Subject: Re: [OAUTH-WG] New Version Notification for draft-hunt-oauth-pop-architecture-00.txt

From: Prateek Mishra <[email-masked]>
Date: Thu, 03 Apr 2014 09:30:27 -0700

"key confirmed" or "key confirmation" is another term that is widely 
used for these use-cases
> I really *like* the name "proof of possession", but I think the 
> acronym PoP is going to be confused with POP. HOTK has the advantage 
> of not being a homonym for aything else.  What about "Possession Proof"?
> -bill
>
>
> --------------------------------
> William J. Mills
> "Paranoid" MUX Yahoo!
>
> On Thursday, April 3, 2014 1:38 AM, "[email-masked]" 
> <[email-masked]> wrote:
>
> A new version of I-D, draft-hunt-oauth-pop-architecture-00.txt
> has been successfully submitted by Hannes Tschofenig and posted to the
> IETF repository.
>
> Name:        draft-hunt-oauth-pop-architecture
> Revision:    00
> Title:        OAuth 2.0 Proof-of-Possession (PoP) Security Architecture
> Document date:    2014-04-03
> Group:        Individual Submission
> Pages:        21
> URL: 
> http://www.ietf.org/internet-drafts/draft-hunt-oauth-pop-architecture-00.txt
> Status: 
> https://datatracker.ietf.org/doc/draft-hunt-oauth-pop-architecture/
> Htmlized: http://tools.ietf.org/html/draft-hunt-oauth-pop-architecture-00
>
>
> Abstract:
>   The OAuth 2.0 bearer token specification, as defined in RFC 6750,
>   allows any party in possession of a bearer token (a "bearer") to get
>   access to the associated resources (without demonstrating possession
>   of a cryptographic key).  To prevent misuse, bearer tokens must to be
>   protected from disclosure in transit and at rest.
>
>   Some scenarios demand additional security protection whereby a client
>   needs to demonstrate possession of cryptographic keying material when
>   accessing a protected resource.  This document motivates the
>   development of the OAuth 2.0 proof-of-possession security mechanism.
>
>
>
>
> Please note that it may take a couple of minutes from the time of 
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
>

---

From: Anil Saldhana <[email-masked]>
Date: Thu, 03 Apr 2014 11:37:51 -0500

Prateek,
   why not just use "proof"?

draft-hunt-oauth-proof-architecture-00.txt

Is that allowed by IETF?

Regards,
Anil

---

From: Phil Hunt <[email-masked]>
Date: Thu, 3 Apr 2014 09:41:39 -0700

What was wrong with HOK?

Aside: Why was “the” so important in HOTK?

Phil

@independentid
www.independentid.com
[email-masked]

On Apr 3, 2014, at 9:37 AM, Anil Saldhana <[email-masked]> wrote:

>> "key confirmed" or "key confirmation" is another term that is widely used for these use-cases
>>> I really *like* the name "proof of possession", but I think the acronym PoP is going to be confused with POP.  HOTK has the advantage of not being a homonym for aything else.  What about "Possession Proof"?
>>>  
>>> -bill
>>> 
>>> 
>>> On Thursday, April 3, 2014 1:38 AM, "[email-masked]" <[email-masked]> wrote:
>>> 
>>> URL:            http://www.ietf.org/internet-drafts/draft-hunt-oauth-pop-architecture-00.txt
>>> Status:        https://datatracker.ietf.org/doc/draft-hunt-oauth-pop-architecture/
>>> Please note that it may take a couple of minutes from the time of submission
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: John Bradley <[email-masked]>
Date: Thu, 3 Apr 2014 14:10:10 -0400

Some people and specs associate holder of key with asymmetric keys.  Proof of possession is thought to be a broader category including symmetric and key agreement eg http://tools.ietf.org/html/rfc2875.

