Subject: Re: [OAUTH-WG] RFC5849 - Purpose of Temporary Credentials Shared Secret?

From: "Craig Heath" <[email-masked]>
Date: Wed, 2 Mar 2011 12:57:13 -0800

Thanks for the quick response!  Can I ask a more specific question:  What's the security purpose of the Temporary Credentials shared secret?  If an implementation were to, say, always use an empty string, would it make any difference to the security of the protocol?

- Craig.
-----Original Message-----
From: Eran Hammer-Lahav
Sent:  02-03-2011, 8:27  pm
To: Craig Heath; [email-masked]
Subject: RE: RFC5849 - Purpose of Temporary Credentials Shared Secret?

Because it uses the same method of making authenticated requests as everything else. It’s just a result of pushing everything through a single function.

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Craig Heath
Sent: Wednesday, March 02, 2011 10:05 AM
To: [email-masked]
Subject: [OAUTH-WG] RFC5849 - Purpose of Temporary Credentials Shared Secret?

Hello!  Can some kind soul help me understand the purpose of the shared secret part of the Temporary Credentials in RFC5849?

- The client authenticates using the Cient Credentials, and gets the Temporary Credentials.
- The Resource Owner gives their authorization.
- The Temporary Credentials are then used in the Token Credentials Request.

The part that's puzzling me is the RFC says the client authenticates using *both* the Client Credentials and the Token Credentials in the Token Credentials Request.  I could understand one or the other, but why both? (and incidentally, how can it provide both?)  Clearly the Token Credentials identifier is needed, as it is part of the Token Credentials Request; it's only the shared secret I'm wondering about (the "oauth_token_secret" part of the reponse to the Temporary Credentials Request).

My best guess so far is that it is intended to allow for the case when the Client Credentials are not secret, but in that case why use the Client Credentials at all in the Token Credential Request?

Thanks for any light shed on this!

- Craig Heath.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 2 Mar 2011 16:26:42 -0700

It limits the ability to exchange the token in cases where the client has no private secret, or if the client has multiple instances using the same credentials (providing an isolation between them). You need to make your own security analysis of the protocol and your needs.

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Craig Heath
Sent: Wednesday, March 02, 2011 12:57 PM
To: [email-masked]
Subject: Re: [OAUTH-WG] RFC5849 - Purpose of Temporary Credentials Shared Secret?

- Craig.

-----Original Message-----

From: Eran Hammer-Lahav

Because it uses the same method of making authenticated requests as everything else. It's just a result of pushing everything through a single function.

EHL

- Craig Heath.

---

From: "Craig Heath" <[email-masked]>
Date: Thu, 3 Mar 2011 01:06:18 -0800

"... if the client has multiple instances ..."

Aha, the penny drops!  Thank you :-)

- Craig.

From: Eran Hammer-Lahav [mailto:[email-masked]]
Sent: 02 March 2011 23:27
To: Craig Heath; [email-masked]
Subject: RE: [OAUTH-WG] RFC5849 - Purpose of Temporary Credentials Shared Secret?

EHL

- Craig.

-----Original Message-----

From: Eran Hammer-Lahav

EHL

- Craig Heath.