Re: [OAUTH-WG] [Ace] New OAuth client credentials RPK and PSK

Samuel Erdtman <samuel@erdtman.se> Mon, 15 May 2017 08:52 UTC

MIME-Version: 1.0
In-Reply-To: <000501d2ccef$398d0940$aca71bc0$@augustcellars.com>
References: <CAF2hCbZpWTCMg617dK7D+F+0w=hxrz4VNdsFZHPGM1rZy+K3TA@mail.gmail.com> <000501d2ccef$398d0940$aca71bc0$@augustcellars.com>
From: Samuel Erdtman <samuel@erdtman.se>
Date: Mon, 15 May 2017 10:49:02 +0200
Message-ID: <CAF2hCbY0p=kN3FHWk8+GaQa4drPa8batV9cqLqmehEbBwTnSqw@mail.gmail.com>
To: Jim Schaad <ietf@augustcellars.com>
Cc: "<oauth@ietf.org>" <oauth@ietf.org>, ace <Ace@ietf.org>, Ludwig Seitz <ludwig.seitz@ri.se>
Content-Type: multipart/alternative; boundary="f403043c496480eb1f054f8c2086"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/ucGq5ZBVN6H0VQiQvdJKSuhjqfg>
Subject: Re: [OAUTH-WG] [Ace] New OAuth client credentials RPK and PSK
Precedence: list

In short this draft focuses on the C to AS connection and
draft-gerdes-ace-dtls-authorize focuses on the C to RS connection.

This draft details on how to use RPK or PSK as client credentials to setup
the (D)TLS between C and AS while draft-gerdes-ace-dtls-authorize provides
details for how to use the RPK or PSK bound to an access token to setup the
connection between C and RS.

//Samuel


On Sun, May 14, 2017 at 10:18 PM, Jim Schaad <ietf@augustcellars.com> wrote:

> How is this draft supposed to interact with draft-gerdes-ace-dtls-
> authorize?
>
>
>
> Jim
>
>
>
>
>
> *From:* Ace [mailto:ace-bounces@ietf.org] *On Behalf Of *Samuel Erdtman
> *Sent:* Friday, May 12, 2017 1:03 AM
> *To:* <oauth@ietf.org> <oauth@ietf.org>; ace <Ace@ietf.org>
> *Cc:* Ludwig Seitz <ludwig.seitz@ri.se>
> *Subject:* [Ace] New OAuth client credentials RPK and PSK
>
>
>
> Hi ACE and OAuth WGs,
>
> I and Ludwig submitted a new draft yesterday defining how to use Raw
> Public Key and Pre Shared Key with (D)TLS as OAuth client credentials,
> https://datatracker.ietf.org/doc/draft-erdtman-ace-rpcc/.
>
>
>
> We think this is valuable to the ACE work since the ACE framework is based
> on OAuth, but client credentials as defined in the OAuth framework are not
> the best match for embedded devices.
>
> We think Raw Public Keys and Pre Shared Keys are more suitable credentials
> for embedded devices for the following reasons:
>
> * Better security by binding to transport layer.
>
> * If PSK DTLS is to be used a key need to be distributed any way, why not
> make use of it as credential.
>
> * Client id and client secret accommodates for manual input by a humans.
> This does not scale well and requires some for of input device.
>
> * Some/many devices will have crypto-hardware that can protect key
> material, to not use that possibility would be a waste.
>
> * There are probably more reasons these was just the once on top of my
> head.
>
>
>
> This is not the first resent initiative to create new client credential
> types, the OAuth WG adopted a similar draft for certificate based client
> credentials (https://tools.ietf.org/html/draft-ietf-oauth-mtls-00.html).
> That work is also valuable to ACE but not all devices will be able to work
> with certificates or even asymmetric cryptos .
>
> Please review and comment.
>
> Cheers
>
> //Samuel
>
>
>

[OAUTH-WG] New OAuth client credentials RPK and P… Samuel Erdtman
Re: [OAUTH-WG] New OAuth client credentials RPK a… Torsten Lodderstedt
Re: [OAUTH-WG] New OAuth client credentials RPK a… Samuel Erdtman
Re: [OAUTH-WG] [Ace] New OAuth client credentials… Jim Schaad
Re: [OAUTH-WG] [Ace] New OAuth client credentials… Samuel Erdtman
Re: [OAUTH-WG] [Ace] New OAuth client credentials… Adrian Imach