<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks Brian,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I created <a href="https://bitbucket.org/openid/eap/pull-requests/3">
https://bitbucket.org/openid/eap/pull-requests/3</a> to do this. Please review.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Brian Campbell <bcampbell@pingidentity.com>
<br>
<b>Sent:</b> Tuesday, April 8, 2025 10:17 AM<br>
<b>To:</b> Michael Jones <michael_b_jones@hotmail.com><br>
<b>Cc:</b> Andrii Deinega <andrii.deinega@gmail.com>; Joni Brennan <jonibrennan@gmail.com>; leifj@sunet.se; openid-specs-eap@lists.openid.net<br>
<b>Subject:</b> Re: [OpenID-specs-EAP] WGLC for OpenID Connect EAP ACR Values spec<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">I'd think any security considerations need to say that the RP really needs to check that the received ACR meets its requirements. Relying on the content of the request and a successful response from the OP isn't sufficient in enough/most
cases so shouldn't ever be relied on. <o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, Apr 7, 2025 at 11:51<span style="font-family:"Arial",sans-serif"> </span>AM Michael Jones via Openid-specs-eap <<a href="mailto:openid-specs-eap@lists.openid.net">openid-specs-eap@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">I’ve created
<a href="https://bitbucket.org/openid/eap/pull-requests/2" target="_blank">https://bitbucket.org/openid/eap/pull-requests/2</a>, which adds Security Considerations on preventing downgrade attacks by using signed requests.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> -- Mike</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:currentcolor currentcolor">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-eap <<a href="mailto:openid-specs-eap-bounces@lists.openid.net" target="_blank">openid-specs-eap-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>Michael Jones via Openid-specs-eap<br>
<b>Sent:</b> Saturday, March 29, 2025 3:54 PM<br>
<b>To:</b> Andrii Deinega <<a href="mailto:andrii.deinega@gmail.com" target="_blank">andrii.deinega@gmail.com</a>><br>
<b>Cc:</b> Joni Brennan <<a href="mailto:jonibrennan@gmail.com" target="_blank">jonibrennan@gmail.com</a>>;
<a href="mailto:leifj@sunet.se" target="_blank">leifj@sunet.se</a>; <a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">
openid-specs-eap@lists.openid.net</a><br>
<b>Subject:</b> Re: [OpenID-specs-EAP] WGLC for OpenID Connect EAP ACR Values spec</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">We could add a reference to RFC 9191 in the Security Considerations, and in particular, cite the
<a href="https://www.rfc-editor.org/rfc/rfc9101.html#name-downgrade-attack" target="_blank">
Downgrade Attack</a> considerations. What do others think?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> -- Mike</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:currentcolor currentcolor">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Andrii Deinega <<a href="mailto:andrii.deinega@gmail.com" target="_blank">andrii.deinega@gmail.com</a>>
<br>
<b>Sent:</b> Thursday, March 27, 2025 3:13 PM<br>
<b>To:</b> Michael Jones <<a href="mailto:michael_b_jones@hotmail.com" target="_blank">michael_b_jones@hotmail.com</a>><br>
<b>Cc:</b> Joni Brennan <<a href="mailto:jonibrennan@gmail.com" target="_blank">jonibrennan@gmail.com</a>>;
<a href="mailto:leifj@sunet.se" target="_blank">leifj@sunet.se</a>; <a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">
openid-specs-eap@lists.openid.net</a>; Dean Saxe <<a href="mailto:dean.saxe@beyondidentity.com" target="_blank">dean.saxe@beyondidentity.com</a>><br>
<b>Subject:</b> Re: [OpenID-specs-EAP] WGLC for OpenID Connect EAP ACR Values spec</span><o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Mike, I’m curious whether the security considerations section in this spec should recommend passing request parameters (especially those that include acr_values) as
<a href="https://www.rfc-editor.org/rfc/rfc9101.html" target="_blank">JWT-Secured Authorization Requests (JAR)</a>, or as <a href="https://datatracker.ietf.org/doc/html/rfc9126" target="_blank">Pushed Authorization Requests (PAR)</a>.<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Otherwise, parameter acr_values could be removed without detection on an OP side.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">PARs and encrypted JARs also allow to hide from others what's specifically requested from an RP to an OP.<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">All the best,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Andrii<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Thu, Mar 27, 2025 at 7:53<span style="font-family:"Arial",sans-serif"> </span>AM Dean Saxe via Openid-specs-eap <<a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">openid-specs-eap@lists.openid.net</a>>
wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I support progressing this spec to final.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">-dhs<br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">--<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Dean H. Saxe,
