Subject: [OAUTH-WG] OAuth 1.0a

From: William Mills <[email-masked]>
Date: Tue, 14 Aug 2012 12:21:57 -0700 (PDT)

What's the general opinion on 1.0a?  Am I stepping in something if I refer to it in another draft?  I want to reference an auth scheme that uses signing and now MAC is apparently going back to the drawing board, so I'm thinking about using 1.0a.

Thanks,

-bill

---

From: Mike Jones <[email-masked]>
Date: Tue, 14 Aug 2012 19:28:07 +0000

What problem are you trying to solve?

From: [email-masked] [mailto:[email-masked]] On Behalf Of William Mills
Sent: Tuesday, August 14, 2012 12:22 PM
To: O Auth WG
Subject: [OAUTH-WG] OAuth 1.0a

Thanks,

-bill

---

From: William Mills <[email-masked]>
Date: Tue, 14 Aug 2012 12:37:36 -0700 (PDT)

It's for the OAUTH SASL spec.  I've been writing it with the idea that OAuth 1.0a would work (since I think we'll have extant 1.0a typ[e tokens we want to allow for IMAP), but several folks were saying when this all started that 1.0a was dead and I should not refer to it.

I want to make sure the SASL mechanism is build to properly handle signed auth schemes and not just bearer (cookie) type.  

-bill

________________________________
 From: Mike Jones <[email-masked]>
To: William Mills <[email-masked]>; O Auth WG <[email-masked]> 
Sent: Tuesday, August 14, 2012 12:28 PM
Subject: RE: [OAUTH-WG] OAuth 1.0a

 
From:[email-masked] [mailto:[email-masked]] On Behalf Of William Mills
Sent: Tuesday, August 14, 2012 12:22 PM
To: O Auth WG
Subject: [OAUTH-WG] OAuth 1.0a

Thanks,
 
-bill

---

From: Torsten Lodderstedt <[email-masked]>
Date: Tue, 14 Aug 2012 21:42:37 +0200

Hi Bill,

do you need to specify this aspect of your SASL profile now? Why don't 
you wait for the group to complete the work on signing/HoK?

You could also contribute your use cases to drive the discussion.

best regards,
Torsten.

Am 14.08.2012 21:37, schrieb William Mills:
> It's for the OAUTH SASL spec.  I've been writing it with the idea that 
> OAuth 1.0a would work (since I think we'll have extant 1.0a typ[e 
> tokens we want to allow for IMAP), but several folks were saying when 
> this all started that 1.0a was dead and I should not refer to it.
>
> I want to make sure the SASL mechanism is build to properly handle 
> signed auth schemes and not just bearer (cookie) type.
>
> -bill
>
> ------------------------------------------------------------------------
> *From:* Mike Jones <[email-masked]>
> *To:* William Mills <[email-masked]>; O Auth WG <[email-masked]>
> *Sent:* Tuesday, August 14, 2012 12:28 PM
> *Subject:* RE: [OAUTH-WG] OAuth 1.0a
>
> *From:[email-masked] [mailto:[email-masked]] *On 
> Behalf Of *William Mills
> *Sent:* Tuesday, August 14, 2012 12:22 PM
> *To:* O Auth WG
> *Subject:* [OAUTH-WG] OAuth 1.0a
> What's the general opinion on 1.0a?  Am I stepping in something if I 
> refer to it in another draft?  I want to reference an auth scheme that 
> uses signing and now MAC is apparently going back to the drawing 
> board, so I'm thinking about using 1.0a.
> Thanks,
> -bill
>
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Mike Jones <[email-masked]>
Date: Tue, 14 Aug 2012 19:44:19 +0000

Agreed.  Use Bearer now.  If you have requirements that Bearer *can't* meet, please use them as input to the working group's future work.

                                                                -- Mike

From: Torsten Lodderstedt [mailto:[email-masked]]
Sent: Tuesday, August 14, 2012 12:43 PM
To: William Mills
Cc: Mike Jones; O Auth WG
Subject: Re: [OAUTH-WG] OAuth 1.0a

Hi Bill,

do you need to specify this aspect of your SASL profile now? Why don't you wait for the group to complete the work on signing/HoK?

best regards,
Torsten.

-bill

________________________________
From: Mike Jones <[email-masked]><mailto:[email-masked]>
To: William Mills <[email-masked]><mailto:[email-masked]>; O Auth WG <[email-masked]><mailto:[email-masked]>
Sent: Tuesday, August 14, 2012 12:28 PM
Subject: RE: [OAUTH-WG] OAuth 1.0a

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of William Mills
Sent: Tuesday, August 14, 2012 12:22 PM
To: O Auth WG
Subject: [OAUTH-WG] OAuth 1.0a

Thanks,

-bill

OAuth mailing list

[email-masked]<mailto:[email-masked]>

---

From: William Mills <[email-masked]>
Date: Tue, 14 Aug 2012 12:53:43 -0700 (PDT)

I want to get the SASL work done.   HoK is interesting, but I've become convinced that it's not actually anything that needs it's own spec, you can do HoK with MAC or any other signed scheme by including the needed proof of ownership in the token.   HoK, however it works out, is unlikely to vary a lot from the elements that would currently be needed to support MAC or 1.0a and if needed can just extend the SASL mechanism.

