Subject: [kitten] Bearer vs. non-bearer (Re: OAUTH SASL and Channel binding)

From: Nico Williams <[email-masked]>
Date: Thu, 16 Aug 2012 11:20:35 -0500

FWIW, I seethe appeal of bearer tokens.  If you trust the TLS server
PKI then bearer tokens can be implemented with no changes to the
HTTP/TLS stack and *no additional crypto* on the client side.  Heck,
it's even possible to implement bearer token schemes with no
additional crypto anywhere.  This sounds too wonderful too be true,
but it is true, no?

But once you're stuck with a bearer token you're also stuck with
either trusting the TLS server PKI fully, or making changes to the
HTTP/TLS stack.  That seems like an awful bind to me.

So, in principle bearer and signature tokens can both offer reasonable
security (if one adheres to their respective security considerations).
 In practice there are differences, which I hope I captured succinctly
enough above.

I believe the downside of bearer tokens overwhelm the upside -- a
proposition that no doubt requires more discussion.

Nico
--

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 17 Aug 2012 14:08:04 +0300

The problem with not trusting the PKI is that you will run into lots of other problems as well. While I acknowledge that the PKI world is far from being perfect the alternatives also have their issues. 

The DANE work (in combination with a TLS extension for raw public keys) also provides an alternative to the Web-based PKI and it is even compatible with the Bearer Token approach. 

ABFAB, for example, standardizes an alternative model to the Web PKI world. It yet has to seen the deployment in the application world (and even better in the Web world) but theoretically it would work great. 

In a nutshell, OAuth relies on a PKI (at least for the client to authorization server interaction) and I doubt that we will ever get an agreement whether security at the lower layers (as offered by TLS) or at the higher layers (as an application layer security solution, such as the MAC tokens or a JSON based approach) is better. 

On Aug 16, 2012, at 7:20 PM, Nico Williams wrote:

> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten