Subject: [OAUTH-WG] Proposal: OAuth 1.0 signature in core with revision

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 26 Sep 2010 23:44:29 -0700

Building on John Panzer's proposal, I would like to ask if people have strong objections to the following:

- Add the 1.0a RFC language for HMAC-SHA-1 signatures to the core specification in -11
- Discuss the signature language on the list and improve both prose and signature base string construction
- Apply improvements to -12

Keeping the 1.0a signature in the core specification makes sense and builds on existing experience and deployment. If we can reach quick consensus on some improvements, great. If not, we satisfy the need of many here to offer a simple alternative to bearer tokens, without having to reach consensus on a new signature algorithm suitable for core inclusion.

---

I have seen nothing to suggest that this working group is going to reach consensus on a single signature algorithm worthy of core inclusion. I agree with John that at least the 1.0a algorithm is well understood and already deployed. I can live with it used without changes, which will also allow reusing existing code with 2.0. I think we can improve it by making small changes, but have better things to do with my time than spend the next few months arguing over it.

By including the 1.0a text in -11, we will have a feature complete specification that I hope many people here can live with if it doesn't change (which looks more likely).

My question is, who here has strong objections to this, and cannot live with the core specification including the 1.0a HMAC-SHA1 algorithm?

EHL

---

From: Dick Hardt <[email-masked]>
Date: Mon, 27 Sep 2010 06:46:18 -0700

As others have stated and I agree with, you also need an extension mechanism so that other signature algorithms can be used. If there is no extension mechanism, then the spec is saying this is the only signature mechanism possible.

-- Dick

On 2010-09-26, at 11:44 PM, Eran Hammer-Lahav wrote:

> Building on John Panzer’s proposal, I would like to ask if people have strong objections to the following:
>  
> By including the 1.0a text in -11, we will have a feature complete specification that I hope many people here can live with if it doesn’t change (which looks more likely).
>  
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 27 Sep 2010 08:14:01 -0700

That goes without saying. Yes. Does this satisfy your concerns?

EHL

From: Dick Hardt [mailto:[email-masked]]
Sent: Monday, September 27, 2010 6:46 AM
To: Eran Hammer-Lahav
Cc: OAuth WG ([email-masked])
Subject: Re: [OAUTH-WG] Proposal: OAuth 1.0 signature in core with revision

-- Dick

---

EHL
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Dick Hardt <[email-masked]>
Date: Mon, 27 Sep 2010 08:53:33 -0700

On 2010-09-27, at 8:14 AM, Eran Hammer-Lahav wrote:

> That goes without saying.

No it does not. We are talking about normative specifications.

> Yes. Does this satisfy your concerns?

Depends on the quality of the extension mechanism. 

Many of the people wanting signing want something stronger or more flexible than the OAuth 1.0A mechanism, so I remain concerned that this approach will satisfy them. Interested to see what the signing proponents say.

-- Dick

---

From: Mike Jones <[email-masked]>
Date: Mon, 27 Sep 2010 16:36:42 +0000

Since you were asking for votes earlier, I'll add a -1.  I believe the industry would be better served by approving a draft soon without signatures, and then working on signatures separately.

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Eran Hammer-Lahav
Sent: Sunday, September 26, 2010 11:44 PM
To: OAuth WG ([email-masked])
Subject: [OAUTH-WG] Proposal: OAuth 1.0 signature in core with revision

---

EHL

---

From: Marius Scurtescu <[email-masked]>
Date: Mon, 27 Sep 2010 11:14:23 -0700

I also think we should focus on finishing OAuth 2 core and deal with
signatures in a separate spec.

Not sure what are optional 1.0a signatures really buying.

Client developers given an option in most cases will go with bearer
tokens. If server developers want to enforce signatures, or provide
the option, they can always implement OAuth 1.0a (for the time being).
Is that much worse than enforcing OAuth 2 with 1.0a signatures?

The only other argument I am aware of is that IETF will not approve
OAuth 2 core if there are no signatures in it. Is this a guess? How
come this was not an issue until recently?

