Subject: Re: [OAUTH-WG] draft-tschofenig-oauth-hotk-01

From: Torsten Lodderstedt <[email-masked]>
Date: Thu, 27 Dec 2012 09:18:10 +0100

Hi Hannes,

as far as I understand, your proposal prevents adversaries to create new requests utilizing a stolen access token. Does the proposal also intend to prevent request replay?

Regards,
Torsten.

Am 16.07.2012 um 20:07 schrieb Hannes Tschofenig <[email-masked]>:

> Hi all, 
> 
> I had just submitted an updated version of the holder-of-the-key document and you can find it here: 
> http://tools.ietf.org/html/draft-tschofenig-oauth-hotk-01
> 
> John, Tony, and Phil joined me as co-authors and the document now also describes the symmetric key case (even though I am not entirely convinced about it) but there was good discussion feedback on the mailing list about it and so it makes sense to illustrate a strawman solution. 
> 
> Ciao
> Hannes
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth