Subject: [Unbearable] similarities....

From: Bill Mills <[email-masked]>
Date: Tue, 27 Jan 2015 20:13:29 +0000 (UTC)

As an aside http://tools.ietf.org/html/draft-ietf-oauth-spop-06 falls right into this space.

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 27 Jan 2015 21:59:08 +0000

I believe that one could use what is being proposed here and not have a OAUTH specific solution as SPOP provides

From: Unbearable [mailto:[email-masked]] On Behalf Of Bill Mills
Sent: Tuesday, January 27, 2015 12:13 PM
To: [email-masked]
Subject: [Unbearable] similarities....

---

From: John Bradley <[email-masked]>
Date: Tue, 27 Jan 2015 19:17:13 -0300

SPOP now PKCE solves a issue now without changes to the browser/TLS.

In the future Token binding might be able to address the same issue (I hope).

However there would be the question of non browser applications like native OAuth apps sharing the same Token binding key store.  
On some platforms currently apps need to provide there own TLS stack.   
I am guessing that having Token binding at the OS level with a common TLS stack sharing keys may take a while.
It is defiantly worth exploring.

The browser and native apps not sharing the same TLS keys will slow down a number of possible use cases for Token binding.

John B.

> On Jan 27, 2015, at 6:59 PM, Anthony Nadalin <[email-masked]> wrote:
> 
>   <>
> From: Unbearable [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Bill Mills
> To: [email-masked] <mailto:[email-masked]>
> As an aside http://tools.ietf.org/html/draft-ietf-oauth-spop-06 <http://tools.ietf.org/html/draft-ietf-oauth-spop-06> falls right into this space.
>  
> _______________________________________________
> Unbearable mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/unbearable <https://www.ietf.org/mailman/listinfo/unbearable>

---

From: Bill Mills <[email-masked]>
Date: Tue, 27 Jan 2015 22:19:14 +0000 (UTC)

Yes.  There are some design choices to think about.  SPOP is using a relatively cheap hash and disposable one-use secrets which is a bit different, so there is an interesting practical question of whether a PK signature check would be acceptable.  You could certainly assert a public key instead of the hashed code verifier and send a signature of the code and the public key as the verifier to get the same result SPOP does.

     On Tuesday, January 27, 2015 1:59 PM, Anthony Nadalin <[email-masked]> wrote:

 #yiv6702337357 -- filtered {font-family:Helvetica;panose-1:2 11 6 4 2 2 2 2 2 4;}#yiv6702337357 filtered {panose-1:2 4 5 3 5 4 6 3 2 4;}#yiv6702337357 filtered {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;}#yiv6702337357 p.yiv6702337357MsoNormal, #yiv6702337357 li.yiv6702337357MsoNormal, #yiv6702337357 div.yiv6702337357MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:12.0pt;}#yiv6702337357 a:link, #yiv6702337357 span.yiv6702337357MsoHyperlink {color:blue;text-decoration:underline;}#yiv6702337357 a:visited, #yiv6702337357 span.yiv6702337357MsoHyperlinkFollowed {color:purple;text-decoration:underline;}#yiv6702337357 span.yiv6702337357EmailStyle17 {color:#1F497D;}#yiv6702337357 .yiv6702337357MsoChpDefault {font-size:10.0pt;}#yiv6702337357 filtered {margin:1.0in 1.0in 1.0in 1.0in;}#yiv6702337357 div.yiv6702337357WordSection1 {}#yiv6702337357 I believe that one could use what is being proposed here and not have a OAUTH specific solution as SPOP provides    From: Unbearable [mailto:[email-masked]]On Behalf Of Bill Mills
Sent: Tuesday, January 27, 2015 12:13 PM
To: [email-masked]
Subject: [Unbearable] similarities....    As an aside http://tools.ietf.org/html/draft-ietf-oauth-spop-06 falls right into this space.