Subject: [OAUTH-WG] Fwd: New Version Notification for draft-sakimura-oauth-tcse-00.txt

From: Nat Sakimura <[email-masked]>
Date: Tue, 30 Jul 2013 18:58:57 +0900

As some of you know, passing the authorization code securely to a native
app on iOS platform is next to impossible. Malicious application may
register the same custom scheme as the victim application and hope to
obtain the code, whose success rate is rather high.

We have discussed about it during the OpenID Conenct Meeting at IETF 87 on
Sunday, and over a lengthy thread on the OpenID AB/Connect work group list.
I have captured the discussion in the form of I-D. It is pretty short and
hopefully easy to read.

IMHO, although it came up as an issue in OpenID Connect, this is a quite
useful extension to OAuth 2.0 in general.

Best,

Nat Sakimura

---------- Forwarded message ----------
From: <[email-masked]>
Date: 2013/7/30
Subject: New Version Notification for draft-sakimura-oauth-tcse-00.txt
To: Nat Sakimura <[email-masked]>, John Bradley <
[email-masked]>, Naveen Agarwal <[email-masked]>

A new version of I-D, draft-sakimura-oauth-tcse-00.txt
has been successfully submitted by Nat Sakimura and posted to the
IETF repository.

Filename:        draft-sakimura-oauth-tcse
Revision:        00
Title:           OAuth Transient Client Secret Extension for Public Clients
Creation date:   2013-07-29
Group:           Individual Submission
Number of pages: 7
URL:
http://www.ietf.org/internet-drafts/draft-sakimura-oauth-tcse-00.txt
Status:          http://datatracker.ietf.org/doc/draft-sakimura-oauth-tcse
Htmlized:        http://tools.ietf.org/html/draft-sakimura-oauth-tcse-00

Abstract:
   The OAuth 2.0 public client utilizing code flow is susceptible to the
   code interception attack.  This specification describe a mechanism
   that acts as a control against this threat.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: Nat Sakimura <[email-masked]>
Date: Wed, 31 Jul 2013 00:36:19 +0900

Hi.

I had to fix a few issues with the previous draft text.
No normative changes, but just removed some extra text.

Nat

---------- Forwarded message ----------
From: <[email-masked]>
Date: 2013/7/31
Subject: New Version Notification for draft-sakimura-oauth-tcse-01.txt
To: Nat Sakimura <[email-masked]>, John Bradley <

A new version of I-D, draft-sakimura-oauth-tcse-01.txt
has been successfully submitted by Nat Sakimura and posted to the
IETF repository.

Filename:        draft-sakimura-oauth-tcse
Revision:        01
Title:           OAuth Transient Client Secret Extension for Public Clients
Creation date:   2013-07-30
Group:           Individual Submission
Number of pages: 7
URL:
http://www.ietf.org/internet-drafts/draft-sakimura-oauth-tcse-01.txt
Status:          http://datatracker.ietf.org/doc/draft-sakimura-oauth-tcse
Htmlized:        http://tools.ietf.org/html/draft-sakimura-oauth-tcse-01
Diff:
http://www.ietf.org/rfcdiff?url2=draft-sakimura-oauth-tcse-01

Abstract:
   The OAuth 2.0 public client utilizing authorization code grant is
   susceptible to the code interception attack.  This specification
   describe a mechanism that acts as a control against this threat.

The IETF Secretariat

2013/7/30 Nat Sakimura <[email-masked]>