-bill

________________________________
 From: Torsten Lodderstedt <[email-masked]>
To: William Mills <[email-masked]> 
Cc: Mike Jones <[email-masked]>; O Auth WG <[email-masked]> 
Sent: Tuesday, August 14, 2012 12:42 PM
Subject: Re: [OAUTH-WG] OAuth 1.0a

Hi Bill,

do you need to specify this aspect of your SASL profile now? Why
    don't you wait for the group to complete the work on signing/HoK? 

best regards,
Torsten.

>I want to make sure the SASL mechanism is build to properly handle signed auth schemes and not just bearer (cookie) type.  
OAuth mailing list [email-masked] https://www.ietf.org/mailman/listinfo/oauth

---

From: William Mills <[email-masked]>
Date: Tue, 14 Aug 2012 12:54:24 -0700 (PDT)

Yeah, I still need 1.0a to work which I was hoping to replace with MAC.

________________________________
 From: Mike Jones <[email-masked]>
To: William Mills <[email-masked]>; Torsten Lodderstedt <[email-masked]> 
Cc: O Auth WG <[email-masked]> 
Sent: Tuesday, August 14, 2012 12:44 PM
Subject: RE: [OAUTH-WG] OAuth 1.0a

Agreed.  Use Bearer now.  If you have requirements that Bearer *can’t* meet, please use them as input to the working group’s future work.
 
                                                                -- Mike
 
From:Torsten Lodderstedt [mailto:[email-masked]] 
Sent: Tuesday, August 14, 2012 12:43 PM
To: William Mills
Cc: Mike Jones; O Auth WG
Subject: Re: [OAUTH-WG] OAuth 1.0a
 
Hi Bill,

best regards,
Torsten.
>From:Mike Jones <[email-masked]>

---

From: Mike Jones <[email-masked]>
Date: Tue, 14 Aug 2012 19:59:11 +0000

I’d replace MAC with Bearer

From: William Mills [mailto:[email-masked]]
Sent: Tuesday, August 14, 2012 12:54 PM
To: Mike Jones; Torsten Lodderstedt
Cc: O Auth WG
Subject: Re: [OAUTH-WG] OAuth 1.0a

________________________________
From: Mike Jones <[email-masked]<mailto:[email-masked]>>
To: William Mills <[email-masked]<mailto:[email-masked]>>; Torsten Lodderstedt <[email-masked]<mailto:[email-masked]>>
Cc: O Auth WG <[email-masked]<mailto:[email-masked]>>
Sent: Tuesday, August 14, 2012 12:44 PM
Subject: RE: [OAUTH-WG] OAuth 1.0a

                                                                -- Mike

From: Torsten Lodderstedt [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>
Sent: Tuesday, August 14, 2012 12:43 PM
To: William Mills
Cc: Mike Jones; O Auth WG
Subject: Re: [OAUTH-WG] OAuth 1.0a

Hi Bill,

best regards,
Torsten.

-bill

Thanks,

-bill

OAuth mailing list

---

From: Justin Richer <[email-masked]>
Date: Tue, 14 Aug 2012 16:50:48 -0400

In my personal view, 1.0a is technically obsoleted but still useful, 
especially for cases where 2 doesn't offer a solution right now. If you 
can specify a way to bind to different token/signature types, you'd be 
able to leave yourself the flexibility.

  -- Justin

---

From: Dick Hardt <[email-masked]>
Date: Tue, 14 Aug 2012 14:11:38 -0700

FYI: Google's SASL for IMAP is with OAuth 1.0A -- took me a while to get it working.

---

From: Ryan Troll <[email-masked]>
Date: Tue, 14 Aug 2012 16:27:46 -0700

And our SASL for IMAP (and SMTP) support for OAuth 2.0 will be launching in
the very near future.

The implementation conforms to draft-ietf-kitten-sasl-oauth-03, except for
the mechanism name.  (We're launching with an alternate mechanism name, so
that we don't conflict with the standard when it is completed.)  Once this
standard is published, we'll also add support for it.

