<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Verdana,Geneva,sans-serif'>
<p>I have something to report on the tooling side.</p>
<p>During the APIDays Berlin, I had a chance to talk to 42crunch people. They are connected with Open API community and told me that they could potentially take the feature request regarding the expressibility of the security features to them. So, hopefully, in the next version of Open API/Swagger, we will have better support for the security features that we rely on. </p>
<div>
<pre>---<br />Nat Sakimura
Research Fellow, Nomura Research Institute
Chairman of the Board, OpenID Foundation</pre>
</div>
<p>On 2017-11-14 23:32, Dave Tonge via Openid-specs-fapi wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div dir="ltr">
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;">Hi Anders,</div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;"> </div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;">OpenBanking decided to use detached JWS for this use-case:</div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;"> </div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><a href="https://tools.ietf.org/html/rfc7515#appendix-F">https://tools.ietf.org/html/rfc7515#appendix-F</a> and <a href="https://tools.ietf.org/html/rfc7797">https://tools.ietf.org/html/rfc7797</a></span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><br /></span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;">This requires both the resource server and the client to agree on the method by which the "payload" is encoded and therefore by which its signature can be verified. However, it is standards compliant, and for "new" APIs seems to have advantages. </span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><br /></span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;">Other options considered were that the resource server to return JWTs instead of JSON, i.e. it returns the conent-type "application/jwt"</span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;">This is also standards compliant, but it was felt that the tooling is not mature enough for this option to be developer friendly.</span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><br /></span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;">Dave</span></div>
</div>
<div class="gmail_extra"><br />
<div class="gmail_quote">On 13 November 2017 at 09:53, Anders Rundgren via Openid-specs-fapi <span><<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>></span> wrote:<br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">On 2017-11-13 10:25, Phil Hunt (IDM) wrote:<br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">Fwiw. We looked at signed http requests as part of proof of possession specs. </blockquote>
<br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">The advice from key members of the http wg is that http request signing is impossible. Too much water under the bridge with isps, gateways, balancers and proxys messing with messages.</blockquote>
<br /> Indeed. Unfortunately it also means that "proper" signing of REST requests is impossible/not recommended.<br /><br /> Combining that with the desire of also using Browsers/JS as well as WebSockets for carrying "business messages", my conclusion was that the REST concept squarely matches the needs of *my* kind of work.<br /><br /> Anders<br /><br /><br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">So yes you can do it in a lab environment. But having a 10% (or whatever the number is) false fail rate in production is not usable in the real world.<br /><br /> To sign requests you have to have a content type that does this. I seem to recall ws-* hd request signing but still suffering scars.<br /><br /> Phil<br /><br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;"><span><span> On Nov 13, 2017, at 5:09 PM, Anders Rundgren via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>> wrote:<br /><br /></span></span>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">On 2017-11-12 20:49, Nat Sakimura via Openid-specs-fapi wrote:<br /> Dear FAPIers:<br /> I have started to paste the comments that I got by now into the<br /> following google doc.</blockquote>
<span><br /> Hi Nat,<br /> May I take the liberty commenting a bit on this?<br /><br /></span>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_document_d_1fh09jiJGITuefXkB1Zq3oCrhHNvP5BWXDrpKPJK-5FiRE_edit-3Fusp-3Dsharing&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=43ChkaJn0AI1162Dlg47a0yRs-exDmX5IjKRo10RsZ8&s=-_n_hjGDPSb-65_v6NuK9xZgsc-2ZN6VPWaue57_AW8&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_document_d_1fh09jiJGITuefXkB1Zq3oCrhHNvP5BWXDrpKPJK-5FiRE_edit-3Fusp-3Dsharing&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=43ChkaJn0AI1162Dlg47a0yRs-exDmX5IjKRo10RsZ8&s=-_n_hjGDPSb-65_v6NuK9xZgsc-2ZN6VPWaue57_AW8&e=</a></blockquote>
