Subject: [OAUTH-WG] Nonce-based Replay Protection for DPoP

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 16 Mar 2021 17:45:46 -0400

Brian,

For a nonce-based replay protection you. might want to look at the ACME
protocol here:
https://tools.ietf.org/html/rfc8555#section-6.5

Regards,
 Rifaat

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 16 Mar 2021 16:21:47 -0700

> https://tools.ietf.org/html/rfc8555#section-6.5

Yes, that one is really solid for the sort of thing it does, and I find
myself recommending it over and over again.
Of course, that workflow is not universally applicable, so sometimes it's
not the right thing to do (and I don't remember enough about DPoP to say if
it works there).

-Ben

---

From: Brian Campbell <[email-masked]>
Date: Thu, 18 Mar 2021 14:51:30 -0600

The discussion during the interim wasn't really about replay protection but
rather about precomputation and exfiltration.  Something like a server
contributed nonce can potentially work to address both though so discussing
such things gets fuzzy quickly.

The approach to reply protection in DPoP is a bit different than what
ACME's done. It's arguably somewhat less robust but I think it is
appreciably simpler and is appropriately so because the replay of a DPoP
proof itself isn't of primary interest. To the extent possible/reasonable,
simplicity was and still is a goal of the DPoP design.

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._