Subject: [OAUTH-WG] delegation, authentication, public key, hmac, and bearer tokens

From: Brian Eaton <[email-masked]>
Date: Tue, 1 Dec 2009 09:52:02 -0800

I'm going to try to summarize some conversations that happened in
other threads on these topics.  Our story so far:

A significant number of people don't think any crypto is necessary for
most use cases.   Some folks want HMAC to protect token secrets over
HTTP.  [1].

Several people believe public key cryptography is necessary for
bootstrapping authentication. [2].

A few people have expressed a preference for public key signing of
individual data access requests. [1] and [2].

Everybody is in favor of a model that allows new signature algorithms
to be added in the future. [3].

No one appears to be arguing strongly that data access requests (as
opposed to the initial authentication/authorization) need to be signed
*both* with public key and HMAC.

To meet these requirements, I think we should

1) Agree on a signature base string, something sort of like the
signature base string in OAuth 1.0a. [4]
2) Agree on a system for naming signature algorithms.
3) Agree on profiles for combining bearer tokens/redirects/signed
tokens into reusable profiles to address different use cases.

I'd fully expect people to mix-and-match and come up with new profiles
that trade-off security, complexity, and latency in ways that address
their individual use cases.  My hope would be that they could reuse as
much of the signature base string and the signature algorithms as
possible.

Sound reasonable?

Cheers,
Brian

[1] http://www.ietf.org/mail-archive/web/oauth/current/msg00506.html
[2] http://www.ietf.org/mail-archive/web/oauth/current/msg00630.html
[3] http://www.ietf.org/mail-archive/web/oauth/current/msg00585.html
[4] http://oauth.net/core/1.0a#anchor13

---

From: Igor Faynberg <[email-masked]>
Date: Tue, 01 Dec 2009 20:18:15 -0500

Reasonable?.. As far as I am concerned, it is *perfect!

*Igor

> much of the signature base string and the signature algorithms as

...

---

From: John Panzer <[email-masked]>
Date: Tue, 1 Dec 2009 17:53:53 -0800

+1
--
John Panzer / Google
[email-masked] / abstractioneer.org / @jpanzer

On Tue, Dec 1, 2009 at 9:52 AM, Brian Eaton <[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>