Subject: [OAUTH-WG] OAuth services/libraries wanted for security evaluation...

From: Pieter Philippaerts <[email-masked]>
Date: Mon, 22 Jun 2020 13:51:04 +0000

Hello everyone,

As part of a research project, I've created a test suite to test OAuth 2.0 implementations and measure how well they implement the various MAY/SHOULD/MUST security recommendations in the OAuth standards. (It also includes test cases for the OIDC and FAPI RO/RW recommendations.) The tool is practically finished and will be made available to the public in a few months.

I'm currently working on a security analysis of the OAuth2 ecosystem (i.e. I'm using the tool to test various OAuth/OIDC implementations) and I'm still looking for more candidates to test. If you are the author of an OAuth library or if you are running an OAuth service, feel free to contact me to get involved. Apart from my gratitude, I can offer you a free security audit of your product :-)

Regards,
Pieter

---

From: Garret Fick <[email-masked]>
Date: Mon, 22 Jun 2020 14:52:05 +0000

Hi Pieter,

I am responsible for a very large private OAuth2 and OIDC implementation. I would be highly interested in learning more about your tool if it is available as code.

Garret
________________________________
From: OAuth <[email-masked]> on behalf of Pieter Philippaerts <[email-masked]>
Sent: Monday, June 22, 2020 9:51:04 AM
To: [email-masked] <[email-masked]>
Subject: [OAUTH-WG] OAuth services/libraries wanted for security evaluation...

Hello everyone,

Regards,
Pieter

---

From: Pieter Philippaerts <[email-masked]>
Date: Mon, 22 Jun 2020 15:01:24 +0000

Hello Aaron,

> * Whether an AS token endpoint rejects a request that contains a PKCE code_verifier

> if the authorization code was issued with no code_challenge present

This is indeed one of the test cases. Out of the small set of 15 sites I have currently tested (major providers - think Google, Microsoft, Facebook, ...), the results are the following:
 - 7 sites do not implement PKCE (they ignore the parameters altogether)

 - 3 sites have PKCE support but do not detect the downgrade

 - 3 sites have PKCE support and detect the downgrade

 - 2 sites do not use the authorization code grant

> * Whether an OIDC client uses PKCE

> * Whether an OIDC client that does not use PKCE properly checks the nonce value (for all response types)

I should have been more specific in my first email: the test suite tests server implementations, not client implementations. The framework is basically a (malicious) client. I've thought about testing clients, but it seems much harder. A number of the client security guidelines are difficult to test (e.g. "the client secret should be stored securely"), and the testing procedure will likely not support a high degree of automation. But it is something I'm interested in investigating further in a follow-up project.

?

Regards,

Pieter

________________________________
From: Aaron Parecki <[email-masked]>
Sent: Monday, June 22, 2020 16:03
To: Pieter Philippaerts
Subject: Re: [OAUTH-WG] OAuth services/libraries wanted for security evaluation...

Hi Pieter,

This sounds like a great project!

Can you make sure to test these things, I would be very curious to see the result and it will help inform some of the future work in the Security BCP and OAuth 2.1.

* Whether an AS token endpoint rejects a request that contains a PKCE code_verifier if the authorization code was issued with no code_challenge present
* Whether an OIDC client uses PKCE
* Whether an OIDC client that does not use PKCE properly checks the nonce value (for all response types)

Thank you!

---
Aaron Parecki
https://aaronparecki.com

On Mon, Jun 22, 2020 at 6:51 AM Pieter Philippaerts <[email-masked]<mailto:[email-masked]>> wrote:
Hello everyone,

Regards,
Pieter

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Filip Skokan <[email-masked]>
Date: Mon, 22 Jun 2020 17:24:46 +0200

Hello Pieter, 

I’m interested for my open source project. 

Filip

Odesláno z iPhonu

> 22. 6. 2020 v 15:51, Pieter Philippaerts <[email-masked]>:
> 
> 
> Hello everyone,
> 
> [email-masked]

---

From: Thibault Normand <[email-masked]>
Date: Thu, 25 Jun 2020 11:27:01 +0200

Hello Pieter,

I'm also interested (https://github.com/zntrio/solid), my OIDC framework is
not focused on building a compliant OIDC server but produce a restricted
and harmonized feature set according to your authentication use cases
(human, act as human, software, machine, iot). It mostly like libsodium is
(a high-level api) for low-level encryption operations (CHACHA20/Poly130).

The project is quite new and focused on authorization server building
blocks without the wire protocol constraints.
I tried to design flow without the wire protocol constraints in order to
make the building blocks useable in different context (standard / HTTP, or
IoT / CoAP).

Regards,

Le lun. 22 juin 2020 à 17:25, Filip Skokan <[email-masked]> a écrit :

> 22. 6. 2020 v 15:51, Pieter Philippaerts <[email-masked]
> >:
>
> 
> Hello everyone,
>
> As part of a research project, I've created a test suite to test OAuth 2.0
> implementations and measure how well they implement the various
> MAY/SHOULD/MUST security recommendations in the OAuth standards. (It also
> includes test cases for the OIDC and FAPI RO/RW recommendations.) The tool
> is practically finished and will be made available to the public in a few
> months.
>
> I'm currently working on a security analysis of the OAuth2 ecosystem
> (i..e. I'm using the tool to test various OAuth/OIDC implementations) and
> I'm still looking for more candidates to test. If you are the author of an
> OAuth library or if you are running an OAuth service, feel free to contact
> me to get involved. Apart from my gratitude, I can offer you a free
> security audit of your product :-)
>
> Regards,
> Pieter
>
>

-- 
Thibault Normand
"Il existe moins bien mais c'est plus cher !"
http://www.zenithar.org

---

From: Dominick Baier <[email-masked]>
Date: Thu, 25 Jun 2020 03:28:05 -0700

Hey,

Have a look at https://github.com/IdentityServer/IdentityServer4

<https://github.com/IdentityServer/IdentityServer4>
I <https://github.com/IdentityServer/IdentityServer4>t’s an OIDC certified
.NET implementation

Thanks!
———
Dominick Baier

On 25. June 2020 at 11:27:34, Thibault Normand ([email-masked])
wrote:

Hello Pieter,

Regards,