Just read the draft quickly.
Since we're now leaning on JWT do we need to include the token in this? Why
not just make an additional "Envelope MAC" thing and have the signature include
the 3 JWT parts in the signature base string? That object then just becomes a
JSON container for the kid, timestamp, signature method, signature etc. That
thing then is a 4th base64 encoded JSON thing in the auth header.
How header fields get included in the signature needs definition.
Why did you kill the port number, nonce, and extension parameter out of the
signature base string?
The BNF appears to have no separators between values.
-bill
________________________________
From: "[email protected]" <[email protected]>
To: [email protected]
Cc: [email protected]
Sent: Monday, February 25, 2013 4:46 AM
Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-v2-http-mac-03.txt
A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Web Authorization Protocol Working Group of
the IETF.
Title : OAuth 2.0 Message Authentication Code (MAC) Tokens
Author(s) : Justin Richer
William Mills
Hannes Tschofenig
Filename : draft-ietf-oauth-v2-http-mac-03.txt
Pages : 26
Date : 2013-02-25
Abstract:
This specification describes how to use MAC Tokens in HTTP requests
to access OAuth 2.0 protected resources. An OAuth client willing to
access a protected resource needs to demonstrate possession of a
crytographic key by using it with a keyed message digest function to
the request.
The document also defines a key distribution protocol for obtaining a
fresh session key.
The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-http-mac
There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-03
A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-v2-http-mac-03
Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/
_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth
