Subject: [OAUTH-WG] Timestamp & Nonce, together or apart

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 3 Dec 2009 22:25:35 -0700

Here is an semi-bikeshedding question:

                       timestamp="137131200",  nonce="dj83hs9s"
OR
                       nonce="137131200:dj83hs9s"

The only reason to put them together is because they are really two parts of the same thing, and are not used separately. The only reason to keep them separate is to make parsing a tiny bit easier.

Comments?

EHL

---

From: "Paul C. Bryan" <[email-masked]>
Date: Thu, 03 Dec 2009 21:43:43 -0800

I'd like my bikeshed painted in two distinct and separate colors:
timestamp and nonce.

On Thu, 2009-12-03 at 22:25 -0700, Eran Hammer-Lahav wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: "Manger, James H" <[email-masked]>
Date: Sat, 5 Dec 2009 00:59:34 +1100

>                        nonce="137131200:dj83hs9s"

My suggestion:   t=137131200.65757

Time in seconds since 1970 as a real number (ie can have a decimal point).
Server accepts any value that is "recent enough" and hasn't been seen before.
Server should not generally require strictly increasing values (to cope with reordering of requests or distributed clients -- unless ordering is crucial for the specific app).
Servers should use string comparisons to check if a value has been seen before to avoid any floating point limitations (client can send values with any (reasonable) precision).

Clients can append extra digits (random or incrementing) (after the decimal point) if necessary. A distributed client could do this to (statistically) ensure values are unique.
A fast client (making multiple requests per clock tick) could do this.
Any client could do this to ensure the value is not predictable (or subject to manipulation by a server pretending its clock was a specific time).

A client can determine the time at the server from the Date and optional Age HTTP header fields.
Those should be enough. It sounds like an explicit suggestion for clients to look at those might be helpful.

-- 
James Manger

---

From: Richard Barnes <[email-masked]>
Date: Sun, 6 Dec 2009 21:03:42 -0500

Separate.  IIRC, they are handled separately, e.g., the server looks  
for non-decreasing timestamps.  If they're not used separately (if the  
time semantic isn't important), then we should just have a nonce.
--Richard

On Dec 4, 2009, at 12:25 AM, Eran Hammer-Lahav wrote:

> The only reason to put them together is because they are really two  
> parts of the same thing, and are not used separately. The only  
> reason to keep them separate is to make parsing a tiny bit easier.
>
> Comments?
>
> EHL