Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-pop-key-distribution-03.txt

From: [email-masked]
Date: Fri, 24 Feb 2017 13:55:25 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Web Authorization Protocol of the IETF.

        Title           : OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key Distribution
        Authors         : John Bradley
                          Phil Hunt
                          Michael B. Jones
                          Hannes Tschofenig
	Filename        : draft-ietf-oauth-pop-key-distribution-03.txt
	Pages           : 18
	Date            : 2017-02-24

Abstract:
   RFC 6750 specified the bearer token concept for securing access to
   protected resources.  Bearer tokens need to be protected in transit
   as well as at rest.  When a client requests access to a protected
   resource it hands-over the bearer token to the resource server.

   The OAuth 2.0 Proof-of-Possession security concept extends bearer
   token security and requires the client to demonstrate possession of a
   key when accessing a protected resource.

   This document describes how the client obtains this keying material
   from the authorization server.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-pop-key-distribution/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-oauth-pop-key-distribution-03

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-pop-key-distribution-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: John Bradley <[email-masked]>
Date: Fri, 24 Feb 2017 18:58:57 -0300

I updated the references but haven't made any other changes.

I had some questions about it so though it was worth keeping alive at-least for discussion.

There have been some other questions and proposed changes.  

I will take a look through them and see if what may be worth updating.

John B.

> Begin forwarded message:
> 
> From: [email-masked]
> Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-pop-key-distribution-03.txt
> Date: February 24, 2017 at 6:55:25 PM GMT-3
> To: <[email-masked]>
> Cc: [email-masked]
> 
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Phil Hunt <[email-masked]>
Date: Fri, 24 Feb 2017 15:33:55 -0800

I have been wondering about that myself. Interest seems to wained with the TOKBIND work emerging. Maybe I am wrong about that?

Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Feb 24, 2017, at 1:58 PM, John Bradley <[email-masked]> wrote:
> 
>> From: [email-masked] <mailto:[email-masked]>
>> To: <[email-masked] <mailto:[email-masked]>>
>> Cc: [email-masked] <mailto:[email-masked]>
>> 
>> 
>> https://datatracker.ietf.org/doc/draft-ietf-oauth-pop-key-distribution/ <https://datatracker.ietf.org/doc/draft-ietf-oauth-pop-key-distribution/>
>>

---

From: John Bradley <[email-masked]>
Date: Fri, 24 Feb 2017 20:51:09 -0300

The European banks are interested in mutual TLS for server to server connections as part of PSD2/Open Banking.

They have been thinking that they would have central CA and directly use CA certificates for all the legs.  

I sent them this to get them thinking that they could perhaps secure the token endpoint with cert based mutual TLS but allow clients to specify there own keys for access tokens to make key rotation and deployment easier.

I was also think ing that they could protect a jwks_uri with the CA certificate using OCSP stapling and then use mutual TLS to the token endpoint based on keyid and/or fingerprint. allowing for rotation of keys to token endpoint and better support clusters with multiple keys.

I don’t think this has much interest outside of some verticals like financials.

John B.
> On Feb 24, 2017, at 8:33 PM, Phil Hunt <[email-masked]> wrote:
> 
>> On Feb 24, 2017, at 1:58 PM, John Bradley <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>>> https://tools.ietf.org/html/draft-ietf-oauth-pop-key-distribution-03 <https://tools.ietf.org/html/draft-ietf-oauth-pop-key-distribution-03>
>>> 
>> [email-masked] <mailto:[email-masked]>