Subject: [OAUTH-WG] New OAuth DPoP and Security BCP drafts

From: Daniel Fett <[email-masked]>
Date: Mon, 8 Jul 2019 15:29:41 +0200

All,

In preparation for the meeting in Montreal, I just uploaded a new version
of the DPoP draft:
https://tools.ietf.org/html/draft-fett-oauth-dpop-02

Please have a look and let me know what you think. We should make this a
working group item soon.

As you might have noticed, there is also a new version of the Security Best
Current Practice draft:
https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13

-Daniel

---

From: Filip Skokan <[email-masked]>
Date: Mon, 8 Jul 2019 17:15:15 +0200

I've updated my OP projects draft implementation to 02 as well as the
example browser based client using DPoP for those interested

RP: https://murmuring-journey-60982.herokuapp.com
OP: https://op.panva.cz/.well-known/openid-configuration

As I've mentioned in the github issue tracker i think a server discovery
medatata will be needed so that the RP can know upfront which DSAs are
supported on the OP side to validate DPoP Proof JWTs with

Best,
*Filip Skokan*

On Mon, 8 Jul 2019 at 15:30, Daniel Fett <[email-masked]> wrote:

> As you might have noticed, there is also a new version of the Security
> Best Current Practice draft:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Filip Skokan <[email-masked]>
Date: Fri, 12 Jul 2019 16:51:10 +0200

Hello Daniel, everyone,

I don't know if this belongs to the DPoP document itself or each respective
BCP (especially Browser-Based Apps), but one of the documents should give
recommendation to implementers on how to

   1. generate the unique private keys per installation / browser session
   2. platform specific storage for them (e.g. in between browser
   navigation / app launches)

I come asking for this guidance especially for the Browser-Based App use
case. I think the clear recommendation is to use the Web Cryptography API
<https://www.w3.org/TR/WebCryptoAPI/#SubtleCrypto-method-generateKey> (with
extractable: false) for (1) and IndexedDB API
<https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API> for (2),
but the more important question is how to deal with lack of those APIs in
browsers that are known to not support them or be buggy (see data in
https://caniuse.com), so

   - is it ok to use other means of generating the key when webcrypto is
   not available?
   - is it ok to generate keys through webcrypto (or other means) that are
   extractable and store them via other means than IndexedDB when indexed DB
   is not available, such as cookie or localstorage.

Best,
*Filip*