Subject: [OAUTH-WG] Call for adoption: Token Binding for OAuth 2.0

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 3 Aug 2016 09:45:59 +0200

Hi all,

this is the call for adoption of the 'OAuth 2.0 Token Binding' document
bundle* following the positive call for adoption at the recent IETF
meeting in Berlin.

Here are the links to the documents presented at the last IETF meeting:
https://tools.ietf.org/html/draft-jones-oauth-token-binding-00
https://tools.ietf.org/html/draft-campbell-oauth-tbpkce-00

Please let us know by August 17th whether you accept / object to the
adoption of this document as a starting point for work in the OAuth
working group.

Ciao
Hannes & Derek

*: We will find out what the best document structure is later, i.e.,
whether the content should be included in one, two or multiple documents.

---

From: John Bradley <[email-masked]>
Date: Wed, 3 Aug 2016 16:48:04 -0400

I accept these documents as a starting point of the Token binding work in OAuth.

John B.
> On Aug 3, 2016, at 3:45 AM, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi all,
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Mike Jones <[email-masked]>
Date: Wed, 3 Aug 2016 21:11:18 +0000

I agree with the adoption of these documents as the starting point for OAuth Token Binding work.

				-- Mike

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of John Bradley
Sent: Wednesday, August 3, 2016 1:48 PM
To: Hannes Tschofenig <[email-masked]>
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Call for adoption: Token Binding for OAuth 2.0

John B.

---

From: Vladimir Dzhuvinov <[email-masked]>
Date: Thu, 4 Aug 2016 13:18:25 +0300

I agree to have these specs accepted.

-- 
Vladimir Dzhuvinov

---

From: Brian Campbell <[email-masked]>
Date: Thu, 4 Aug 2016 10:10:49 -0600

I accept these documents as a starting point of the Token binding work in
OAuth.

With emphases on "starting point" because even the initial discussions
about the work in Berlin uncovered changes that'll be necessary or
desirable.

On Wed, Aug 3, 2016 at 1:45 AM, Hannes Tschofenig <[email-masked]
> wrote:

---

From: George Fletcher <[email-masked]>
Date: Thu, 4 Aug 2016 13:17:08 -0400

George

---

From: Brian Campbell <[email-masked]>
Date: Tue, 16 Aug 2016 12:44:58 -0600

Just a friendly reminder that the 'deadline' for this call for adoption is
tomorrow.

According to the minutes from Berlin
<https://www.ietf.org/proceedings/96/minutes/minutes-96-oauth>, 13 people
were in favor of adopting OAuth 2.0 Token Binding and 0 were against.

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 16 Aug 2016 21:26:35 +0000

I’m OK with the https://tools.ietf.org/html/draft-jones-oauth-token-binding-00<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-oauth-token-binding-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=xvSOCX9FFLdJWikbxzxKgjEWjU%2frqZs1mmsvNsFHWZw%3d> but not sure that https://tools.ietf.org/html/draft-campbell-oauth-tbpkce-00<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-campbell-oauth-tbpkce-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gDQIAohk3uNIMgRl5dNgofQr832IWlboumgfycnPmYg%3d> is a good starting point as we would want a more generic solution for PoP tokens in general

From: OAuth [mailto:[email-masked]] On Behalf Of Brian Campbell
Sent: Tuesday, August 16, 2016 11:45 AM
To: Hannes Tschofenig <[email-masked]>
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Call for adoption: Token Binding for OAuth 2.0

Just a friendly reminder that the 'deadline' for this call for adoption is tomorrow.

According to the minutes from Berlin<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fproceedings%2f96%2fminutes%2fminutes-96-oauth&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=5UfCdNKt2iVuFfdiSELqGto9yFSuzjRvdk9rBlGyMz8%3d>, 13 people were in favor of adopting OAuth 2.0 Token Binding and 0 were against.

On Wed, Aug 3, 2016 at 1:45 AM, Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:
Hi all,

Here are the links to the documents presented at the last IETF meeting:
https://tools.ietf.org/html/draft-jones-oauth-token-binding-00<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-oauth-token-binding-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=xvSOCX9FFLdJWikbxzxKgjEWjU%2frqZs1mmsvNsFHWZw%3d>
https://tools.ietf.org/html/draft-campbell-oauth-tbpkce-00<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-campbell-oauth-tbpkce-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gDQIAohk3uNIMgRl5dNgofQr832IWlboumgfycnPmYg%3d>

Ciao
Hannes & Derek

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=E9HUI5JUL%2fYw%2fvnEWGBwEu28r%2fNdF53rdoLP5%2fU46uU%3d>

---

From: Dirk Balfanz <[email-masked]>
Date: Wed, 17 Aug 2016 07:39:58 +0000

> I accept these documents as a starting point of the Token binding work in

Same here. I accept adoption as a starting point.

