Subject: [OAUTH-WG] [oauth] #2: No Required Signature Method

From: "oauth issue tracker" <[email-masked]>
Date: Tue, 21 Jul 2009 22:19:20 -0000

#2: No Required Signature Method
---------------------------------+------------------------------------------
 Reporter:  [email-masked]  |       Owner:     
     Type:  defect               |      Status:  new
 Priority:  major                |   Milestone:     
Component:  authentication       |     Version:     
 Severity:  Active WG Document   |    Keywords:     
---------------------------------+------------------------------------------
 The protocol currently supports three separate signature methods but does
 not mandate any. This implies that clients must support all methods in
 order to inter-operate. The spec should either spell that out as a client
 requirement or pick at least one method as required for both the client
 and server.

-- 
Ticket URL: <https://trac.tools.ietf.org/wg/oauth/trac/ticket/2>
oauth <http://tools.ietf.org/oauth/>

---

From: "oauth issue tracker" <[email-masked]>
Date: Fri, 31 Jul 2009 17:26:27 -0000

Severity:  Active WG Document   |   Resolution:     
 Keywords:                       |  

Comment(by [email-masked]):

 It seems that there must be use-cases for each of the three signature
 methods in which it makes sense for a provider/server to support only that
 signature method and neither of the other two.

 Plaintext: Communication only allowed over SSL
 HMAC-SHA1: Communication over SSL not available, payload not sensitive
 RSA-SHA1: ???

 Perhaps we can mandate HMAC-SHA1, which could also be used with SSL or TLS
 and providers can support the PLAINTEXT at their discretion. It would
 depend on the requirements that led to RSA-SHA1 and the processing
 overhead of HMAC-SH1 on mobile devices, neither of which are areas I am
 familiar with.

-- 
Ticket URL: <https://trac.tools.ietf.org/wg/oauth/trac/ticket/2#comment:1>
oauth <http://tools.ietf.org/oauth/>