Subject: [OAUTH-WG] Client credentials w/ or w/o secret

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 10 Jun 2010 12:42:54 -0700

Some of the flows require/allow a client secret while others disallow it (when the client has no secure means to keep it secret). My question is, do you plan to issue different credentials for different flows (with or without secret) or allow the same set to be used, sometimes with and sometimes without a secret based on the flow?

EHL

---

From: Thomas Hardjono <[email-masked]>
Date: Thu, 10 Jun 2010 16:33:49 -0400

If you want to introduce the notion
of non-repudiation (meaning that the client
cannot deny issuing an access request to the resource
server), then you need to get the client
to exercise its secret (eg. by using it
in some crypto computation).

When a flow does not include the exercise/usage
of the client secret, then you do not get non-repudiation.
I think this aspects needs to be made clear
in the spec. Which may bring-up the question
as to some flows being safer than others.

/thomas/
__________________________________________

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Eran Hammer-Lahav
> Sent: Thursday, June 10, 2010 3:43 PM
> To: OAuth WG ([email-masked])
> Subject: [OAUTH-WG] Client credentials w/ or w/o secret
> 
> Some of the flows require/allow a client secret while others disallow it
> (when the client has no secure means to keep it secret). My question is,
do
> you plan to issue different credentials for different flows (with or
without
> secret) or allow the same set to be used, sometimes with and sometimes
> without a secret based on the flow?
> 
> EHL
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: David Recordon <[email-masked]>
Date: Thu, 10 Jun 2010 13:51:04 -0700

We've talked about issuing different client secrets for use with
different flows. We haven't actually implemented it yet and prefer
using something like TPM on devices which support it. A different
secret is at least better than nothing for apps which can't reliably
keep secrets and don't have something like a TPM.

--David