Subject: [OAUTH-WG] implementations of draft-ietf-oauth-proof-of-possession

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 13 Dec 2015 22:13:35 -0500

Hi,

Are there any implementations of  draft-ietf-oauth-proof-of-possession?

Thanks!

-- 

Best regards,
Kathleen

---

From: Mike Jones <[email-masked]>
Date: Mon, 14 Dec 2015 03:40:17 +0000

Yes.  Xbox One and its partners have been using this since its launch.  The following token claims are from a production trace captured in early 2013:

  {
   "iss":"xas.xboxlive.com",
   "aud":"http://auth.xboxlive.com",
   "exp":"1361398824",
   "nbf":"1360189224",
   "cnf":{
     "jwk":{
       "kty":"EC",
       "use":"sig",
       "crv":"P-256",
       "x":"18wHLeIgW9wVN6VD1Txgpqy2LszYkMf6J8njVAibvhM",
       "y":"-V4dS4UaLMgP_4fY4j8ir7cl1TXlFdAgcx55o7TkcSA"
      }
    }
  }

				-- Mike

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
Sent: Sunday, December 13, 2015 7:14 PM
To: [email-masked]
Subject: [OAUTH-WG] implementations of draft-ietf-oauth-proof-of-possession

Hi,

Thanks!

-- 

Best regards,
Kathleen

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 13 Dec 2015 22:59:13 -0500

Thanks, Mike!

-- 

Best regards,
Kathleen

---

From: "Manger, James" <[email-masked]>
Date: Mon, 14 Dec 2015 15:03:44 +1100

That value uses strings for expiry and not-before dates so it is not a valid JWT; these dates need to be numbers.

3 of the examples in draft-ietf-oauth-proof-of-possession are similarly invalid ("exp" and "iat"); 1 example gets it right.

--

James Manger

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Monday, 14 December 2015 2:40 PM
To: Kathleen Moriarty <[email-masked]>; [email-masked]
Subject: Re: [OAUTH-WG] implementations of draft-ietf-oauth-proof-of-possession

  {

   "exp":"1361398824",

   "nbf":"1360189224",

   "cnf":{

     "jwk":{

       "kty":"EC",

       "use":"sig",

       "crv":"P-256",

      }

    }

  }

                                                                -- Mike

-----Original Message-----

To: [email-masked]<mailto:[email-masked]>

Hi,

Thanks!

--

Best regards,

Kathleen

OAuth mailing list

[email-masked]<mailto:[email-masked]>

OAuth mailing list

[email-masked]<mailto:[email-masked]>

---

From: Mike Jones <[email-masked]>
Date: Mon, 14 Dec 2015 04:07:58 +0000

Good eye, James!  Thanks for catching this.  I'll fix it right away.

It turns out that examples are based on the trace captured in February 2013 - well before the Xbox One launch in November 2013.  I'd actually noticed this then and had Xbox correct their code.  But silly me, I failed to uniformly correct it in the draft.

                                                          Thanks again!
                                                          -- Mike

From: Manger, James [mailto:[email-masked]]
Sent: Sunday, December 13, 2015 8:04 PM
To: Mike Jones <[email-masked]>; Kathleen Moriarty <[email-masked]>; [email-masked]
Subject: RE: [OAUTH-WG] implementations of draft-ietf-oauth-proof-of-possession

--

James Manger

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Monday, 14 December 2015 2:40 PM
To: Kathleen Moriarty <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Re: [OAUTH-WG] implementations of draft-ietf-oauth-proof-of-possession

  {

   "exp":"1361398824",

   "nbf":"1360189224",

   "cnf":{

     "jwk":{

       "kty":"EC",

       "use":"sig",

       "crv":"P-256",

      }

    }

  }

                                                                -- Mike

-----Original Message-----

Hi,

Thanks!

--

Best regards,

Kathleen

OAuth mailing list

OAuth mailing list

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 13 Dec 2015 23:09:18 -0500

I just added the ballot for these drafts, can this be fixed quickly?

