Hi Hannes, On 12/18/2018 04:26 PM, Hannes Tschofenig wrote: > Hi Steffi, > >> In OAuth, the expires_in field is usually used to inform the client how long >> the access token is valid. If the client uses the access token in a request >> after the token expired, the RS will reject the request, which usually is >> not a big problem for the client. > >> In ACE, AS provides the client with keying material for the RS, which is a >> completely different situation. If the client does not know how long the >> keying material is valid, it may use outdated keying material to communicate >> with RS. The expires_in field can be used to inform the client how long the >> keying material for RS is valid, if the keying material is valid as long as >> the access token. > >> The main reason to change keying material from time to time is to avoid that >> it is compromised. I therefore think that it is necessary for the security >> of the solution that C knows how long the keying material is supposed to be >> valid. > > If a client uses either an old key or an old token then the request will > fail. I don't see much difference here between OAuth and ACE.
The difference is that C cannot authenticate RS with an outdated key. And even if the correct RS rejects the request, the confidentiality of the request may already have been breached, i.e., the damage is already done. C therefore must know how long the keying material is valid. Viele Grüße Steffi _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace
