Re: [OAUTH-WG] Question lengths in draft-sakimura-oauth-tcse-03

I think octets is more consistent with other JW* and OAuth specs.

The code_challange is the same length as the code_verifyer or is a hash of the code_verifyer so likely smaller than 128octets (43 ish for base64 256 bit)

Limiting the code_verifyer size sets the upper bound for code_challange, unless someone comes up with a really creative code challenge algorithm.

I will talk to nat about changing it to octets when I see him tomorrow.  

John B.

On May 12, 2014, at 11:15 PM, Derek Atkins <warlord@MIT.EDU> wrote:

> Brian Campbell <bcampbell@pingidentity.com> writes:
> 
>> I notice that code_verifier is defined as "high entropy cryptographic random
>> string of length less than 128 bytes"  [1], which brought a few questions and
>> comments to mind. So here goes:
>> 
>> Talking about the length of a string in terms of bytes is always potentially
>> confusing. Maybe characters would be an easier unit for people like me to wrap
>> their little brains around?
> 
> It depends if it really is characters or bytes.  For example there are
> many multi-byte UTF-8 characters, so if it really is bytes then saying
> characters is wrong because it could overflow.  So let's make sure we
> know what we're talking about.  Historically, if we're talking bytes the
> IETF often uses the phrase "octets".  Would that be less confusing?
> 
>> Why are we putting a length restriction on the code_verifier anyway? It seems
>> like it'd be more appropriate to restrict the length of the code_challenge
>> because that's the thing the AS will have to maintain somehow (store in a DB
>> or memory or encrypt into the code). Am I missing something here?
>> 
>> Let me also say that I hadn't looked at this document since its early days in
>> draft -00 or -01 last summer but I like the changes and how it's been kept
>> pretty simple for the common use-case while still allowing for crypto agility/
>> extension. Nice work!
>> 
>> [1] http://tools.ietf.org/html/draft-sakimura-oauth-tcse-03#section-3.3
> 
> -derek
> 
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
> 
> -- 
>       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
>       Member, MIT Student Information Processing Board  (SIPB)
>       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
>       warlord@MIT.EDU                        PGP key available