Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-mtls-13.txt

From: [email-masked]
Date: Mon, 25 Feb 2019 14:14:50 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Web Authorization Protocol WG of the IETF.

        Title           : OAuth 2.0 Mutual TLS Client Authentication and Certificate-Bound Access Tokens
        Authors         : Brian Campbell
                          John Bradley
                          Nat Sakimura
                          Torsten Lodderstedt
	Filename        : draft-ietf-oauth-mtls-13.txt
	Pages           : 29
	Date            : 2019-02-25

Abstract:
   This document describes OAuth client authentication and certificate-
   bound access tokens using mutual Transport Layer Security (TLS)
   authentication with X.509 certificates.  OAuth clients are provided a
   mechanism for authentication to the authorization server using mutual
   TLS, based on either self-signed certificates or public key
   infrastructure (PKI).  OAuth authorization servers are provided a
   mechanism for binding access tokens to a client's mutual TLS
   certificate, and OAuth protected resources are provided a method for
   ensuring that such an access token presented to it was issued to the
   client presenting the token.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-mtls/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-oauth-mtls-13
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-mtls-13

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-mtls-13

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Brian Campbell <[email-masked]>
Date: Mon, 25 Feb 2019 15:23:59 -0700

Draft -13 of "OAuth 2.0 Mutual TLS Client Authentication and
Certificate-Bound Access Tokens" has been published. The changes are listed
below and are largely aimed at addressing feedback from the AD review.
Although they also include some things that the WG has discussed on this
mailing list and at/around the meeting in Bangkok.

   draft-ietf-oauth-mtls-13

   o  Add an abstract protocol flow and diagram to serve as an overview
      of OAuth in general and baseline to describe the various ways in
      which the mechanisms defined herein are intended to be used.
   o  A little bit less of that German influence.
   o  Rework the TLS references a bit and, in the Terminology section,
      clean up the description of what messages are sent and verified in
      the handshake to do 'mutual TLS'.
   o  Move the explanation about "cnf" introspection registration into
      the IANA Considerations.
   o  Add CIBA as an informational reference and additional example of
      an OAuth extension that defines an endpoint that utilizes client
      authentication.
   o  Shorten a few of the section titles.
   o  Add new client metadata values to allow for the use of a SAN in
      the PKI MTLS client authentication method.
   o  Add privacy considerations attempting to discuss the implications
      of the client cert being sent in the clear in TLS 1.2.
   o  Changed the 'Certificate Bound Access Tokens Without Client
      Authentication' section to 'Public Clients and Certificate Bound
      Tokens' and moved it up to be a top level section while adding
      discussion of binding refresh tokens for public clients.
   o  Reword/restructure the main PKI method section somewhat to
      (hopefully) improve readability.
   o  Reword/restructure the Self-Signed method section a bit to
      (hopefully) make it more comprehensible.
   o  Reword the AS and RS Implementation Considerations somewhat to
      (hopefully) improve readability.
   o  Clarify that the protected protected resource obtains the client
      certificate used for mutual TLS from its TLS implementation layer.
   o  Add Security Considerations section about the certificate
      thumbprint binding that includes the hash algorithm agility
      recommendation.
   o  Add an "mtls_endpoint_aliases" AS metadata parameter that is a
      JSON object containing alternative authorization server endpoints,
      which a client intending to do mutual TLS will use in preference
      to the conventional endpoints.
   o  Minor editorial updates.

---------- Forwarded message ---------
From: <[email-masked]>
Date: Mon, Feb 25, 2019 at 3:15 PM
Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-mtls-13.txt
To: <[email-masked]>
Cc: <[email-masked]>

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Web Authorization Protocol WG of the IETF.

        Title           : OAuth 2.0 Mutual TLS Client Authentication and
Certificate-Bound Access Tokens
        Authors         : Brian Campbell
                          John Bradley
                          Nat Sakimura
                          Torsten Lodderstedt
        Filename        : draft-ietf-oauth-mtls-13.txt
        Pages           : 29
        Date            : 2019-02-25

Abstract:

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._