OAuth 2.0 Proof-of-Possession (PoP) Security Architecture
draft-ietf-oauth-pop-architecture-08

Document Type Expired Internet-Draft (oauth WG)
Last updated 2017-01-09 (latest revision 2016-07-08)
Replaces draft-hunt-oauth-pop-architecture
Stream IETF
Intended RFC status Informational
Formats
Expired & archived
plain text pdf html bibtex
Reviews
Stream WG state Submitted to IESG for Publication Mar 2016
Document shepherd Kepeng Li
Shepherd write-up Show (last changed 2015-10-20)
IESG IESG state Expired (IESG: Dead)
Consensus Boilerplate Yes
Telechat date
Responsible AD Kathleen Moriarty
Send notices to draft-ietf-oauth-pop-architecture.all@tools.ietf.org
IANA IANA review state Version Changed - Review Needed
IANA action state None

This Internet-Draft is no longer active. A copy of the expired Internet-Draft can be found at
https://www.ietf.org/archive/id/draft-ietf-oauth-pop-architecture-08.txt

Abstract

The OAuth 2.0 bearer token specification, as defined in RFC 6750, allows any party in possession of a bearer token (a "bearer") to get access to the associated resources (without demonstrating possession of a cryptographic key). To prevent misuse, bearer tokens must be protected from disclosure in transit and at rest. Some scenarios demand additional security protection whereby a client needs to demonstrate possession of cryptographic keying material when accessing a protected resource. This document motivates the development of the OAuth 2.0 proof-of-possession security mechanism.

Authors

Phil Hunt (phil.hunt@yahoo.com)
Justin Richer (ietf@justin.richer.org)
William Mills (wmills@yahoo-inc.com)
Prateek Mishra (prateek.mishra@oracle.com)
Hannes Tschofenig (Hannes.Tschofenig@gmx.net)

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)