Re: [OAUTH-WG] Shepherd Writeup for draft-ietf-oauth-spop-06.txt

Nat Sakimura <sakimura@gmail.com> Tue, 10 March 2015 00:25 UTC

Return-Path: <sakimura@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7CE61A8821 for <oauth@ietfa.amsl.com>; Mon, 9 Mar 2015 17:25:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.999
X-Spam-Level:
X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xhbD07Lcbhtt for <oauth@ietfa.amsl.com>; Mon, 9 Mar 2015 17:25:00 -0700 (PDT)
Received: from mail-oi0-x232.google.com (mail-oi0-x232.google.com [IPv6:2607:f8b0:4003:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E6B31A01D8 for <oauth@ietf.org>; Mon, 9 Mar 2015 17:25:00 -0700 (PDT)
Received: by oigi138 with SMTP id i138so32640938oig.4 for <oauth@ietf.org>; Mon, 09 Mar 2015 17:25:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:references:from:date:message-id:subject:to:cc :content-type; bh=nkorWbAgImQ2bPThSYCAHr50bxq6+I5/2E+MVKpv94k=; b=G2BuYJZgW0qKa8aidCwDJyule66iy4un4rSJ5ATZlPf2Yy2e2HlSCV7N173s+9i63I 0kc6objgc6OI006DzoD/07pPP7lpsVGt+wCl6rhAFg8wlHqK3JBSM6E3oFasWaAny/0B 0qFLuw3avMpqyZadLK1zvZ9vOHTFMhr0eJfhbBte2bcykrS38kJVLQfWJIeJjv+ZuvHB S+Qa66ZgDaGzRXjwci6J9RJstX0v5jq4snrucQYix1amj6Dh53fCArAy/mQZ8aUdPzkT 2mrpE0r2OdxlvD3YMHcuzDtdiIRA9hJt9ZScDpDwJHrIf2HmAd66w4Vpqk0Ezn4eTPQX LxLw==
X-Received: by 10.60.115.99 with SMTP id jn3mr24046142oeb.68.1425947100001; Mon, 09 Mar 2015 17:25:00 -0700 (PDT)
MIME-Version: 1.0
References: <54C7BBA4.4030702@gmx.net> <CA+k3eCQCPiAR0s1cX5mC=h2O-5ptVTVq6=cVKHFKu_Adq8bJTg@mail.gmail.com> <2E3D2EE7-8F5F-452D-880A-D62A513AC853@lodderstedt.net> <54E370F9.8060209@gmx.net> <17faabb6e724fb54f3cb8060a3d9cb08@lodderstedt.net> <54E4B0AD.10801@gmx.net> <CA+k3eCThg3TxRtCuEwGGWG07yWZD82i87fUQjDrKs3sMmd5frg@mail.gmail.com> <54E4CCDD.6010709@gmx.net> <CA+k3eCTqAFK_yfn65YOV-Ba0buhw9+cT=4+uF1aLO++7dfikbg@mail.gmail.com>
From: Nat Sakimura <sakimura@gmail.com>
Date: Tue, 10 Mar 2015 00:24:59 +0000
Message-ID: <CABzCy2A6gr_0Xv3YcyB0bN_JbR4P_VmG5kmmo1LEEOyyS2Awjg@mail.gmail.com>
To: Brian Campbell <bcampbell@pingidentity.com>, Hannes Tschofenig <hannes.tschofenig@gmx.net>
Content-Type: multipart/alternative; boundary=089e0116126e5d39f20510e42eda
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/ud25vpXPUltOtDKaNdVEpqebmAY>
Cc: oauth <oauth@ietf.org>, "naa@google.com >> Naveen Agarwal" <naa@google.com>
Subject: Re: [OAUTH-WG] Shepherd Writeup for draft-ietf-oauth-spop-06.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Mar 2015 00:25:02 -0000

Finally, we added PKCE S256 support on our implementation.

