OAuth 2.0 Proof-of-Possession (PoP) Security Architecture
draft-ietf-oauth-pop-architecture-08
Document | Type | Expired Internet-Draft (oauth WG) | |
---|---|---|---|
Authors | Phil Hunt , Justin Richer , William Mills , Prateek Mishra , Hannes Tschofenig | ||
Last updated | 2017-01-09 (latest revision 2016-07-08) | ||
Replaces | draft-hunt-oauth-pop-architecture | ||
Stream | IETF | ||
Intended RFC status | Informational | ||
Formats |
Expired & archived
pdf
htmlized (tools)
htmlized
bibtex
|
||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Kepeng Li | ||
Shepherd write-up | Show (last changed 2015-10-20) | ||
IESG | IESG state | Expired (IESG: Dead) | |
Consensus Boilerplate | Yes | ||
Telechat date | |||
Responsible AD | Kathleen Moriarty | ||
Send notices to | draft-ietf-oauth-pop-architecture.all@tools.ietf.org | ||
IANA | IANA review state | Version Changed - Review Needed |
https://www.ietf.org/archive/id/draft-ietf-oauth-pop-architecture-08.txt
Abstract
The OAuth 2.0 bearer token specification, as defined in RFC 6750, allows any party in possession of a bearer token (a "bearer") to get access to the associated resources (without demonstrating possession of a cryptographic key). To prevent misuse, bearer tokens must be protected from disclosure in transit and at rest. Some scenarios demand additional security protection whereby a client needs to demonstrate possession of cryptographic keying material when accessing a protected resource. This document motivates the development of the OAuth 2.0 proof-of-possession security mechanism.
Authors
Phil Hunt
(phil.hunt@yahoo.com)
Justin Richer
(ietf@justin.richer.org)
William Mills
(wmills@yahoo-inc.com)
Prateek Mishra
(prateek.mishra@oracle.com)
Hannes Tschofenig
(Hannes.Tschofenig@gmx.net)
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)