Subject: [OAUTH-WG] channel bindings

From: Leif Johansson <[email-masked]>
Date: Wed, 29 Jul 2009 08:51:42 +0200

Here is a topic I raised at the mic at the first OAuth BOF: Should OAuth grow 
channel bindings in the sense of RFC5056? The purpose would be to bind the
OAuth exchange to an underlying secure channel (eg HTTPS) if present.

Background reading for this (apart from RFC5056) might be 
http://tools.ietf.org/html/draft-santesson-digestbind-01 that defines channel 
bindings for another HTTP authentication mechanism as well as the IANA
registry: http://www.iana.org/assignments/channel-binding-types/

	Cheers Leif