<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">This is a means of providing message integrity on top of other systems like TLS. You’re right that most systems won’t need it, in which case they just sign a nonce and send it over to get HoK characteristics. But I think we can have the same core mechanism used to also sign the HTTP request (or parts of it) if you want to. That’s the basic idea of re-using the JWT compact form with hashes generated from the HTTP request, we can combine a lot of stuff into a single mechanism. The issues brian points out are all very real and they need to be fixed before it’s really viable. I haven’t had time or motivation to push it forward yet, but I might have a chance to do that in the next couple months.<div class=""><br class=""><div class=""> — Justin</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Oct 21, 2015, at 11:28 AM, Nat Sakimura <<a href="mailto:sakimura@gmail.com" class="">sakimura@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class="">One of the question I would have is whether we need the integrity protection in this layer or just do the client authentication. As it is happening over TLS, just the client auth may be sufficient for many purposes. </div><div class="gmail_extra"><br class=""><div class="gmail_quote">2015-10-21 3:29 GMT+09:00 Brian Campbell <span dir="ltr" class=""><<a href="mailto:bcampbell@pingidentity.com" target="_blank" class="">bcampbell@pingidentity.com</a>></span>:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class=""><div class=""><br class=""></div>Yeah, that would be the one that maps to it but there are issues with it that need to be sorted out: <a href="http://www.ietf.org/mail-archive/web/oauth/current/msg14801.html" target="_blank" class="">http://www.ietf.org/mail-archive/web/oauth/current/msg14801.html</a><span class=""><br class=""><div class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Mon, Oct 19, 2015 at 6:17 PM, Nat Sakimura <span dir="ltr" class=""><<a href="mailto:sakimura@gmail.com" target="_blank" class="">sakimura@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br class=""><div dir="ltr" class=""><div class=""><br class=""><div class="">- Nat asked which draft was the HoK version of RFC6750. </div><div class=""> <a href="https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request" target="_blank" class="">https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request</a> </div><div class=""> seems to be the one that maps to it. </div><div class=""> </div><br class=""></div></div></blockquote></div></div></div></span></div>
</blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class="gmail_signature">Nat Sakimura (=nat)<div class="">Chairman, OpenID Foundation<br class=""><a href="http://nat.sakimura.org/" target="_blank" class="">http://nat.sakimura.org/</a><br class="">@_nat_en</div></div>
</div>
_______________________________________________<br class="">Openid-specs-ab mailing list<br class=""><a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab<br class=""></div></blockquote></div><br class=""></div></div></body></html>