<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Spec call notes 12-Jan-12<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">John Bradley<o:p></o:p></p>
<p class="MsoNormal">Mike Jones<o:p></o:p></p>
<p class="MsoNormal">Nat Sakimura<o:p></o:p></p>
<p class="MsoNormal">Edmund Jay<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Agenda:<o:p></o:p></p>
<p class="MsoNormal"> Open Issues<o:p></o:p></p>
<p class="MsoNormal"> Token Linking Issue<o:p></o:p></p>
<p class="MsoNormal"> Encryption<o:p></o:p></p>
<p class="MsoNormal"> Events<o:p></o:p></p>
<p class="MsoNormal"> Updating the openid.net/connect page<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Open Issues:<o:p></o:p></p>
<p class="MsoNormal"> #506 - Assigned to John for review and change<o:p></o:p></p>
<p class="MsoNormal"> #507 - Invalid - John will add rationale in the comments<o:p></o:p></p>
<p class="MsoNormal"> #505 - John still needs to write proposed language<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Token Linking Issue:<o:p></o:p></p>
<p class="MsoNormal"> Breno sent a proposal that's close enough to complete to be actionable<o:p></o:p></p>
<p class="MsoNormal"> Describes adding a hash of the Access Token to the ID Token<o:p></o:p></p>
<p class="MsoNormal"> John believes it only solves a problem for the implicit (token) flow<o:p></o:p></p>
<p class="MsoNormal"> We discussed that, if added, this functionality could be either RECOMMENDED or OPTIONAL<o:p></o:p></p>
<p class="MsoNormal"> John believes that we may want to require this for the implicit flow<o:p></o:p></p>
<p class="MsoNormal"> John believes it should be the RP who decides if this is important<o:p></o:p></p>
<p class="MsoNormal"> This lets RPs detect Access Token tampering in the implicit flow<o:p></o:p></p>
<p class="MsoNormal"> In a sense, this is an audience restriction of the Access Token with the implicit flow<o:p></o:p></p>
<p class="MsoNormal"> Mike stated that we should evaluate this based upon specific language<o:p></o:p></p>
<p class="MsoNormal"> John will write up proposed language for review (after doing the edits for his other issues)<o:p></o:p></p>
<p class="MsoNormal" align="right" style="text-align:right"><o:p> </o:p></p>
<p class="MsoNormal">Encryption:<o:p></o:p></p>
<p class="MsoNormal"> Breno wants encryption with integrity using CBC<o:p></o:p></p>
<p class="MsoNormal"> John believes we should reinstate the integrity proposal from JSMS for CBC<o:p></o:p></p>
<p class="MsoNormal"> At least as an option<o:p></o:p></p>
<p class="MsoNormal"> NIST recommends wrapping the symmetric key to avoid using the same key repeatedly for many messages<o:p></o:p></p>
<p class="MsoNormal"> Do we use a KDF or use the same key for encryption and HMAC?<o:p></o:p></p>
<p class="MsoNormal"> Mike pointed out that a different key may be necessary for elliptic curve<o:p></o:p></p>
<p class="MsoNormal"> John pointed out that integrity and encryption key sizes may different anyway, requiring KDF<o:p></o:p></p>
<p class="MsoNormal"> If we want the smallest number of options, always use a KDF and always use a content master key<o:p></o:p></p>
<p class="MsoNormal"> If using GCM, you'd only get one key from the KDF<o:p></o:p></p>
<p class="MsoNormal"> Question of encrypting to multiple recipients is also on the table<o:p></o:p></p>
<p class="MsoNormal"> John believes there are legitimate cases for multiple parties decrypting a security token<o:p></o:p></p>
<p class="MsoNormal"> Including the RP and Check ID Endpoint for an ID Token<o:p></o:p></p>
<p class="MsoNormal"> Including STS token transforms<o:p></o:p></p>
<p class="MsoNormal"> Self-issued tokens may also require multiple recipients<o:p></o:p></p>
<p class="MsoNormal"> We need to develop a concrete proposal including syntax and which options to and not support<o:p></o:p></p>
<p class="MsoNormal"> If not before, we should try to develop a concrete proposal at RSA<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Events:<o:p></o:p></p>
<p class="MsoNormal"> John pinged Don about announcing and planning an interop event for RSA<o:p></o:p></p>
<p class="MsoNormal"> Time is short to organize this<o:p></o:p></p>
<p class="MsoNormal"> Mike suggested we also send a note to the interop list now to get people thinking about it<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Interop:<o:p></o:p></p>
<p class="MsoNormal"> We should be testing Discovery and Registration<o:p></o:p></p>
<p class="MsoNormal"> We should be testing asymmetric signatures<o:p></o:p></p>
<p class="MsoNormal"> We should be testing using the request object<o:p></o:p></p>
<p class="MsoNormal"> We should be testing native client apps<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Spec Review Feedback Received:<o:p></o:p></p>
<p class="MsoNormal"> Breno plans to review the present specs during the present review period<o:p></o:p></p>
<p class="MsoNormal"> Mike gave the WG a heads-up that Yaron sent several pages of feedback<o:p></o:p></p>
<p class="MsoNormal"> In particular, Yaron believes that Issuers must be able to include a path<o:p></o:p></p>
<p class="MsoNormal"> Mike will come back to discuss this once he has a specific proposal<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Events:<o:p></o:p></p>
<p class="MsoNormal"> John spoke with Don about an interop event at RSA<o:p></o:p></p>
<p class="MsoNormal"> Don will communicate to the board that we want to do that<o:p></o:p></p>
<p class="MsoNormal"> We need to find a sponsor that can provide space<o:p></o:p></p>
<p class="MsoNormal"> John also gave the other list of proposed events to Don<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Updating the openid.net/connect page:<o:p></o:p></p>
<p class="MsoNormal"> It doesn't currently mention the implementer's draft review<o:p></o:p></p>
<p class="MsoNormal"> There are other ways it is probably out of date<o:p></o:p></p>
<p class="MsoNormal"> Nat will look at it<o:p></o:p></p>
<p class="MsoNormal"> Pam should be updating the diagram to add the OAuth JWT Profile and the Multiple Response Types<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Misc:<o:p></o:p></p>
<p class="MsoNormal"> John pointed out that we should track the "Why aren't we using WebFinger?" issue<o:p></o:p></p>
<p class="MsoNormal"> We should have a concise response document<o:p></o:p></p>
<p class="MsoNormal"> We will do that as other work and priorities allow<o:p></o:p></p>
<p class="MsoNormal"> BrowserID issue<o:p></o:p></p>
<p class="MsoNormal"> Don and Tony are discussing this in person today<o:p></o:p></p>
<p class="MsoNormal"> Hopefully this will empower Don to write a response and speak publicly<o:p></o:p></p>
<p class="MsoNormal"> Nat may repeat some of his previous comments from July for current consumption<o:p></o:p></p>
</div>
</body>
</html>