Hi all, I have posted draft-davliatshin-oauth-attenuation-chains-report-00:
https://datatracker.ietf.org/doc/draft-davliatshin-oauth-attenuation-chains-report/ It is an individual implementation report in the shape of RFC 7942, not a proposal. I am not an author of either draft it covers. What it contains: - A minimal TypeScript verifier written from the text of draft-niyikiza-oauth-attenuating-agent-tokens (-01 and -02) and draft-asor-wimse-agent-delegation-chain-02. The -02 profile, written from the text before the vectors were run, agrees with the author's 229-vector JWS suite on all 229 vectors, with the expected Section 8 step on every denial. asor-02 agrees with the 35 attenu-guard vectors. - A ProVerif model of both chain structures (parent-hash linkage, depth and lifetime monotonicity, holder binding, proof of possession), with the two properties Neil Madden raised in review checked on both, and one variant that isolates where the two chains' guarantees differ: which key verifies a link below the root. - 25 observations recorded on AAT -01 while implementing it, with the status of each against the -02 text (19 are decided by -02, one in part, one no longer arises, four are unchanged); ten points where -02 still leaves an implementer more than one conforming behaviour; seven observations on asor-02, the main one being that Section 6 names no key for a link below the root, and one on how a child's del_max_depth is bounded. Code, model and vectors: https://github.com/azatdavliatshin/aat (Apache-2.0). I would value corrections from the draft authors most of all -- in particular where I have misread the text. Section 6.5 (the ten underdetermined points) and Section 7 are the places where a wrong reading on my side would matter; Section 8 states what the model shows about the difference between the two chains. Regards, Azat Davliatshin _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