NIST defines the term PoP Protocol http://fismapedia.org/index.php?title=Term:Proof_of_Possession_Protocol

In SAML the saml:SubjectConfirmation method  is called urn:oasis:names:tc:SAML:2.0:cm:holder-of-key 

In WS* the term proof of possession is more common.

So I think for this document as an overview "Proof of Possession (PoP) Architecture" is fine.

John B.

---

From: Mike Jones <[email-masked]>
Date: Thu, 3 Apr 2014 18:31:52 +0000

I agree with what John wrote below.  Besides, PoP is more natural to say than HoK and certainly more natural to say than HOTK.  I'd like us to stay with the term Proof-of-Possession (PoP).

                                                            -- Mike

From: OAuth [mailto:[email-masked]] On Behalf Of John Bradley
Sent: Thursday, April 03, 2014 11:10 AM
To: Phil Hunt
Cc: [email-masked]
Subject: Re: [OAUTH-WG] New Version Notification for draft-hunt-oauth-pop-architecture-00.txt

John B.

On Apr 3, 2014, at 12:41 PM, Phil Hunt <[email-masked]<mailto:[email-masked]>> wrote:

What was wrong with HOK?

Aside: Why was "the" so important in HOTK?

Phil

@independentid
www.independentid.com<http://www.independentid.com/>
[email-masked]<mailto:[email-masked]>

On Apr 3, 2014, at 9:37 AM, Anil Saldhana <[email-masked]<mailto:[email-masked]>> wrote:

Prateek,

Is that allowed by IETF?

Regards,
Anil

-bill

On Thursday, April 3, 2014 1:38 AM, "[email-masked]"<mailto:[email-masked]> <[email-masked]><mailto:[email-masked]> wrote:

Abstract:

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org/>.

The IETF Secretariat

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Bill Mills <[email-masked]>
Date: Thu, 3 Apr 2014 09:06:24 -0700

-bill

Abstract:

The IETF Secretariat

---

From: Thomas Hardjono <[email-masked]>
Date: Fri, 4 Apr 2014 15:38:15 +0000

Bill,

The PoP terminology in ancient IETF terminology coming from the IPsec WG (also home of IKE and IKEv2 protocols), 
and perhaps even before the IPsec WG.  So its a well-known term in the Security Area. I'd suggest we keep it.

Folks that work in the Mail & routing area use the term POP3 or RFC1939 in their context.

People in OASIS security-related Technical Committees use HOK (holder of key), such as the HOK Web Browser profile:

https://wiki.oasis-open.org/security/SamlHoKWebSSOProfile

/thomas/

________________________________________
From: OAuth [[email-masked]] on behalf of Bill Mills [[email-masked]]
Sent: Thursday, April 03, 2014 12:06 PM
To: Phil Hunt; Prateek Mishra; Hannes Tschofenig; Justin Richer; OAuth WG
Subject: Re: [OAUTH-WG] New Version Notification for draft-hunt-oauth-pop-architecture-00.txt

-bill

Abstract:

The IETF Secretariat

---

From: Anthony Nadalin <[email-masked]>
Date: Mon, 7 Apr 2014 01:45:54 +0000

I have to agree with Phil on this as there are already spec out there that use HoK and PoP , either of these work but prefer HoK as folks get confused with PoP as we have seen this within our company already

From: OAuth [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Thursday, April 3, 2014 11:32 AM
To: John Bradley; Phil Hunt
Cc: [email-masked]
Subject: Re: [OAUTH-WG] New Version Notification for draft-hunt-oauth-pop-architecture-00.txt

                                                            -- Mike

From: OAuth [mailto:[email-masked]] On Behalf Of John Bradley
Sent: Thursday, April 03, 2014 11:10 AM
To: Phil Hunt
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [OAUTH-WG] New Version Notification for draft-hunt-oauth-pop-architecture-00.txt

John B.

What was wrong with HOK?

Phil

@independentid

Prateek,

Is that allowed by IETF?

Regards,
Anil

-bill

Abstract:

The IETF Secretariat