<span> <br /> "4.2 [signHTTP] is not a standard nor it is on the way to become standard.<br /> It has not and is not going under the rigor of the standardization process"<br /><br /></span> FWIW, the STET PSD2 API (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.stet.eu_en_news_news1_stet-2Dpsd2-2Dapi-2Dis-2Dnow-2Davailable.html&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=43ChkaJn0AI1162Dlg47a0yRs-exDmX5IjKRo10RsZ8&s=pyTgj5xuZ0AD3s770l7oKscOELvtX68LJtkcAhpLV90&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__www.stet.eu_en_news_news1_stet-2Dpsd2-2Dapi-2Dis-2Dnow-2Davailable.html&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=43ChkaJn0AI1162Dlg47a0yRs-exDmX5IjKRo10RsZ8&s=pyTgj5xuZ0AD3s770l7oKscOELvtX68LJtkcAhpLV90&e=</a>) also builds on [signHTTP].<span><br /><br /> AFAICT there is little else you can do if you want to be fully faithful to the REST philosophy since a request is qualified by Payload + Headers + Verb.<br /><br /> Due to the problems combining signatures and REST requests ("non-standard" as you say), as well as to REST's limited usability for interactive (bi-directional) Wallet communication, I "invented" a scheme called YASMIN:<br /></span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__cyberphone.github.io_doc_web_yasmin.html&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=43ChkaJn0AI1162Dlg47a0yRs-exDmX5IjKRo10RsZ8&s=5riJjr107NACSCT-xVxjYuL0VTUWIOMoPiOXmJuCtjo&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__cyberphone.github.io_doc_web_yasmin.html&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=43ChkaJn0AI1162Dlg47a0yRs-exDmX5IjKRo10RsZ8&s=5riJjr107NACSCT-xVxjYuL0VTUWIOMoPiOXmJuCtjo&e=</a><span><span><br /><br /> Anders<br /><br /></span></span>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">I have not incorporated the OBIE response ideas yet. If you guys are<br /> interested, please let me know so that I can send their comments<br /> privately.</blockquote>
<span><br /> _______________________________________________<br /> Openid-specs-fapi mailing list<br /><a href="mailto:Openid-specs-fapi@lists.openid.net">Openid-specs-fapi@lists.openid.net</a><br /></span><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dfapi&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=43ChkaJn0AI1162Dlg47a0yRs-exDmX5IjKRo10RsZ8&s=RsGWklKg4SMG8_KQR0ahMcV9gnDd-zQEMNDW-RArMhw&e=">https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dfapi&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=43ChkaJn0AI1162Dlg47a0yRs-exDmX5IjKRo10RsZ8&s=RsGWklKg4SMG8_KQR0ahMcV9gnDd-zQEMNDW-RArMhw&e=</a></blockquote>
</blockquote>
<div class="HOEnZb">
<div class="h5"><br /> _______________________________________________<br /> Openid-specs-fapi mailing list<br /><a href="mailto:Openid-specs-fapi@lists.openid.net">Openid-specs-fapi@lists.openid.net</a><br /><a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a></div>
</div>
</blockquote>
</div>
<br /><br clear="all" />
<div> </div>
-- <br />
<div class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div style="font-size: 1em; font-weight: bold; line-height: 1.4;">
<div style="color: #616161; font-size: 14px; font-weight: normal; line-height: 21px;">
<div style="font-family: Arial,Helvetica,sans-serif; font-size: 0.925em; line-height: 1.4; color: #dc291e; font-weight: bold;">
<div style="font-size: 14px; font-weight: normal; color: #333333; font-family: lato,'open sans',arial,sans-serif; line-height: normal;">
<div style="color: #00a4b7; font-weight: bold; font-size: 1em; line-height: 1.4;">Dave Tonge</div>
<div style="font-size: 0.8125em; line-height: 1.4;">CTO</div>
<div style="font-size: 0.8125em; line-height: 1.4; margin: 0px;"><a style="color: #835ea5; text-decoration: none;" href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A"><img style="border: none; padding: 0px; border-radius: 2px; margin: 7px;" title="Moneyhub Enterprise" src="./program/resources/blocked.gif" alt="Moneyhub Enterprise" width="200" height="50" /></a></div>
<div style="padding: 8px 0px;"><span style="color: #00a4b7; font-size: 11px; background-color: transparent;">10 Temple Back, Bristol, BS1 6FL</span></div>
<span style="font-size: 11px; line-height: 15.925px; color: #00a4b7; font-weight: bold;">t: </span><span style="font-size: 11px; line-height: 15.925px;">+44 (0)117 280 5120</span></div>
<div style="color: #616161; font-size: 14px; font-weight: normal; font-family: lato,'open sans',arial,sans-serif;"><span style="color: #00a4b7;"><span style="font-size: 11px; line-height: 15.925px;"><br /></span></span>
<div style="color: #333333; line-height: 1.4;"><span style="font-size: 0.75em;">Moneyhub Enterprise is a trading style of Momentum Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority ("FCA"). Momentum Financial Technology is entered on the Financial Services Register </span><span style="font-size: 0.75em; background-color: transparent;">(FRN </span><span style="font-size: 0.75em; background-color: transparent; color: #00a4b7; font-weight: bold;">561538</span><span style="font-size: 0.75em; background-color: transparent;">) at <a href="http://fca.org.uk/register">fca.org.uk/register</a>. Momentum Financial Technology is registered in England & Wales, company registration number </span><span style="font-size: 0.75em; color: #00a4b7; font-weight: bold; background-color: transparent;">06909772</span><span style="font-size: 0.75em; background-color: transparent;"> </span><span style="color: #222222; font-family: arial,sans-serif; background-color: transparent;"><span style="font-size: xx-small;">©</span></span><span style="font-size: 0.75em; background-color: transparent;"> . </span><span style="background-color: transparent; font-size: 0.75em;">Momentum Financial Technology Limited 2016. </span><span style="background-color: transparent; font-size: 0.75em; color: #888888;">DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Limited or of any other group company.</span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br />
<pre>_______________________________________________
Openid-specs-fapi mailing list
<a href="mailto:Openid-specs-fapi@lists.openid.net">Openid-specs-fapi@lists.openid.net</a>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a>
</pre>
</blockquote>
</body></html>