Subject: [OAUTH-WG] ID, MAC and SIG HTTP schemes - starting point for "use a token"

From: "Manger, James H" <[email-masked]>
Date: Wed, 17 Feb 2010 00:38:04 +1000

Attached is my suggested starting point for the “how to use a token” part of OAuth.

It defines 3 schemes:

Authorization: ID a=”…”    (or in URI or POST)

* quite like WRAP, but with shorter labels, a smidgen of “discovery”, and no explicit tie to OAuth delegation

Authorization: MAC m=”hmac-sha-256” u=”user-id” a=”authz-info” … s=”hgasdag76sa7as”

* a MAC over selected parts of an HTTP request, with a bit of negotiation, and no explicit tie to OAuth delegation

Authorization: SIG m=”rsa…” … s=”hgasjGHfHGFhgFHGfHGFGFghfHdag76sa7as”

* a digital signature over selected parts of an HTTP request, like MAC but with public-key crypto

P.S. It is formatted as an (incomplete) internet-draft since that is what it needs to head to, but it has not be submitted to the IETF draft system.

--

James Manger

> ----------

> From: Eran Hammer-Lahav

> Sent: Friday, 5 February 2010 6:29 PM

> To: OAuth WG ([email-masked])

> Subject: [OAUTH-WG] Which draft to use as a starting point for 'using a token'?

> …

> We have three options for moving forward with 'how to use a token'.

> Start with:

> 1. draft-ietf-oauth-authentication

> 2. draft-hammer-http-token-auth

> 3. something else*

> …

> Pick.

---

From: Brian Eaton <[email-masked]>
Date: Wed, 17 Feb 2010 07:08:59 -0800

> Attached is my suggested starting point for the “how to use a token” part of

Hey James -

Before I read the draft, can you comment on your use cases for the
HMAC and RSA schemes?

Cheers,
Brian

---

From: "Manger, James H" <[email-masked]>
Date: Thu, 18 Feb 2010 16:09:49 +1100

> Before I read the draft, can you comment on your use cases for the

I don’t have a current desire to use the HMAC or RSA schemes.
I do have a strong desire NOT to define an OAuth-specific way to sign HTTP requests, that isn't applicable to any app that wants to authenticate "important" parts of a HTTP request with a key, or doesn't follow the existing model for HTTP authentication (including interop given just a user-id and key).

My "use case" for HMAC and RSA schemes is that OAuth 1 (specs and implementations), plus Eran’s drafts, use it.

I would be happy to see HMAC and RSA schemes dropped from future OAuth specs completely (a la WRAP, but web-style).

-- 
James Manger