Best,

Nat
2015年2月20日(金)、7:28 Brian Campbell <bcampbell@pingidentity.com>om>:

> I can't comment with any authority on product road-map (that's above my
> pay-grade) but I can speculate that we probably would support "S256"
> eventually.
>
> On Wed, Feb 18, 2015 at 10:33 AM, Hannes Tschofenig <
> hannes.tschofenig@gmx.net> wrote:
>
>> Thanks Brian for pointing me to Section 4.4.1 and to the MTI for "S256".
>> While this is good from a security point of view I am wondering whether
>> anyone is actually compliant to the specification. Neither PingIdentity
>> nor DT implements the S256 transform, if I understood that correctly.
>> Are you guys going planning to update your implementations?
>>
>> Ciao
>> Hannes
>>
>> On 02/18/2015 05:45 PM, Brian Campbell wrote:
>> > There's a bit of MTI talk tucked into
>> > https://tools.ietf.org/html/draft-ietf-oauth-spop-10#section-4.4.1 that
>> > perhaps needs to be expanded and/or placed somewhere else.
>> >
>> > On Wed, Feb 18, 2015 at 8:33 AM, Hannes Tschofenig
>> > <hannes.tschofenig@gmx.net <mailto:hannes.tschofenig@gmx.net>> wrote:
>> >
>> >     Thanks for the info, Torsten.
>> >
>> >     Your feedback raises an interesting question, namely what
>> functionality
>> >     the parties have to implement to claim conformance to the
>> specification.
>> >
>> >     Quickly scanning through the specification didn't tell me whether
>> it is
>> >     OK to just implement the plain mode or whether both modes are
>> >     mandatory-to-implement. We have to say something about this.
>> >
>> >     Ciao
>> >     Hannes
>> >
>> >
>> >     On 02/18/2015 02:16 PM, torsten@lodderstedt.net
>> >     <mailto:torsten@lodderstedt.net> wrote:
>> >     > Hi Hannes,
>> >     >
>> >     > our implementation supports the "plain" mode only. We just
>> verified
>> >     > compliance of our implementation with the current spec. As the
>> only
>> >     > deviation, we do not enforce the minimum length of 43 characters
>> >     of the
>> >     > code verifier.
>> >     >
>> >     > kind regards,
>> >     > Torsten.
>> >     >
>> >     > Am 17.02.2015 17:48, schrieb Hannes Tschofenig:
>> >     >> Hi Torsten,
>> >     >>
>> >     >> does this mean that your implementation is not compliant with the
>> >     >> current version anymore or that you haven't had time to verify
>> >     whether
>> >     >> there are differences to the earlier version?
>> >     >>
>> >     >> Ciao
>> >     >> Hannes
>> >     >>
>> >     >>
>> >     >> On 01/31/2015 05:34 PM, Torsten Lodderstedt wrote:
>> >     >>> Deutsche Telekom also implemented an early version of the draft
>> last
>> >     >>> year.
>> >     >>>
>> >     >>>
>> >     >>>
>> >     >>> Am 30.01.2015 um 18:50 schrieb Brian Campbell
>> >     >>> <bcampbell@pingidentity.com <mailto:bcampbell@pingidentity.com>
>> >     <mailto:bcampbell@pingidentity.com
>> >     <mailto:bcampbell@pingidentity.com>>>:
>> >     >>>
>> >     >>>>
>> >     >>>> On Tue, Jan 27, 2015 at 9:24 AM, Hannes Tschofenig
>> >     >>>> <hannes.tschofenig@gmx.net <mailto:hannes.tschofenig@gmx.net>
>> >     <mailto:hannes.tschofenig@gmx.net
>> >     <mailto:hannes.tschofenig@gmx.net>>> wrote:
>> >     >>>>
>> >     >>>>
>> >     >>>>     1) What implementations of the spec are you aware of?
>> >     >>>>
>> >     >>>>
>> >     >>>> We have an AS side implementation of an earlier draft that was
>> >     >>>> released in June of last year:
>> >     >>>>
>> >
>> http://documentation.pingidentity.com/pages/viewpage.action?pageId=26706844
>> >     >>>>
>> >     >>>> _______________________________________________
>> >     >>>> OAuth mailing list
>> >     >>>> OAuth@ietf.org <mailto:OAuth@ietf.org> <mailto:OAuth@ietf.org
>> >     <mailto:OAuth@ietf.org>>
>> >     >>>> https://www.ietf.org/mailman/listinfo/oauth
>> >
>> >
>>
>>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>