IETF Logo Mail Archive

Re: [OAUTH-WG] why are we signing?

Eran Hammer-Lahav <eran@hueniverse.com> Thu, 12 November 2009 08:16 UTC

Return-Path: <eran@hueniverse.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DBA0D3A6935 for <oauth@core3.amsl.com>; Thu, 12 Nov 2009 00:16:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.549
X-Spam-Level:
X-Spam-Status: No, score=-2.549 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gdwD+Nxh6y0R for <oauth@core3.amsl.com>; Thu, 12 Nov 2009 00:16:59 -0800 (PST)
Received: from p3plex1out01.prod.phx3.secureserver.net (p3plex1out01.prod.phx3.secureserver.net [72.167.180.17]) by core3.amsl.com (Postfix) with SMTP id EEAE33A6A24 for <oauth@ietf.org>; Thu, 12 Nov 2009 00:16:58 -0800 (PST)
Received: (qmail 7720 invoked from network); 12 Nov 2009 08:17:27 -0000
Received: from unknown (HELO smtp.ex1.secureserver.net) (72.167.180.19) by p3plex1out01.prod.phx3.secureserver.net with SMTP; 12 Nov 2009 08:17:27 -0000
Received: from P3PW5EX1MB01.EX1.SECURESERVER.NET ([10.6.135.19]) by P3PW5EX1HT001.EX1.SECURESERVER.NET ([72.167.180.19]) with mapi; Thu, 12 Nov 2009 01:17:27 -0700
From: Eran Hammer-Lahav <eran@hueniverse.com>
To: "oauth@ietf.org" <oauth@ietf.org>
Date: Thu, 12 Nov 2009 01:17:15 -0700
Thread-Topic: [OAUTH-WG] why are we signing?
Thread-Index: AcpjOxC9Jywn9WdvQaucgA3t0oWNLwANOzDQ
Message-ID: <90C41DD21FB7C64BB94121FBBC2E72343785102B49@P3PW5EX1MB01.EX1.SECURESERVER.NET>
References: <daf5b9570911082102u215dcf22gf0aeb2f3578e5ea0@mail.gmail.com> <35D50F5C-3982-4298-A9E0-86A528F5C5D3@jkemp.net> <daf5b9570911092158k682aff63l959c423c399b2277@mail.gmail.com> <4A956CE47D1066408D5C7EB34368A5110551FFC1@S4DE8PSAAQC.mitte.t-com.de> <daf5b9570911111754u49f72a0aia59814b5da497a51@mail.gmail.com>
In-Reply-To: <daf5b9570911111754u49f72a0aia59814b5da497a51@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [OAUTH-WG] why are we signing?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 12 Nov 2009 08:16:59 -0000

As a matter of process, I would suggest looking at what the 1.0 HMAC-SHA1 method signs, and discuss if it is where we should be. We are working with an existing draft and should structure our discussions as feedback to that point of reference. This doesn't limit the conclusion in any way, and is how this WG has been chartered.

EHL


> -----Original Message-----
> From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf
> Of Brian Eaton
> Sent: Wednesday, November 11, 2009 5:54 PM
> To: BeckW@telekom.de
> Cc: oauth@ietf.org
> Subject: Re: [OAUTH-WG] why are we signing?
> 
> So we've got at least five different use cases for signing requests
> with the oauth access token and token secret.
> 
> Sweet.
> 
> The downside to the use cases is that they all have incompatible
> signature base strings.  I'd like to see us come up with something so
> that we don't have to reinvent the base string again for every single
> use case.
> 
> Cheers,
> Brian
> 
> On Wed, Nov 11, 2009 at 5:49 PM,  <BeckW@telekom.de> wrote:
> >
> > On Mon, Nov 9, 2009 at 6:28 AM, John Kemp <john@jkemp.net> wrote:
> >> If we are only interested in i) [authenticating the entity] then
> > signing any piece of the message might
> >> be sufficient. If we are interested in ii) [binding the signature to
> > the message] (or some other security property)
> >> then we will need to identify which pieces of the message we want to
> > provide
> >> that, or other, security properties for.
> >
> >> Brian Eaton wrote:
> >> OK, let me try to summarize what I've heard on this thread about the
> >> different use-cases for message signing:
> >>
> >> - sign the HTTP request
> >>   Used to prevent MITM from replaying token to a different URL.
>  Also
> >> limits the replay attack window to minutes instead of hours.
> >>
> >> - sign various other parts of the message
> >>   DKIM: signs various message headers
> >>   SIP: unspecified, just says "relevant parts of SIP request"
> > Hannes Tschofenig suggested handle SIP messages the way described in
> RfC
> > 4474 (SIP identity). It lists the parts of a SIP messsage that need
> to
> > be protected.
> >
> > Wolfgang
> >
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email