Subject: Re: [oauth] OAUTH Charter Proposal

From: Chris Messina <[email-masked]>
Date: Sun, 1 Feb 2009 16:09:36 -0800

Had two quick things...
First, small typo: "OAuth consist of:" should be "OAuth consists of:"

Second, w/r/t to this:

Furthermore, Oauth 1.0 defines three signature methods used to protect
requests,
> namely PLAINTEXT, HMAC-SHA1, and RSA-SHA1. The group will work on new
> signature methods in case the existing mechanisms do not fulfill
> the security requirements.

Where are the "security requirements" coming from? Are these defined
separately? Whose are they?

Chris

On Sat, Jan 31, 2009 at 6:28 PM, Krishna Sankar <[email-masked]> wrote:

> Hannes,
>   Thank you. Agreed on all.
> Cheers & have a nice weekend
> <k/>
>
> Hannes Tschofenig wrote:
>
>> Hi Krishna,
>> Thanks for your quick response.
>>
>>
>>> Three vectors:
>>>
>>> a)   While we cannot legislate extensibility, an extensibility guideline
>>> document need to be part of the deliverables. When the main OAuth
>>> discussions occur, there will be things we will say "this is not core but
>>> belongs to extensions" or we might make certain assumptions that we need to
>>> explicitly state or we might have certain insights. This document can
>>> systemically capture all these artifacts. We also might need to add security
>>> considerations as well as interoperability and conformance for extensions.
>>>
>>>
>>
>> A description on how OAUTH can (or should) be extended is certainly useful
>> (better explicit than implicit). This could, for example, be part of the
>> main specification. I have also seen separate documents that illustrate
>> how
>> a protocol (or a set of protocols) can be extended. Example: Design
>> Guidelines for RADIUS
>> http://www.ietf.org/internet-drafts/draft-ietf-radext-design-05.txt
>> This document has been written some time after the deployment happened and
>> provides a sort of best current practice on how to build RADIUS
>> extensions.
>> I believe it is a bit early for these type of documents.
>> So, my proposal would be to capture the most important extensibility
>> aspects
>> within the main specification itself. Later, when some expertise can be
>> gained with OAUTH extensions one can start thinking about capturing the
>> design experience in a document.
>> I guess we are doing fine with the security considerations as every IETF
>> document needs to contain a section describing them.
>> In any case, if you already have some ideas for text (or already a text
>> proposal) for the OAUTH draft feel free to post something to the list
>> (even
>> though it is not directly related to the charter discussion itself).
>>
>>
>>> b) As a part of the charter we should add :
>>>
>>> * Promote interoperability
>>> * Provide guidelines for extensibility
>>>
>>> The group should think about extensibility & document the results of the
>>> deliberations
>>>
>>>
>>
>> Explicitly stating extensibility in the charter sounds useful to me. I
>> added it to the charter text.
>>
>>> c)   While I like an extensibility framework, it might prove to be too
>>> much and might not be practical. So am happy at the level of guidelines,
>>> insights and suggestions.
>>>
>>>
>>
>> Ok.
>>
>> Ciao
>> Hannes
>>
>>
>>
>>> Cheers
>>> <k/>
>>> Hannes Tschofenig wrote:
>>>
>>>
>>>>  >Should we mention anything about extensions or any
>>>>
>>>>
>>>>> extensibility framework ?
>>>>>
>>>>> Cheers
>>>>> <k/>
>>>>>
>>>>>
>>>> What specifically do you have in mind? A document that describes an
>>>> extensibility framework?
>>>> Highlighting in the charter what extension points
>>>>
>>> could/should be used?
>>>
>>>
>>>> Ciao
>>>> Hannes
>>>>
>>>>
>>>>
>>>>
>>>
>>
>>
>>
>
> _______________________________________________
> oauth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
Chris Messina
Citizen-Participant &
 Open Web Advocate-at-Large

factoryjoe.com # diso-project.org
citizenagency.com # vidoop.com
This email is:   [ ] bloggable    [X] ask first   [ ] private
_______________________________________________
oauth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth