Re: [OAUTH-WG] IPR Disclosure - OAuth 2.0 Security Best Current Practice

2023-11-01 Thread isciurus
Hannes, I am not aware of any IPR related to this draft. Andrey On Wed, Oct 4, 2023 at 8:53 AM wrote: > I am not aware of any IPR associated with this document. > Am 4. Okt. 2023, 17:16 +0200 schrieb Daniel Fett 40danielfett...@dmarc.ietf.org>: > > I am not aware of any IPR associated with

Re: [OAUTH-WG] [SPICE] Relationship between SPICE and OAuth

2023-11-01 Thread Dick Hardt
I can't help myself to not reply to this ... :) On Wed, Nov 1, 2023 at 11:18 AM Denis wrote: > > > Bridging the architectural narrative used in the core OAuth framework (AS, > RS, RO) and in the three roles model > (Holder, Issuer, Verifier) would not be appropriate. > I'm not sure "would not

Re: [OAUTH-WG] [SPICE] Relationship between SPICE and OAuth

2023-11-01 Thread Denis
Hi Hannes, The current charter of the OAuth WG is available at: https://datatracker.ietf.org/wg/oauth/about/ The major problem is that both this charter and the OAuth 2.1 (or OAuth 2.0) authorization framework cannot currently address the three roles model with an Holder, an Issuer and

Re: [OAUTH-WG] Relationship between SPICE and OAuth

2023-11-01 Thread Hannes Tschofenig
Hi Torsten, Am 01.11.2023 um 17:43 schrieb tors...@lodderstedt.net: Have a missed a posting on this list where you have started a discussion with the WG of whether the drafts shall be moved into SPICE now? Otherwise I’m wondering about the tone of your post. It’s the WG that needs to decide on

[OAUTH-WG] Missing IPR confirmations .... Re: IPR Disclosure - OAuth 2.0 Security Best Current Practice

2023-11-01 Thread Hannes Tschofenig
John & Andrey - please reply to my email below. Ciao Hannes Am 04.10.2023 um 15:41 schrieb Tschofenig, Hannes: Hi Daniel, Torsten, Andrey, John, as part of the shepherd write-up, all authors of must confirm that any and all appropriate IPR disclosures required for full conformance with

Re: [OAUTH-WG] Relationship between SPICE and OAuth

2023-11-01 Thread torsten=40lodderstedt . net
Hi Hannes, Am 1. Nov. 2023, 12:21 +0100 schrieb Hannes Tschofenig : > Hi all, > > I am a bit puzzled by the response Pam and I received when putting the agenda > for the SPICE BOF together. It appears that most people have not paid > attention to the discussions during the last few months. > >

Re: [OAUTH-WG] [SPICE] Relationship between SPICE and OAuth

2023-11-01 Thread Orie Steele
I was also surprised to see this agenda, based on the discussions on OAUTH and SPICE lists. I am supportive of recapping, the great work that is happening at OAUTH, and how that work is applied outside of OAUTH to none OAUTH use cases. I don't think work items that are close to the finish line

Re: [OAUTH-WG] Relationship between SPICE and OAuth

2023-11-01 Thread Brian Campbell
I didn't expect to see SD-JWT as a "proposed work item" on the SPICE BoF agenda because its appropriateness to be and stay in the OAuth WG had been discussed on list (e.g., https://mailarchive.ietf.org/arch/msg/oauth/6qjAsqLwyp5WoxqY3dVv8SJ5nVM/) and SD-JWT wasn't mentioned in the SPICE BoF

Re: [OAUTH-WG] Relationship between SPICE and OAuth

2023-11-01 Thread Kristina Yasuda
Moving a somewhat mature draft to another WG is highly likely slow down the progress on that document: there is no guarantee there will be an overlap in the WG members, there is a risk that discussions that were already resolved to be re-opened to be, etc. I consider SD-JWT closer to a finish

[OAUTH-WG] Relationship between SPICE and OAuth

2023-11-01 Thread Hannes Tschofenig
Hi all, I am a bit puzzled by the response Pam and I received when putting the agenda for the SPICE BOF together. It appears that most people have not paid attention to the discussions during the last few months. Let me try to get you up to speed. So, here is my summary. The OAuth working