Subject: [OAUTH-WG] Document Management Issue (Signatures)

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Mon, 27 Sep 2010 19:43:24 +0300

Hi all 

I wonder whether the question of "signature in the main specification or
in a separate document" does not really matter. It is purely a matter of
document management style. 

The important question is whether there will be a **mandatory to
implement** or **mandatory to use** someone in the document set.
Mandatory to use is typically hard to enforce unless there is only one
approach possible. This does not seem to be the case.

So, everything then boils down to the question: What is mandatory to
implement? (in this specific case with regard to security)

Ciao
Hannes

---

From: Phil Hunt <[email-masked]>
Date: Mon, 27 Sep 2010 09:51:59 -0700

I think it would also help with handling revisions over time. Changes to signature specifications, etc over time, won't impact the core specification -- keeping it stable and well understood.

Maybe a compromise is to include the 1.0a stuff in the core spec as "legacy" (since it was in the 1.0 core), but reference a normative external signature extension specification document for 2.0 on.

Phil
[email-masked]

On 2010-09-27, at 9:43 AM, Tschofenig, Hannes (NSN - FI/Espoo) wrote:

> Hi all
> 
> I wonder whether the question of "signature in the main specification or in a separate document" does not really matter. It is purely a matter of document management style.
> 
> The important question is whether there will be a **mandatory to implement** or **mandatory to use** someone in the document set. Mandatory to use is typically hard to enforce unless there is only one approach possible. This does not seem to be the case.
> 
> So, everything then boils down to the question: What is mandatory to implement? (in this specific case with regard to security)
> 
> Ciao
> Hannes
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 27 Sep 2010 09:55:12 -0700

It matters if we publish one main specification and then a bunch of extensions. It doesn't matter if we break the core specification into multiple functional parts, where using bearer tokens are also outside core. My concern is solely on the impression and education the specification provides. Putting bearer tokens in the core specification and signatures elsewhere creates a strong bias towards bearer tokens.

I want a fair and balance document.

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Tschofenig, Hannes (NSN - FI/Espoo)
Sent: Monday, September 27, 2010 9:43 AM
To: [email-masked]
Subject: [OAUTH-WG] Document Management Issue (Signatures)

Hi all

Ciao
Hannes

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 27 Sep 2010 10:00:40 -0700

I would also be happy with the core only dealing with *getting* a token, and moving all text about *using* a token to other documents. This will produce three parts:

1.       Getting a document

2.       Using bearer tokens

3.       Using cryptographic tokens

Part 3 can include both the JSON token and a 1.0a HMAC-SHA-1 solution (unless we can solve that disagreement which I highly doubt). Or part 3 can be just the signature framework. With such a setup, I'm happy to close part 1 and 2 immediately and move them along (only hold final RFC publication until part 3 is ready).

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Monday, September 27, 2010 9:52 AM
To: Tschofenig, Hannes (NSN - FI/Espoo)
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Document Management Issue (Signatures)

Phil
[email-masked]<mailto:[email-masked]>

Hi all

Ciao
Hannes
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Lukas Rosenstock <[email-masked]>
Date: Mon, 27 Sep 2010 23:43:00 +0200

2010/9/27 Eran Hammer-Lahav <[email-masked]>

> I would also be happy with the core only dealing with **getting** a token,
> and moving all text about **using** a token to other documents. This will
> produce three parts:
>
>
>
> 1.       Getting a document
>
> 2.       Using bearer tokens
>
Won't there be any scenarios in which signatures are required for getting a
token, like in OAuth 1 (the request is signed with the client id/secret)?

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 27 Sep 2010 21:42:52 -0700

Maybe, but that's something we actually have wide consensus that is not needed. The current draft replaces signatures for obtaining an access token using other means.

EHL

From: Lukas Rosenstock [mailto:[email-masked]]
Sent: Monday, September 27, 2010 2:43 PM
To: Eran Hammer-Lahav
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Document Management Issue (Signatures)

2010/9/27 Eran Hammer-Lahav <[email-masked]<mailto:[email-masked]>>
I would also be happy with the core only dealing with *getting* a token, and moving all text about *using* a token to other documents. This will produce three parts:

1.       Getting a document

2.       Using bearer tokens

Won't there be any scenarios in which signatures are required for getting a token, like in OAuth 1 (the request is signed with the client id/secret)?