Thanks.
Kathleen

On Sun, Dec 13, 2015 at 11:07 PM, Mike Jones
<[email-masked]> wrote:
> Good eye, James!  Thanks for catching this.  I’ll fix it right away.
>
>
>
> It turns out that examples are based on the trace captured in February 2013
> – well before the Xbox One launch in November 2013.  I’d actually noticed
> this then and had Xbox correct their code.  But silly me, I failed to
> uniformly correct it in the draft.
>
>
>
>                                                           Thanks again!
>
>                                                           -- Mike
>
>
>
> To: Mike Jones <[email-masked]>; Kathleen Moriarty
> <[email-masked]>; [email-masked]
> 3 of the examples in draft-ietf-oauth-proof-of-possession are similarly
> invalid (“exp” and “iat”); 1 example gets it right.
>
>
>
> --
>
> James Manger
>
>
>
> Yes.  Xbox One and its partners have been using this since its launch.  The
> following token claims are from a production trace captured in early 2013:
>
>
>
>   {
>

-- 

Best regards,
Kathleen

---

From: Mike Jones <[email-masked]>
Date: Mon, 14 Dec 2015 04:10:43 +0000

Right away.  The only change will be to remove some double-quotes around numbers.

-----Original Message-----
From: Kathleen Moriarty [mailto:[email-masked]] 
Sent: Sunday, December 13, 2015 8:09 PM
To: Mike Jones <[email-masked]>
Cc: Manger, James <[email-masked]>; [email-masked]
Subject: Re: [OAUTH-WG] implementations of draft-ietf-oauth-proof-of-possession

Thanks.
Kathleen

On Sun, Dec 13, 2015 at 11:07 PM, Mike Jones <[email-masked]> wrote:
> It turns out that examples are based on the trace captured in February 
> 2013 – well before the Xbox One launch in November 2013.  I’d actually 
> noticed this then and had Xbox correct their code.  But silly me, I 
> failed to uniformly correct it in the draft.
>
>
>
>                                                           Thanks again!
>
>                                                           -- Mike
>
>
>
> That value uses strings for expiry and not-before dates so it is not a 
> valid JWT; these dates need to be numbers.
>
>
>
> 3 of the examples in draft-ietf-oauth-proof-of-possession are 
> similarly invalid (“exp” and “iat”); 1 example gets it right.
>
>
>
> --
>
> James Manger
>
>
>
> Yes.  Xbox One and its partners have been using this since its launch.  
> The following token claims are from a production trace captured in early 2013:
>
>
>
>   {
>
> Mike

-- 

Best regards,
Kathleen

---

From: Mike Jones <[email-masked]>
Date: Mon, 14 Dec 2015 04:33:04 +0000

Done in -09.

-----Original Message-----
From: Kathleen Moriarty [mailto:[email-masked]] 
Sent: Sunday, December 13, 2015 8:09 PM
To: Mike Jones <[email-masked]>
Cc: Manger, James <[email-masked]>; [email-masked]
Subject: Re: [OAUTH-WG] implementations of draft-ietf-oauth-proof-of-possession

Thanks.
Kathleen

-- 

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 14 Dec 2015 00:16:18 -0500

Thank you!

Sent from my iPhone

> On Dec 13, 2015, at 11:33 PM, Mike Jones <[email-masked]> wrote:
> 
> Done in -09.
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 17 Dec 2015 17:12:04 +0100

Samuel and I had been working on a prototype implementation of the PoP
tokens for an IoT scenario, which we showed at ARM TechCon. It used the
JWT (instead of the CBOR-encoded version of the JWT since we had JOSE
code available).

Our version used symmetric key cryptography.

Roland Hedberg also mentioned to me that one person from his group
implemented the PoP token functionality and also the functionality
outlined in draft-ietf-oauth-proof-of-possession.

Ciao
Hannes