What you describe as your minimum case is what I intended to be the
minimum case for this document. I opted to put the token inside the
payload instead of a hash because then we wouldn't need an additional
header to carry the token, and the client wouldn't be required to do an
additional crypto operation outside of the JOSE process.
-- Justin
On 3/7/2017 2:13 AM, Nat Sakimura wrote:
Hi Justin, John, and Hannes
Is there an appetite to change the draft in such a way as:
- do not wrap access token itself. It could include at_hash though.
Rationale: Pop access token can be pretty large and I do not want to
double base64url encode.
- perhaps change ts to string to accommodate nonce like string.
Essentially, what I want to do is not the http signing but just the pop
based
client authentication, which is very simple.
While I was writing it up, it occurred that if the above modification were
done, your draft will be a superset of what I wanted to do.
My write up is here: http://bit.ly/oauth-jpop
Financial API uses cases needs something like that.
(Another possibility is a sender confirmation.)
Best,
Nat Sakimura
--
PLEASE READ :This e-mail is confidential and intended for the
named recipient only. If you are not an intended recipient,
please notify the sender and delete this e-mail.
-----Original Message-----
From: OAuth [mailto:oauth-boun...@ietf.org] On Behalf Of
internet-dra...@ietf.org
Sent: Tuesday, August 9, 2016 1:34 AM
To: i-d-annou...@ietf.org
Cc: oauth@ietf.org
Subject: [OAUTH-WG] I-D Action:
draft-ietf-oauth-signed-http-request-03.txt
A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Web Authorization Protocol of the IETF.
Title : A Method for Signing HTTP Requests for OAuth
Authors : Justin Richer
John Bradley
Hannes Tschofenig
Filename : draft-ietf-oauth-signed-http-request-03.txt
Pages : 13
Date : 2016-08-08
Abstract:
This document a method for offering data origin authentication and
integrity protection of HTTP requests. To convey the relevant data
items in the request a JSON-based encapsulation is used and the JSON
Web Signature (JWS) technique is re-used. JWS offers integrity
protection using symmetric as well as asymmetric cryptography.
The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-signed-http-request/
There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03
A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-signed-http-request-03
Please note that it may take a couple of minutes from the time of
submission
until the htmlized version and diff are available at tools.ietf.org.
Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
