[Txauth] (no subject)

[Dick Hardt <[e-mail]>]

Hey Kathleen

A couple questions on your presentation:

1) Which versions of the documents did you review?

2) Would you elaborate on your security comparisons of XAuth and XYZ? I
want to make sure I understand the work you put into your review.  While
reviewing your slides, I was not following a number of your statements. For
example:

In your first slide:

A) you stated that "XAuth Relies heavily on OAuth2.0, using Bearer token
and adding cryptographic (e.g.JOSE) functions after-the-fact". Both XAuth
and XYZ support bearer tokens for calling an RS. I'm not clear how this
feature is different in XAuth.

B) What parts of XYZ did you view as "Builds security into the protocol as
opposed to adding it in later (e.g. OAuth2.0 bearer token + JWT)"?

C) "Interaction flows defined, focus more on security with cryptographic
requirements and examples included" -- there some cryptography in the
redirect flow, but not in the others. In my opinion, the cryptography in
the redirect flow does not add any value, and just complicates the
protocol.

Perhaps you can point to sections in each draft?

Thanks!

/Dick