<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta content="text/html; charset=utf-8">
</head>
<body>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
Make it so!</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Brian Campbell <bcampbell@pingidentity.com><br>
<b>Sent:</b> Friday, May 11, 2018 2:51:44 PM<br>
<b>To:</b> Mike Jones<br>
<b>Cc:</b> openid-specs-eap@lists.openid.net<br>
<b>Subject:</b> Re: [OpenID-specs-EAP] No call today and IESG Token Binding review results</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>
<div>That is good news. Thanks for the update, Mike. <br>
<br>
</div>
There are two smallish changes to the Connect Token Binding draft that I'd like to see before going to Implementer’s Draft:<br>
<br>
</div>
1) Be explicit that the "tbh" value doesn't include any trailing pad characters '=' or any line breaks/whitespace. This is sort of assumed now but isn't explicitly stated so there is some ambiguity. And different interpretations could result in interop problems
if the "tbh" check is done as a string comparison. <br>
<br>
<div>
<div>
<div>
<div>2) As discussed on the April 18th call, adjust the metadata to advertise supported confirmation method hash algorithms. "tbh" will still be the only one that's defined but allowing metadata to convey the alg(s) will better position the spec with respect
to algorithm agility in the future. <br>
<br>
</div>
<div>I'll work up a pull request or two in the nearish future that capture those changes.
<br>
<br>
<br>
<br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, May 10, 2018 at 9:05 AM, Mike Jones via Openid-specs-eap
<span dir="ltr"><<a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">openid-specs-eap@lists.openid.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div lang="EN-US">
<div class="m_-4758751556618026580WordSection1">
<p class="MsoNormal">John and I don’t feel that there’s a need for the EAP call today.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The good news is that the DISCUSSes on the IETF Token Binding specs that might have resulted in protocol changes were cleared. Additional editorial changes will be made to clarify some points. After that, they should be approved to go
to the RFC Editor.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Therefore, we should plan to at least get to an Implementer’s Draft of the Connect Token Binding draft shortly.<span class="HOEnZb"><font color="#888888"><u></u><u></u></font></span></p>
<span class="HOEnZb"><font color="#888888">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> <wbr> -- Mike<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</font></span></div>
</div>
<br>
______________________________<wbr>_________________<br>
Openid-specs-eap mailing list<br>
<a href="mailto:Openid-specs-eap@lists.openid.net">Openid-specs-eap@lists.openid.<wbr>net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-eap" rel="noreferrer" target="_blank">http://lists.openid.net/<wbr>mailman/listinfo/openid-specs-<wbr>eap</a><br>
<br>
</blockquote>
</div>
<br>
</div>
<br>
<i style="margin:0px; padding:0px; border:0px; outline:0px; vertical-align:baseline; background:rgb(255,255,255); color:rgb(85,85,85)"><span style="margin:0px; padding:0px; border:0px; outline:0px; vertical-align:baseline; background:transparent; font-weight:600"><font size="2">CONFIDENTIALITY
NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify
the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</font></span></i></div>
</body>
</html>