Dirk.

---

From: Torsten Lodderstedt <[email-masked]>
Date: Wed, 17 Aug 2016 10:38:05 +0200

+1

Am 17.08.2016 09:39, schrieb Dirk Balfanz:
>
>
> On Wed, Aug 3, 2016 at 1:48 PM John Bradley <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     > On Aug 3, 2016, at 3:45 AM, Hannes Tschofenig
>     <[email-masked] <mailto:[email-masked]>> wrote:
>     >
>     > Hi all,
>     >
>     > [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>

---

From: Brian Campbell <[email-masked]>
Date: Mon, 22 Aug 2016 15:02:00 -0600

I agree with Tony, if I understand what he's saying.
https://tools.ietf.org/html/draft-campbell-oauth-tbpkce-00
<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-campbell-oauth-tbpkce-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gDQIAohk3uNIMgRl5dNgofQr832IWlboumgfycnPmYg%3d>
was largely a straw-man to get the conversation started. But after talking
with people in Berlin, reviewing Dirk's document, and thinking about it
some more - it's not clear that PKCE is a great fit for token binding the
authorization code.

Token binding the authorization code is, I think, something we want to
account for.  But using/extending PKCE might not be the way to go about it.
And whatever approach we land on should probably be just one part of the
larger document on OAuth 2.0 Token Binding.

On Tue, Aug 16, 2016 at 3:26 PM, Anthony Nadalin <[email-masked]>
wrote:

> I’m OK with the https://tools.ietf.org/html/draft-jones-oauth-token-
> binding-00
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-oauth-token-binding-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=xvSOCX9FFLdJWikbxzxKgjEWjU%2frqZs1mmsvNsFHWZw%3d>
> but not sure that https://tools.ietf.org/html/
> draft-campbell-oauth-tbpkce-00
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-campbell-oauth-tbpkce-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gDQIAohk3uNIMgRl5dNgofQr832IWlboumgfycnPmYg%3d>
> is a good starting point as we would want a more generic solution for PoP
> tokens in general
>
>
>
> *From:* OAuth [mailto:[email-masked]] *On Behalf Of *Brian
> Campbell
> *Sent:* Tuesday, August 16, 2016 11:45 AM
> *To:* Hannes Tschofenig <[email-masked]>
> *Cc:* [email-masked]
> *Subject:* Re: [OAUTH-WG] Call for adoption: Token Binding for OAuth 2.0
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fproceedings%2f96%2fminutes%2fminutes-96-oauth&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=5UfCdNKt2iVuFfdiSELqGto9yFSuzjRvdk9rBlGyMz8%3d>,
> 13 people were in favor of adopting OAuth 2.0 Token Binding and 0 were
> against.
>
>
>
> On Wed, Aug 3, 2016 at 1:45 AM, Hannes Tschofenig <
> [email-masked]> wrote:
>
> Hi all,
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-oauth-token-binding-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=xvSOCX9FFLdJWikbxzxKgjEWjU%2frqZs1mmsvNsFHWZw%3d>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-campbell-oauth-tbpkce-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gDQIAohk3uNIMgRl5dNgofQr832IWlboumgfycnPmYg%3d>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=E9HUI5JUL%2fYw%2fvnEWGBwEu28r%2fNdF53rdoLP5%2fU46uU%3d>
>
>
>

---

From: Torsten Lodderstedt <[email-masked]>
Date: Tue, 23 Aug 2016 16:36:02 +0200

+1

I would also propose to focus use of token binding to detect replay of 
tokens (access, refresh, code)

Am 22.08.2016 um 23:02 schrieb Brian Campbell:
> was largely a straw-man to get the conversation started. But after 
> talking with people in Berlin, reviewing Dirk's document, and thinking 
> about it some more - it's not clear that PKCE is a great fit for token 
> binding the authorization code.
>
> account for.  But using/extending PKCE might not be the way to go 
> about it. And whatever approach we land on should probably be just one 
> part of the larger document on OAuth 2.0 Token Binding.
>
> On Tue, Aug 16, 2016 at 3:26 PM, Anthony Nadalin 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>     I’m OK with the
>     but not sure that
>     is a good starting point as we would want a more generic solution
>     for PoP tokens in general
>
>     *From:*OAuth [mailto:[email-masked]
>     <mailto:[email-masked]>] *On Behalf Of *Brian Campbell
>     *To:* Hannes Tschofenig <[email-masked]
>     <mailto:[email-masked]>>
>     *Cc:* [email-masked] <mailto:[email-masked]>
>     13 people were in favor of adopting OAuth 2.0 Token Binding and 0
>     were against.
>
>     On Wed, Aug 3, 2016 at 1:45 AM, Hannes Tschofenig

---

From: William Denniss <[email-masked]>
Date: Tue, 23 Aug 2016 19:54:05 +0000

+1 to adopt.

