Hi Warren and the rest of the list. I also support adoption of this draft even though I share some of your concerns.
As for real world examples where this draft would give value I have one from my time in the Norwegian health sector and the HelseID ecosystem. Here we saw this exact (ab)use of the DPoP mechanism to also do signing of the http message using the same key. We suggested they look at using HttpSig for this, but I believe they ended up rolling their own custom implementation for that resource server. So I would absolutely welcome more work on this topic. Rune ________________________________ From: Warren Parad <[email protected]> Sent: Tuesday, September 22, 2026 7:46 PM To: Aaron Parecki <[email protected]> Cc: Warren Parad <[email protected]>; oauth <[email protected]> Subject: [OAUTH-WG] Re: Call for adoption - OAuth Proof of Possession Tokens with HTTP Message Signatures If that were true, then I agree that would be the case, but are people actually doing this? And if so why? Did they do it because they didn't know how to use DPoP, because they didn't want to, or because the current RFC is flawed in some way? Can someone with the knowledge of why / and clarity of the scenarios that warrant it who support adoption share? It would be great to have more than hearsay on the matter. On Tue, Sep 22, 2026 at 7:28 PM Aaron Parecki <[email protected]<mailto:[email protected]>> wrote: I support adoption for the reasons Justin mentions below. If we don’t adopt this, people are going to continue using HTTPSig for OAuth PoP anyway, it will just be one-off implementations instead of based on a consistent profile. That will arguably lead to worse interoperability problems later down the road since everyone will be signing slightly different things and managing key distribution in their own way. I am totally on board with better clarifying in the document when HTTPSig makes sense to use over DPoP, but that doesn’t seem like a blocker to adoption. Aaron On Tue, Sep 22, 2026 at 8:46 AM Justin Richer <[email protected]<mailto:[email protected]>> wrote: I think a lot has changed in six years, actually. RFC9449 (DPoP) is published and no longer an active WG item, and one of the arguments at the time was splitting the group’s attention. RFC9421 (HTTPSig) is also published and widely deployed, and several proposals have been made to extend DPoP into spaces that HTTPSig covers natively. We’ve got a few years of experience in both that can better inform the combination of HTTPSig and OAuth. We’ve also got people making this combination on their own because it’s nearly obvious how to fit them together and sign an OAuth message. The real value of this doc is the key assignment, from which we take a lot of learnings from both DPoP and mTLS as well as WIMSE’s HTTPSig draft. — Justin On Sep 22, 2026, at 8:07 AM, Warren Parad <[email protected]<mailto:[email protected]>> wrote: I would appreciate knowing what exactly has changed since the last time this draft was brought to the WG and rejected. On Tue, Sep 22, 2026 at 1:56 PM Dick Hardt <[email protected]<mailto:[email protected]>> wrote: I'm opposed to adoption of this draft. It is focussed on binding a key to an access token, which the WG has already solved with DPoP (RFC 9449). It is not clear why a new mechanism is needed. The editor's note in Section 1 says the draft still needs to give guidance on when to use it instead of DPoP or mTLS. Section 4 introduces a new representation for public keys, the pub signature parameter carrying raw key bytes, instead of using JWK (RFC 7517). Because of that, Section 5 has to define a new htsk confirmation method. A resource server also has to support two algorithm registries and two code paths, depending on how the key was bound. The editor's note in Section 3.2 acknowledges this. It ignores the other HTTP message signature key exchange work, all of which conveys keys as JWKs: Web Bot Auth: https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/ Signature-Key: https://datatracker.ietf.org/doc/draft-hardt-httpbis-signature-key/ WIMSE: https://datatracker.ietf.org/doc/draft-ietf-wimse-http-signature/ On Mon, Sep 21, 2026 at 8:17 PM Rifaat Shekh-Yusef <[email protected]<mailto:[email protected]>> wrote: All, This is an official call for adoption for the OAuth Proof of Possession Tokens with HTTP Message Signatures draft: https://www.ietf.org/archive/id/draft-richer-oauth-httpsig-03.html Please, reply on the mailing list, on whether you support or oppose the adoption of this draft as a WG document by October 5th. Regards, Rifaat & Hannes _______________________________________________ OAuth mailing list -- [email protected]<mailto:[email protected]> To unsubscribe send an email to [email protected]<mailto:[email protected]> _______________________________________________ OAuth mailing list -- [email protected]<mailto:[email protected]> To unsubscribe send an email to [email protected]<mailto:[email protected]> _______________________________________________ OAuth mailing list -- [email protected]<mailto:[email protected]> To unsubscribe send an email to [email protected]<mailto:[email protected]> _______________________________________________ OAuth mailing list -- [email protected]<mailto:[email protected]> To unsubscribe send an email to [email protected]<mailto:[email protected]>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