-R

On Tue, Aug 14, 2012 at 2:11 PM, Dick Hardt <[email-masked]> wrote:

> I want to get the SASL work done.   HoK is interesting, but I've become
> convinced that it's not actually anything that needs it's own spec, you can
> do HoK with MAC or any other signed scheme by including the needed proof of
> ownership in the token.   HoK, however it works out, is unlikely to vary a
> lot from the elements that would currently be needed to support MAC or 1.0a
> and if needed can just extend the SASL mechanism.
>
> -bill
>
>   ------------------------------
> *From:* Torsten Lodderstedt <[email-masked]>
> *To:* William Mills <[email-masked]>
> *Cc:* Mike Jones <[email-masked]>; O Auth WG <[email-masked]>
>
> *Sent:* Tuesday, August 14, 2012 12:42 PM
> *Subject:* Re: [OAUTH-WG] OAuth 1.0a
>
>  Hi Bill,
>
> do you need to specify this aspect of your SASL profile now? Why don't you
> wait for the group to complete the work on signing/HoK?
>
> OAuth 1.0a would work (since I think we'll have extant 1.0a typ[e tokens we
> want to allow for IMAP), but several folks were saying when this all
> started that 1.0a was dead and I should not refer to it.
>
>    ------------------------------
> *From:* Mike Jones <[email-masked]><[email-masked]>
> *To:* William Mills <[email-masked]> <[email-masked]>; O
> Auth WG <[email-masked]> <[email-masked]>
>  *From:* [email-masked] [mailto:[email-masked]<[email-masked]>]
> *On Behalf Of *William Mills
> refer to it in another draft?  I want to reference an auth scheme that uses
> signing and now MAC is apparently going back to the drawing board, so I'm
> thinking about using 1.0a.
>
>  Thanks,
>
>  -bill
>
>
>
>
> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
>
>
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 15 Aug 2012 08:48:39 +0300

FYI: just to repeat my note here as well that I sent to Bill on the KITTEN list:

I see three possible ways forward for the OAuth SASL work, namely:

> 	• Focus on Oauth 1.0 only (since it has a MAC specification in there). Then, you ignore all the Oauth 2.0 deployment that is out there, of which there is a lot. That would be pretty bad IMHO.
> 	• Copy relevant parts from http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 (of which there is almost no deployment).
> 	• Wait for the Oauth group to settle on a mechanism. May take time. 

I doubt that the question about the views of the WG about OAuth 1.0a can answer any of the above questions. 

Bill does not want to wait. He also does not want to copy parts from draft-ietf-oauth-v2-http-mac-01 into the SASL OAuth spec. Focusing on OAuth 1.0 for now would require the specification to be extended later on to fit to OAuth 2.0 deployments (and whatever new security mechanism we will come up with). As a consequence, the specification will then suffer from additional complexity. 

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 15 Aug 2012 08:49:03 +0300

Hi Bill, 

how do you know that the outcome of the security discussions will unlikely be different than MAC?

The views about TLS had changed in the meanwhile (a few years ago many thought it is too heavy and too expensive to get certificates), and we now have the JSON work as well. On top of that we may also want to provide not just client to server key confirmation with integrity protection of a few fields but more than that. In a nutshell the solution has to provide better security than bearer -- not just be different. 

Ciao
Hannes

---

From: William Mills <[email-masked]>
Date: Tue, 14 Aug 2012 23:10:50 -0700 (PDT)

You are mistaken, I cite MAC directly right now, but now that it is up in the air I would much rather rely on 3 specs (Oauth 2 core, Bearer, and 1.0a) than refer to MAC when I think I can do without MAC and use 1.0a instead.  MAC is now in flux again, the other 3 are stable or already standards.

I think you also mistaken that we can't support 1.0a and OAuth 2 tokens in the same SASL mechanism.  Why do you think this is true?

________________________________
 From: Hannes Tschofenig <[email-masked]>
To: William Mills <[email-masked]> 
Cc: Hannes Tschofenig <[email-masked]>; Mike Jones <[email-masked]>; O Auth WG <[email-masked]> 
Sent: Tuesday, August 14, 2012 10:48 PM
Subject: Re: [OAUTH-WG] OAuth 1.0a

Ciao
Hannes

---

From: William Mills <[email-masked]>
Date: Tue, 14 Aug 2012 23:16:01 -0700 (PDT)

Fundamentally MAC and any HoK that uses symmetric keys are equivalent.  Either can pull in the same profile of HTTP stuff into the signature.

I commented on your argument that MAC and Bearer have equivalent security properties in a different thread.

-bill

________________________________
 From: Hannes Tschofenig <[email-masked]>
To: William Mills <[email-masked]> 
Cc: Hannes Tschofenig <[email-masked]>; Torsten Lodderstedt <[email-masked]>; O Auth WG <[email-masked]> 
Sent: Tuesday, August 14, 2012 10:49 PM
Subject: Re: [OAUTH-WG] OAuth 1.0a
 
Hi Bill, 

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 15 Aug 2012 09:26:48 +0300

Hi Bill, 

I know that you can reference many specifications.

