to do this work. >> >> I have written up to this pre 00 draft then have been doing some reality >> checks on some script languages etc. >> >> >> >> No. This pre-00 draft is far from being feature complete. >> >> I still need to copy and paste the Magic Signatures text etc. >> >> Also, I should add how this spec is being used in some of the major >> flows. >> >> >> >> However, since I will not be able to work on it this week, I thought it >> would be worthwhile to share this early draft so that you have some clarity >> into the progress. >> >> >> >> Apparently, Yaron has been working on it as well. We will compare the >> notes and try to merge, I hope. >> >> >> >> So, here it is! >> >> >> >> #For those of you who have seen the private draft, it has not been changed >> since July 31. >> >> >> >> Best, >> >> >> >> =nat >> >> >> >> >> >> _______________________________________________ >> OAuth mailing list >> OAuth@ietf.org >> https://www.ietf.org/mailman/listinfo/oauth >> >> > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth > >
- [OAUTH-WG] OAuth Signature Draft Pre 00 Nat Sakimura
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 Yaron Goland
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 hdknr hidelafoglia
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 Anthony Nadalin
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 hdknr hidelafoglia
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 David Recordon
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 Yaron Goland
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 Dirk Balfanz
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 Anthony Nadalin
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 David Recordon
- Re: [OAUTH-WG] OAuth Signature Draft Pre 00 Mike Jones