<a href="https://idpro.org/cidpro/" target="_blank">CIDPRO</a> (he/him)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Principal Engineer<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Office of the CTO<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Beyond Identity<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="mailto:dean.saxe@beyondidentity.com" target="_blank">dean.saxe@beyondidentity.com</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Mar 25, 2025 at 5:49:29<span style="font-family:"Arial",sans-serif"> </span>PM, Michael Jones via Openid-specs-eap <<a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">openid-specs-eap@lists.openid.net</a>>
wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">This message starts a 2-week Working Group Last Call for the
<a href="https://openid.net/specs/openid-connect-eap-acr-values-1_0.html" target="_blank">
OpenID Connect Extended Authentication Profile (EAP) ACR Values 1.0</a> specification, prior to submitting it to Foundation-wide review for Final status. The Context Class values “</span><span style="font-size:11.0pt;font-family:"Courier New"">phr</span><span style="font-size:11.0pt">”
and “</span><span style="font-size:11.0pt;font-family:"Courier New"">phrh</span><span style="font-size:11.0pt">” are now registered in the IANA “Level of Assurance (LoA) Profiles” registry at
<a href="https://www.iana.org/assignments/loa-profiles/" target="_blank">https://www.iana.org/assignments/loa-profiles/</a>.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">The WGLC ends on Tuesday, April 8<sup>th</sup>. Please reply-all to this e-mail indicating whether you support progressing the specification to Final
status.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">After it becomes Final, we anticipate closing the
<a href="https://openid.net/wg/eap/" target="_blank">EAP working group</a>.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> Thanks,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> -- Mike</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:currentcolor currentcolor">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Michael Jones
<br>
<b>Sent:</b> Sunday, March 23, 2025 11:07 PM<br>
<b>To:</b> <a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">openid-specs-eap@lists.openid.net</a><br>
<b>Cc:</b> <a href="mailto:leifj@sunet.se" target="_blank">leifj@sunet.se</a>; Joni Brennan <<a href="mailto:jonibrennan@gmail.com" target="_blank">jonibrennan@gmail.com</a>>; John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>><br>
<b>Subject:</b> Context Class values added to OpenID EAP ACR Values spec</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">I’ve updated the
<a href="https://openid.net/specs/openid-connect-eap-acr-values-1_0.html" target="_blank">
OpenID Connect Extended Authentication Profile (EAP) ACR Values 1.0</a> specification to add the Context Class values needed to enable registration of the two ACR values indicating that phishing-resistant authentication or phishing-resistant-hardware-backed
authentication is being requested or has been performed. Thanks to Leif Johansson for explaining how to create the Context Class files. They can both be found at
<a href="https://bitbucket.org/openid/eap/src/master/" target="_blank">https://bitbucket.org/openid/eap/src/master/</a>.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">The IANA registrations have been requested – with tracking number [IANA #1415585].</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt">Once these registrations occur, unless working group members want other updates to the spec, we should be able to take the specification to Final
status.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> -- Mike</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">_______________________________________________<br>
Openid-specs-eap mailing list<br>
<a href="mailto:Openid-specs-eap@lists.openid.net" target="_blank">Openid-specs-eap@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-eap" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-eap</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">_______________________________________________<br>
Openid-specs-eap mailing list<br>
<a href="mailto:Openid-specs-eap@lists.openid.net" target="_blank">Openid-specs-eap@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-eap" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-eap</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-eap mailing list<br>
<a href="mailto:Openid-specs-eap@lists.openid.net" target="_blank">Openid-specs-eap@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-eap" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-eap</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<b><i><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#555555;border:none windowtext 1.0pt;padding:0in">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s).
Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</span></i></b><o:p></o:p></p>
</div>
</body>
</html>