Re: [OAUTH-WG] Few questions about HOTK

[Sergey Beryozkin <[e-mail]>]

On 21/12/12 16:32, William Mills wrote:
> I would find using a "mac" attribute inside a MAC token confusing.
> Inside a MAC token or any other client signed thing I'd probably call
> the keying assertion inside "key", and make the payload of that defined
> by token type since some things like EC have more than one value in the
> keying information.

OK. Actually, the draft uses "mac_key" to identify the key inside the 
token on the outbound path from the server, and "access_token" assumes 
the role of key identifier which is quite minimalistic, the access token 
has gone - the key has gone, hence the key scoping is supported...

"mac" is use on the path from a client to the server - but it is not 
part of the token as far as I understand - it is the client 
demonstration of the fact it received MAC token with the "mac_key" 
inside it; naming "mac_key" as simply "key" (which I read you 
suggesting) is a good idea IMHO

Sergey

>
> ------------------------------------------------------------------------
> *From:* Sergey Beryozkin <[e-mail]>
> *To:* William Mills <[e-mail]>
> *Cc:* "<[e-mail]>" <[e-mail]>
> *Sent:* Friday, December 21, 2012 7:59 AM
> *Subject:* Re: [OAUTH-WG] Few questions about HOTK
>
> On 21/12/12 15:54, William Mills wrote:
>  > No, MAC as I'm using it is a MAC token per
>  > http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-02
>
> Sure, what do you mean though when saying
> "HOTK payload can be carried in a MAC token." ?
>
> I'm presuming you have in mind the parameters as defined in the draft,
> and specifically I thought it was the 'mac' attribute which is
> effectively a HOTK payload, possibly alongside few other Authorization
> MAC scheme attributes ?
>
> Sergey
>
>  >
>  > ------------------------------------------------------------------------
>  > *From:* Sergey Beryozkin <[e-mail]
> <mailto:[e-mail]>>
>  > *To:* William Mills <[e-mail]
> <mailto:[e-mail]>>
>  > *Cc:* "<[e-mail] <mailto:[e-mail]>>" <[e-mail]
> <mailto:[e-mail]>>
>  > *Sent:* Friday, December 21, 2012 3:15 AM
>  > *Subject:* Re: [OAUTH-WG] Few questions about HOTK
>  >
>  > On 21/12/12 05:30, William Mills wrote:
>  > > MAC and HOTK describe different properties of a token, and could
> both be
>  > > used in the same token. MAC specifies a basic format for a signed token
>  > > payload and transaction. HOTK defines part of a token payload. HOTK
>  > > payload can be carried in a MAC token.
>  >
>  > Speaking of MAC, are you referring to
>  > "mac" parameter within MAC Authorization payload representing a HOTK
>  > property ?
>  >
>  > Cheers, Sergey
>  >
>  > >
>  > > -bill
>  > >
>  > >
> ------------------------------------------------------------------------
>  > > *From:* Sergey Beryozkin <[e-mail]
> <mailto:[e-mail]>
>  > <mailto:[e-mail] <mailto:[e-mail]>>>
>  > > *To:* "<[e-mail] <mailto:[e-mail]>
> <mailto:[e-mail] <mailto:[e-mail]>>>" <[e-mail]
> <mailto:[e-mail]>
>  > <mailto:[e-mail] <mailto:[e-mail]>>>
>  > > *Sent:* Thursday, December 20, 2012 1:49 PM
>  > > *Subject:* [OAUTH-WG] Few questions about HOTK
>  > >
>  > > Hi Hannes, others,
>  > >
>  > > I'd like to understand what is the difference between HOTK
> Symmetric [1]
>  > > and MAC [2].
>  > >
>  > > I'm reading about HOTK Symmetric and JWS profile and it seems like HOTK
>  > > Symmetric text can support MAC.
>  > >
>  > > My main question at the moment: does HOTK (Symmetric) offer an
>  > > alternative to MAC or is HOTK actually a higher-level token scheme
> which
>  > > can support different types of tokens ?
>  > >
>  > > thanks, Sergey
>  > >
>  > > [1] http://tools.ietf.org/html/draft-tschofenig-oauth-hotk-01
>  > > [2] http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-02
>  > > _______________________________________________
>  > > OAuth mailing list
>  > > [e-mail] <mailto:[e-mail]> <mailto:[e-mail]
> <mailto:[e-mail]>> <mailto:[e-mail] <mailto:[e-mail]>
>  > <mailto:[e-mail] <mailto:[e-mail]>>>
>  > > https://www.ietf.org/mailman/listinfo/oauth
>  > >
>  > >
>  >
>  >
>
>
>