Subject: Re: [OAUTH-WG] proposal for factoring out request signing in OAuth 2

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 8 Jun 2010 23:17:24 -0700

We are clearly not making any progress on signatures (for over a year).

1. I agree with Brian (it does happen on occasion) that this is an impossible list to turn into a single solution.
2. I'm tired of having this discussion - mostly because we are unable to agree on the requirements.
3. We already decided not to mandate TLS for bearer tokens, just make it a strong suggestion.

I consider this my decision as editor (but feel free to disagree with the decision or the powers I granted myself):

1. I am going to move all the signature stuff out of the core spec.
2. I am going to draft a new (individual submission) signature proposal using the current signature parameters and method.
3. I expect Brian, Dirk, and others to submit their own separate signature proposals as individual submissions.
4. The WG can decide if any of the proposals qualify for "upgrade" to WG items and the chairs can decide who will edit these if they become WG items. The WG can also decide if any of those accepted as WG items should stay in separate specs or merged into the core spec.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Brian Eaton
> Sent: Sunday, May 30, 2010 2:42 PM
> To: Torsten Lodderstedt
> Cc: OAuth WG
> Subject: Re: [OAUTH-WG] proposal for factoring out request signing in OAuth
> 2
> 
> On Sun, May 30, 2010 at 11:55 AM, Torsten Lodderstedt
> <[email-masked]> wrote:
> > Regarding client secrets: One of the major obstacles when using OAuth
> > 1.0 in large deployments is the need for sharing client secrets
> > between authz server and resource server. Overcoming that obstacle was
> > an important requirement for OAuth2 from the beginning, expressed by a
> lot of people.
> 
> There are actually a bunch of fundamentally conflicting requirements for
> signatures from the various folks contributing to this working group.
> 
> - no shared secrets with protected resources at all
> 
> - no permanent shared secrets with protected resources
> 
> - no shared secrets with clients
> 
> - allow access tokens to be used by multiple clients without sharing consumer
> secrets
> 
> - don't allow access tokens to be shared by multiple clients
> 
> - don't use public key, because it's slow
> 
> - use public key, because it makes key distribution easier
> 
> - don't use cryptography at all, because it's too complicated
> 
> - don't use bearer tokens at all, because they might leak
> 
> - keep access tokens short
> 
> - encode lots of information in the access token
> 
> I'm sure I'm forgetting some.
> 
> For the record, I think *every single one* of those requirements makes
> sense in certain contexts.
> 
> I'm pretty sure we're going to be able to agree on the cryptographic
> primitives without too much trouble.
> 
> But we're going to have to split out profiles to deal with the different key
> distribution challenges.
> 
> Cheers,
> Brian
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: "William Mills" <[email-masked]>
Date: Wed, 9 Jun 2010 16:10:16 -0700

I thought perhaps the most game changing suggestion on signatures was
saying "the client has to know what it's sending to sign".  Much of the
complexity of the 1.0 signatures was agreeing on what was signed. Was
there strong objection to making this simplifying assumption?

I think signatures have value.   

> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Eran Hammer-Lahav
> Sent: Tuesday, June 08, 2010 11:17 PM
> To: Brian Eaton
> Cc: OAuth WG
> Subject: Re: [OAUTH-WG] proposal for factoring out request 
> signing in OAuth 2
> 
> 1. I agree with Brian (it does happen on occasion) that this 
> is an impossible list to turn into a single solution.
> I consider this my decision as editor (but feel free to 
> disagree with the decision or the powers I granted myself):
> 
> 2. I am going to draft a new (individual submission) 
> signature proposal using the current signature parameters and method.
> 3. I expect Brian, Dirk, and others to submit their own 
> separate signature proposals as individual submissions.
> 4. The WG can decide if any of the proposals qualify for 
> "upgrade" to WG items and the chairs can decide who will edit 
> these if they become WG items. The WG can also decide if any 
> of those accepted as WG items should stay in separate specs 
> or merged into the core spec.
> 
> EHL
> 
> > From: [email-masked] 
> [mailto:[email-masked]] On Behalf 
> > Of Brian Eaton
> > Subject: Re: [OAUTH-WG] proposal for factoring out request 
> signing in 
> > OAuth
> > 2
> > 
> > > Regarding client secrets: One of the major obstacles when using 
> > > OAuth 1.0 in large deployments is the need for sharing client 
> > > secrets between authz server and resource server. Overcoming that 
> > > obstacle was an important requirement for OAuth2 from the 
> beginning, 
> > > expressed by a
> > lot of people.
> > 
> > There are actually a bunch of fundamentally conflicting 
> requirements 
> > for signatures from the various folks contributing to this 
> working group.
> > 
> > - allow access tokens to be used by multiple clients 
> without sharing 
> > consumer secrets
> > 
> > But we're going to have to split out profiles to deal with the 
> > different key distribution challenges.
> > 
> > Cheers,
> > Brian