Re: [OAUTH-WG] draft-zhang-jose-json-fine-grained-access
Thank you very much for your feedback. We will continue to work on it. -Jiangcheng At 2024-03-23 18:09:34, "Warren Parad" wrote: Some thoughts in no particular order, but mostly I'm with Justin: The exact data properties of the json probably don't belong in this RFC, but rather can be used as an example in the RFC rather than anything normative, as the structure defined herein is not sufficient in many cases. Depending exactly on how (#2) is done, needs to be more extensible or potentially completely ignored since any JSON or even string could be used to achieve #2. The mechanism of how to use the json to encrypt and decrypt the message feels like the only relevant/interesting detail here and it is the main detail left out. I'd recommend cutting the context related to the structure of the request (#1) and focus on how it will be used to encrypt/decrypt payloads (#2). - Warren On Sat, Mar 23, 2024 at 10:38 AM Justin Richer wrote: Thank you for presenting your proposal to the group in Brisbane. Reading through the draft, it seemed that there are really two topics in here, and I'm wondering how they could be split: 1, a data structure for complex access rights 2, a cryptographic mechanism for selectively encrypting some of those rights to protect them from unintentional audiences. The data structure used to convey the access rights seems very similar to the object structure defined by RAR, RFC9396: https://www.rfc-editor.org/rfc/RFC9396 I was unable to find something in this data structure that is required to provide the cryptographic hiding functionality, have I missed something? Or would it be possible to apply this to RAR objects? Does the key distribution happen or of band of the protocol? In the oauth world, would these keys become part of the RS configuration? Thank you, - Justin From: OAuth on behalf of jiangcheng Sent: Tuesday, March 19, 2024 9:42 PM To:OAuth@ietf.org Cc: zhangjl382 ; jill32 Subject: [OAUTH-WG] draft-zhang-jose-json-fine-grained-access Dear oauth， We have a draft and we are looking forward to soliciting comments on it. https://datatracker.ietf.org/doc/draft-zhang-jose-json-fine-grained-access/ Best regards ___ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth ___ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
Re: [OAUTH-WG] draft-zhang-jose-json-fine-grained-access
Some thoughts in no particular order, but mostly I'm with Justin: 1. The exact data properties of the json probably don't belong in this RFC, but rather can be used as an example in the RFC rather than anything normative, as the structure defined herein is not sufficient in many cases. Depending exactly on how (#2) is done, needs to be more extensible or potentially completely ignored since any JSON or even string could be used to achieve #2. 2. The mechanism of how to use the json to encrypt and decrypt the message feels like the only relevant/interesting detail here and it is the main detail left out. I'd recommend cutting the context related to the structure of the request (#1) and focus on how it will be used to encrypt/decrypt payloads (#2). - Warren On Sat, Mar 23, 2024 at 10:38 AM Justin Richer wrote: > Thank you for presenting your proposal to the group in Brisbane. > > Reading through the draft, it seemed that there are really two topics in > here, and I'm wondering how they could be split: > > 1, a data structure for complex access rights > > 2, a cryptographic mechanism for selectively encrypting some of those > rights to protect them from unintentional audiences. > > The data structure used to convey the access rights seems very similar to > the object structure defined by RAR, RFC9396: > https://www.rfc-editor.org/rfc/RFC9396 > > I was unable to find something in this data structure that is required to > provide the cryptographic hiding functionality, have I missed something? Or > would it be possible to apply this to RAR objects? > > Does the key distribution happen or of band of the protocol? In the oauth > world, would these keys become part of the RS configuration? > > Thank you, > > - Justin > -- > *From:* OAuth on behalf of jiangcheng < > jiangcheng...@163.com> > *Sent:* Tuesday, March 19, 2024 9:42 PM > *To:* OAuth@ietf.org > *Cc:* zhangjl382 ; jill32 < > jil...@chinaunicom.cn> > *Subject:* [OAUTH-WG] draft-zhang-jose-json-fine-grained-access > > > Dear oauth， > > > > We have a draft and we are looking forward to soliciting comments on > it. > > > https://datatracker.ietf.org/doc/draft-zhang-jose-json-fine-grained-access/ > > > Best regards > > > ___ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth > ___ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
Re: [OAUTH-WG] draft-zhang-jose-json-fine-grained-access
Thank you for presenting your proposal to the group in Brisbane. Reading through the draft, it seemed that there are really two topics in here, and I'm wondering how they could be split: 1, a data structure for complex access rights 2, a cryptographic mechanism for selectively encrypting some of those rights to protect them from unintentional audiences. The data structure used to convey the access rights seems very similar to the object structure defined by RAR, RFC9396: https://www.rfc-editor.org/rfc/RFC9396 I was unable to find something in this data structure that is required to provide the cryptographic hiding functionality, have I missed something? Or would it be possible to apply this to RAR objects? Does the key distribution happen or of band of the protocol? In the oauth world, would these keys become part of the RS configuration? Thank you, - Justin From: OAuth on behalf of jiangcheng Sent: Tuesday, March 19, 2024 9:42 PM To: OAuth@ietf.org Cc: zhangjl382 ; jill32 Subject: [OAUTH-WG] draft-zhang-jose-json-fine-grained-access Dear oauth， We have a draft and we are looking forward to soliciting comments on it. https://datatracker.ietf.org/doc/draft-zhang-jose-json-fine-grained-access/ Best regards ___ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
[OAUTH-WG] draft-zhang-jose-json-fine-grained-access
Dear oauth， We have a draft and we are looking forward to soliciting comments on it. https://datatracker.ietf.org/doc/draft-zhang-jose-json-fine-grained-access/ Best regards ___ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