Marius

On Mon, Sep 27, 2010 at 9:36 AM, Mike Jones <[email-masked]> wrote:
> Since you were asking for votes earlier, I’ll add a -1.  I believe the
> industry would be better served by approving a draft soon without
> signatures, and then working on signatures separately.
>
>
>
>                                                             -- Mike
>
>
>
> Keeping the 1.0a signature in the core specification makes sense and builds
> on existing experience and deployment. If we can reach quick consensus on
> some improvements, great. If not, we satisfy the need of many here to offer
> a simple alternative to bearer tokens, without having to reach consensus on
> a new signature algorithm suitable for core inclusion.
>
>
>
> ---
>
>
>
> I have seen nothing to suggest that this working group is going to reach
> consensus on a single signature algorithm worthy of core inclusion. I agree
> with John that at least the 1.0a algorithm is well understood and already
> deployed. I can live with it used without changes, which will also allow
> reusing existing code with 2.0. I think we can improve it by making small
> changes, but have better things to do with my time than spend the next few
> months arguing over it.
>
>
>
> By including the 1.0a text in -11, we will have a feature complete
> specification that I hope many people here can live with if it doesn’t
> change (which looks more likely).
>
>
>
> My question is, who here has strong objections to this, and cannot live with
> the core specification including the 1.0a HMAC-SHA1 algorithm?
>
>
>
> EHL
>

---

From: Anthony Nadalin <[email-masked]>
Date: Mon, 27 Sep 2010 21:37:49 +0000

Not seeing an overwhelming support for doing this, how many interoperable deployments of 1.0a signature are there?

---

EHL

---

From: Lukas Rosenstock <[email-masked]>
Date: Mon, 27 Sep 2010 23:39:56 +0200

In my opinion, there could be two arguments against including 1.0 signatures
into the core:
1) The spec will be too long.
2) The signature mechanism isn't good, so it would be replaced with
something else anyway.
Is 1) a concern? For 2), I think the adoption of OAuth 1.0 speaks for the
signature mechanism being both feasible to implement and secure. Also as
it's already written it should not delay finishing the spec.

I agree with Dick Hardt that if the signatures are included, there should be
a mechanism to allow for different signature schemes who might be defined in
the future.

There's another question: What will be required for OAuth compliance? Is
only-bearer-tokens fine or must the signature mechanism be supported? Is it
fine to not allow both but only a third signature algorithm?

By not including signatures some people (those who strongly feel about
signatures) will feel OAuth 2 is somewhat "less" than OAuth 1 and stick with
OAuth 1 instead of the whole web world moving forward to a new standard.

2010/9/27 Eran Hammer-Lahav <[email-masked]>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 27 Sep 2010 21:45:43 -0700

You must be joking about 1.0a signature deployment. It's also nice that half a day is your measurement for obtaining consensus.

EHL

From: Anthony Nadalin [mailto:[email-masked]]
Sent: Monday, September 27, 2010 2:38 PM
To: Eran Hammer-Lahav; OAuth WG ([email-masked])
Subject: RE: Proposal: OAuth 1.0 signature in core with revision

---

EHL

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 28 Sep 2010 04:48:22 +0000

Still no real answers ...

From: Eran Hammer-Lahav [mailto:[email-masked]]
Sent: Monday, September 27, 2010 9:46 PM
To: Anthony Nadalin; OAuth WG ([email-masked])
Subject: RE: Proposal: OAuth 1.0 signature in core with revision

EHL

---

EHL

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 27 Sep 2010 21:53:32 -0700

Generally speaking, every major provider except Microsoft.

More specifically, over 50 companies last time I counted which was a year ago when we coordinated 1.0a.

An outdated partial list: http://wiki.oauth.net/ServiceProviders

1.0a signatures are widely deployed, secure, and have plenty of library support.

EHL

From: Anthony Nadalin [mailto:[email-masked]]
Sent: Monday, September 27, 2010 9:48 PM
To: Eran Hammer-Lahav; OAuth WG ([email-masked])
Subject: RE: Proposal: OAuth 1.0 signature in core with revision

EHL

---

EHL