[OAUTH-WG] proposal for signatures

2010-06-21 Thread Dirk Balfanz
Hi guys, I think I owe the list a proposal for signatures. I wrote something down that liberally borrows ideas from Magic Signatureshttp://salmon-protocol.googlecode.com/svn/trunk/draft-panzer-magicsig-00.html, SWT http://groups.google.com/group/WRAP-WG/files, and (even the name from) JSON Web

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Ben Laurie
On 21 June 2010 08:04, Dirk Balfanz balf...@google.com wrote: Hi guys, I think I owe the list a proposal for signatures. I wrote something down that liberally borrows ideas from Magic Signatures, SWT, and (even the name from) JSON Web Tokens. Here is a short document (called JSON Tokens) that

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Nat Sakimura
Hi Dirk, In addition to Ben's questions, I have another. For X.509, you seem to be using DER. How do you express the entire certificate chain using DER? (With PEM, you can just concatenate ... ) And here is some comments: If body_hash is not used, it seems it is just doing the client

Re: [OAUTH-WG] Status update

2010-06-21 Thread Thomas Hardjono
Another newbie question: what is the technical reason for NOT including an oauth protocol version number? Including protocol versions numbering is the norm in most/all IETF protocols. Also exchange types, cipher types, etc. etc. /thomas/ From:

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Dick Hardt
Thanks for writing this up Dirk. I would suggest that the token be: payload . envelope . signature This enables the payload to be encrypted and independent from the envelope. Token signing, verification, encryption and decryption code can then be generic and not understand the

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Nat Sakimura
On Mon, Jun 21, 2010 at 10:26 PM, Ben Laurie b...@google.com wrote: On 21 June 2010 14:22, Nat Sakimura sakim...@gmail.com wrote: Hi Dirk, In addition to Ben's questions, I have another. For X.509, you seem to be using DER. How do you express the entire certificate chain using DER? (With

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Ben Laurie
On 21 June 2010 16:33, Nat Sakimura sakim...@gmail.com wrote: On Mon, Jun 21, 2010 at 10:26 PM, Ben Laurie b...@google.com wrote: On 21 June 2010 14:22, Nat Sakimura sakim...@gmail.com wrote: Hi Dirk, In addition to Ben's questions, I have another. For X.509, you seem to be using DER. How do

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Brian Eaton
On Mon, Jun 21, 2010 at 7:43 AM, Dick Hardt dick.ha...@gmail.com wrote: Thanks for writing this up Dirk. I would suggest that the token be: payload . envelope . signature This enables the payload to be encrypted and independent from the envelope. Token signing, verification, encryption and

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Justin Smith
I'm not emphatic about either, but my vote is to remove the envelope. -Original Message- From: oauth-boun...@ietf.org [mailto:oauth-boun...@ietf.org] On Behalf Of Brian Eaton Sent: Monday, June 21, 2010 9:49 AM To: Dick Hardt Cc: OAuth WG Subject: Re: [OAUTH-WG] proposal for signatures

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Dick Hardt
A couple of advantages of separating: 1) everything but the envelope data (key_id, signer, algorithm) gets encrypted 2) if the encrypted data is an object in the JSON, then it has been base64 encoded, and then gets base64 encoded again. Much more efficient to include the base64 encoded binary of

Re: [OAUTH-WG] OAuth 2 for Native Apps

2010-06-21 Thread Marius Scurtescu
Here is the wiki page: http://wiki.oauth.net/OAuth-2-for-Native-Apps Feel free to edit or comment. Marius On Wed, Jun 9, 2010 at 10:59 AM, David Recordon record...@gmail.com wrote: Want to put this on the wiki http://wiki.oauth.net/? On Mon, Jun 7, 2010 at 12:25 PM, Marius Scurtescu

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Dirk Balfanz
On Mon, Jun 21, 2010 at 4:18 AM, Ben Laurie b...@google.com wrote: On 21 June 2010 08:04, Dirk Balfanz balf...@google.com wrote: Hi guys, I think I owe the list a proposal for signatures. I wrote something down that liberally borrows ideas from Magic Signatures, SWT, and (even the name

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Dirk Balfanz
On Mon, Jun 21, 2010 at 6:22 AM, Nat Sakimura sakim...@gmail.com wrote: Hi Dirk, In addition to Ben's questions, I have another. For X.509, you seem to be using DER. How do you express the entire certificate chain using DER? (With PEM, you can just concatenate ... ) Good question:

Re: [OAUTH-WG] proposal for signatures

2010-06-21 Thread Manger, James H
Nat and Ben, In addition to Ben's questions, I have another. For X.509, you seem to be using DER. How do you express the entire certificate chain using DER? (With PEM, you can just concatenate ... ) With DER you can concatenate, too, of course. There's also PKCS#n (for some value

[OAUTH-WG] Last call for feedback on -08

2010-06-21 Thread Eran Hammer-Lahav
I am working on -09 which I hope will be the last major revision of the specification. If you were planning on submitting any feedback on draft -08 or the simplification proposal from David and me, please do so by tomorrow to be included in the next draft. EHL

[OAUTH-WG] OAuth discovery draft?

2010-06-21 Thread Manger, James H
Eran, There have been a few mentions recently of an OAuth discovery draft. Is there any such draft yet, or is this just a part that we know needs to be done? The email on OAuth meeting notes on -05 (with updates) said: 6.1.1. - describing the WWW-Authenticate response header - Discovery

Re: [OAUTH-WG] OAuth discovery draft?

2010-06-21 Thread Eran Hammer-Lahav
Yes, it's on my desk and not yet ready, but I am working on one. It includes your sites proposal among other things. I am trying to get the core spec stable this week and focus on that next. EHL -Original Message- From: Manger, James H [mailto:james.h.man...@team.telstra.com] Sent: