1.) I would not put these parameters in the "token request" category, they belong into a new category. Whether they should be registered in the OAuth parameters registry is doubtful to me, since I don't see them being used in a non-ACE OAuth context. Somewhere in the ACE registries?
2.) I would propose to put it on ACE page to be created for the framework by IANA. /Ludwig -----Original Message----- From: Ace <[email protected]> On Behalf Of Francesca Palombini Sent: den 31 augusti 2020 14:53 To: Ace Wg <[email protected]> Cc: [email protected] Subject: [Ace] OSCORE Profile IANA questions Hi all, I have two quick questions concerning IANA actions to be done for the OSCORE profile: 1) The framework (-params) and the profile are currently conflicting on the registration of parameters, and we need to fix that. In the framework, parameters that are sent from Client to AS (such as req_cnf) are registered in the OAuth Parameters Registry as having "Parameter Usage Location: token request". The OSCORE profile registers parameters sent from Client to RS (such as nonce1) with "Parameter Usage Location: token request". The possible "Parameter Usage Location" are "token request" "token response" "authorization request" "authorization response" (see https://tools.ietf.org/html/rfc6749#section-11.2.1 ). It seems that "authorization request/response" are to the Resource Owner, and "token request/response" are to the Authorization Server. I think the framework is using the right names, but I am not sure what other location to put there, I think there is no name for Client-to-RS and RS-to-Client in the registry right now. 2) The OSCORE profile defines a new registry, the OSCORE Security Context Parameters registry. The question is where to put this registry? My proposal is to put it under https://www.iana.org/assignments/core-parameters/core-parameters.xhtml . Any objections? Thanks, Francesca _______________________________________________ Ace mailing list [email protected] https://www.ietf.org/mailman/listinfo/ace _______________________________________________ Ace mailing list [email protected] https://www.ietf.org/mailman/listinfo/ace