I already see you being referenced by Eran in an upcoming blog post about
the complexity and the lack of interoperability you have added even to SASL
Oauth ;-)

Ciao
Hannes

On 8/15/12 9:10 AM, "ext William Mills" <[email-masked]> wrote:

> You are mistaken, I cite MAC directly right now, but now that it is up in the
> air I would much rather rely on 3 specs (Oauth 2 core, Bearer, and 1.0a) than
> refer to MAC when I think I can do without MAC and use 1.0a instead.  MAC is
> now in flux again, the other 3 are stable or already standards.
> 
> I think you also mistaken that we can't support 1.0a and OAuth 2 tokens in the
> same SASL mechanism.  Why do you think this is true?
> 
>   
>  
>  
>   
> 
> Cc: Hannes Tschofenig <[email-masked]>; Mike Jones
> <[email-masked]>; O Auth WG <[email-masked]>
>> >     € Focus on Oauth 1.0 only (since it has a MAC specification in there).
>> Then, you ignore all the Oauth 2.0 deployment that is out there, of which
>> there is a lot. That would be pretty bad IMHO.
>> >     € Copy relevant parts from
>> http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 (of which there is
>> almost no deployment).
>> >     € Wait for the Oauth group to settle on a mechanism. May take time.
> 
> 
> Bill does not want to wait. He also does not want to copy parts from
> draft-ietf-oauth-v2-http-mac-01 into the SASL OAuth spec. Focusing on OAuth
> 1.0 for now would require the specification to be extended later on to fit to
> OAuth 2.0 deployments (and whatever new security mechanism we will come up
> with). As a consequence, the specification will then suffer from additional
> complexity. 
> 
> Ciao
> Hannes
> 
>> want to allow for IMAP), but several folks were saying when this all started
>> that 1.0a was dead and I should not refer to it.
>> > 
>> > I want to make sure the SASL mechanism is build to properly handle signed
>> auth schemes and not just bearer (cookie) type.
>> > 
>> > -bill
>> > 
>> > What's the general opinion on 1.0a?  Am I stepping in something if I refer
>> to it in another draft?  I want to reference an auth scheme that uses signing
>> and now MAC is apparently going back to the drawing board, so I'm thinking
>> about using 1.0a.
>> >  
>> > Thanks,
>> >  
>> > -bill
>> > 
>> >

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 15 Aug 2012 09:32:06 +0300

Hi Bill, 

On 8/15/12 9:16 AM, "ext William Mills" <[email-masked]> wrote:

> Fundamentally MAC and any HoK that uses symmetric keys are equivalent.  Either
> can pull in the same profile of HTTP stuff into the signature.
> 
> The issue is: a small change in the protocol specification makes the two
> mechanisms incompatible. Hence, you have to provide the code for the two and a
> possible negotiation mechanism along with it. For example, the fact that OAuth
> 1.0 does not allow for automatic token refresh already makes the OAuth 1.0 MAC
> and the OAuth 2.0 MAC different.
> 
> Sorry. I missed that. Do you have a pointer for me by chance?
> 
> 
> Ciao
> Hannes
> 
> -bill
> 
>   
>  
>  
>   
> 
> Cc: Hannes Tschofenig <[email-masked]>; Torsten Lodderstedt
> <[email-masked]>; O Auth WG <[email-masked]>
> The views about TLS had changed in the meanwhile (a few years ago many thought
> it is too heavy and too expensive to get certificates), and we now have the
> JSON work as well. On top of that we may also want to provide not just client
> to server key confirmation with integrity protection of a few fields but more
> than that. In a nutshell the solution has to provide better security than
> bearer -- not just be different.
> 
> Ciao
> Hannes
>

---

From: William Mills <[email-masked]>
Date: Tue, 14 Aug 2012 23:37:28 -0700 (PDT)

Sorry, that other thread is on the Kitten list.  Cross post it here?

Certainly MAC or HoK could change and become incompatible with the current SASL mechanism spec.  Hopefully not fundamentally incompatible, and either a new spec or the updated MAC or HoK spec can update the SASL mechanism to provide comatibility.

-bill

________________________________
 From: Hannes Tschofenig <[email-masked]>
To: William Mills <[email-masked]>; Hannes Tschofenig <[email-masked]> 
Cc: O Auth WG <[email-masked]> 
Sent: Tuesday, August 14, 2012 11:32 PM
Subject: Re: [OAUTH-WG] OAuth 1.0a

Re: [OAUTH-WG] OAuth 1.0a 
Hi Bill, 

>
>The issue is: a small change in the protocol specification makes the two mechanisms incompatible. Hence, you have to provide the code for the two and a possible negotiation mechanism along with it. For example, the fact that OAuth 1.0 does not allow for automatic token refresh already makes the OAuth 1.0 MAC and the OAuth 2.0 MAC different.
>
>  From:Hannes Tschofenig <[email-masked]>