Re: [OAUTH-WG] why are we signing?

["Hannes Tschofenig" <[e-mail]>]

Hi Brian, 

There is no doubt that one can sign different parts of the message to show
that you know the key and to bind the token to the request itself.

You can find examples of signing different practices in other protocols. For
example, DKIM allows you to vary the amount of elements being signed (see
h-parameter on page 20 of http://www.ietf.org/rfc/rfc4871.txt). SIP
Identity, http://www.rfc-editor.org/rfc/rfc4474.txt, signs a fixed number of
fields (although more than the current Oauth spec). 

There is most likely no right answer since it depends a bit on the threat
model and the usage scenarios. Here is an example. The signature mechanism
prevents replays of the token. The HTTP case and the SIP/XMPP communication
model are different since with XMPP/SIP there is also the risk that
intermediaries see the token passing by and misuse it. The usage of Oauth
has been suggested also for XMPP (see
http://xmpp.org/extensions/xep-0235.html) and for SIP (see
http://tools.ietf.org/html/draft-beck-oauth-sip-eval-00). 

Ciao
Hannes

>Hey folks -
>
>What are the use cases for cryptography in OAuth?  Why are we 
>signing requests?  And how much of each request do we need to 
>sign in order to be useful?
>
>As I see it, we have roughly the following menu of choices:
>
>1) No signatures.
>    Just use bearer tokens.  Use transport layer encryption to 
>keep those bearer tokens from leaking.
>
>2) Signed tokens.
>    We could just sign a timestamp, rather than entire messages.
>
>3) Partially signed messages.
>    We could sign just the request URL, or the request URL 
>plus some parameters.
>
>4) Fully signed messages.
>     Sign as much of the HTTP request as possible, down to the 
>bits of the HTTP entity body.
>
>My guess is we need at least two out of those four choices 
>(one with bearer tokens, a la OAuth 1.0 plaintext) and another 
>with cryptography.  But I'm not sure whether we need to sign 
>entire messages, or if we can get away with something simpler 
>and still have reasonable security.
>
>Cheers,
>Brian
>_______________________________________________
>OAuth mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/oauth
>