I believe that there's value in per-message signing completely apart
from the channel level encryption. MAC tokens let us do this with a
per-token secret using a pattern very well established in OAuth1. I'm
sorry that I wasn't at the Vancouver meeting to voice this opinion, for
what it's worth.
-- Justin
On 08/08/2012 12:24 PM, Hannes Tschofenig wrote:
Hi Justas,
thanks for sending your feedback to the list.
There is indeed currently no editor for the document. That is, however, not the
problem.
The problem, as discussed on the list and also at the last IETF meeting, is
that we do not yet know what type of security properties we want. The MAC draft
may or may not provide the type of protection we want.
For that reason we first have to figure out what problem we want to solve
before we jump into the details of fixing some minor errors.
Ciao
Hannes
On Aug 8, 2012, at 6:08 PM, Justin Richer wrote:
Thanks Justas. The MAC document is currently without an editor within the WG,
so this is the best place to record the error.
A wider note to the WG: I wouldn't mind taking over editorship of the MAC token
document so long as I could get a co-editor with enough cryptographic expertise
to make sure all the magical crypto bits work like they should. I've sent an
email to the chairs saying as much, as well.
-- Justin
On 08/05/2012 06:30 AM, Justas Janauskas wrote:
Hello,
Sorry if this is not the right group to send this message; I am new here.
I believe there is mistake in calculated request MAC presented in
"draft-ietf-oauth-v2-http-mac-01" example, section 1.1.
I made a small program to test correctness of an example and it shows
that it is incorrectly calculated in the document:
https://gist.github.com/3263677
I have also implemented an example from previous draft 00, section 1.2
which shows that request MAC is calculated correctly there:
https://gist.github.com/3263765
Thank you,
Justas Janauskas
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