I would like us to develop a unified approach and merge the current drafts.

On Tue, Aug 23, 2016 at 7:58 AM Torsten Lodderstedt <[email-masked]>
wrote:

> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: John Bradley <[email-masked]>
Date: Tue, 23 Aug 2016 17:22:33 -0300

Yes I think merging the drafts and not reusing PKCE is the correct path.

Protection for code in the browser redirect also needs to be added to fully protect the whole flow.

John B.
> On Aug 23, 2016, at 4:54 PM, William Denniss <[email-masked]> wrote:
> 
> +1 to adopt. 
> 
> On Tue, Aug 23, 2016 at 7:58 AM Torsten Lodderstedt <[email-masked] <mailto:[email-masked]>> wrote:
> +1 
> 
> I would also propose to focus use of token binding to detect replay of tokens (access, refresh, code)
> 
> 
>> I agree with Tony, if I understand what he's saying. https://tools.ietf.org/html/draft-campbell-oauth-tbpkce-00 <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-campbell-oauth-tbpkce-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gDQIAohk3uNIMgRl5dNgofQr832IWlboumgfycnPmYg%3d> was largely a straw-man to get the conversation started. But after talking with people in Berlin, reviewing Dirk's document, and thinking about it some more - it's not clear that PKCE is a great fit for token binding the authorization code. 
>> 
>> Token binding the authorization code is, I think, something we want to account for.  But using/extending PKCE might not be the way to go about it. And whatever approach we land on should probably be just one part of the larger document on OAuth 2.0 Token Binding. 
>> 
>> On Tue, Aug 16, 2016 at 3:26 PM, Anthony Nadalin <[email-masked] <mailto:[email-masked]>> wrote:
>> I’m OK with the https://tools.ietf.org/html/draft-jones-oauth-token-binding-00 <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-oauth-token-binding-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=xvSOCX9FFLdJWikbxzxKgjEWjU%2frqZs1mmsvNsFHWZw%3d> but not sure that https://tools.ietf.org/html/draft-campbell-oauth-tbpkce-00 <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-campbell-oauth-tbpkce-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gDQIAohk3uNIMgRl5dNgofQr832IWlboumgfycnPmYg%3d> is a good starting point as we would want a more generic solution for PoP tokens in general
>> 
>> 
>>   <>
>> From: OAuth [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Brian Campbell
>> To: Hannes Tschofenig < <mailto:[email-masked]>[email-masked] <mailto:[email-masked]>>
>> Cc: [email-masked] <mailto:[email-masked]>
>> According to the minutes from Berlin <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fproceedings%2f96%2fminutes%2fminutes-96-oauth&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=5UfCdNKt2iVuFfdiSELqGto9yFSuzjRvdk9rBlGyMz8%3d>, 13 people were in favor of adopting OAuth 2.0 Token Binding and 0 were against.
>> 
>>  
>> On Wed, Aug 3, 2016 at 1:45 AM, Hannes Tschofenig < <mailto:[email-masked]>[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi all,
>> 
>> https://tools.ietf.org/html/draft-jones-oauth-token-binding-00 <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-oauth-token-binding-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=xvSOCX9FFLdJWikbxzxKgjEWjU%2frqZs1mmsvNsFHWZw%3d>
>> https://tools.ietf.org/html/draft-campbell-oauth-tbpkce-00 <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-campbell-oauth-tbpkce-00&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gDQIAohk3uNIMgRl5dNgofQr832IWlboumgfycnPmYg%3d>
>> 
>> https://www.ietf.org/mailman/listinfo/oauth <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7ctonynad%40microsoft.com%7caaa85f447951456bf73c08d3c60582aa%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=E9HUI5JUL%2fYw%2fvnEWGBwEu28r%2fNdF53rdoLP5%2fU46uU%3d>
>>  
>> 
>> 
>> 
>> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
> 
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>

---

From: John Bradley <[email-masked]>
Date: Tue, 23 Aug 2016 18:01:38 -0300

Protection for code in the browser redirect also needs to be added to fully
protect the w

+1 to adopt.

On Tue, Aug 23, 2016 at 7:58 AM Torsten Lodderstedt <[email-masked]>
wrote:

>> *To:* Hannes Tschofenig < <[email-masked]>
>> [email-masked]>
>> *Cc:* [email-masked]
>> <[email-masked]>[email-masked]> wrote:
>>
>> Hi all,
>>