<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I agree, the problem is that m is that section might be taken to read that all login_token_hint values need to be in that format. It needs to be clear that we are only talking about the format from the discovery service to the IdP.<div class=""><br class=""></div><div class="">John B.<br class=""><div><blockquote type="cite" class=""><div class="">On Nov 30, 2015, at 5:23 AM, Lodderstedt, Torsten <<a href="mailto:t.lodderstedt@telekom.de" class="">t.lodderstedt@telekom.de</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Hi John,<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">login_token_hint is needed in the discovery case. There is no need to force any structure to the hint from account chooser. I would prefer to leave it opaque and specify another authentication request parameter.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">best regards,<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Torsten.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 10pt; font-family: Tahoma, sans-serif;" class="">Von:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;" class=""><span class="Apple-converted-space"> </span>Openid-specs-mobile-profile [<a href="mailto:openid-specs-mobile-profile-bounces@lists.openid.net" class="">mailto:openid-specs-mobile-profile-bounces@lists.openid.net</a>]<span class="Apple-converted-space"> </span><b class="">Im Auftrag von<span class="Apple-converted-space"> </span></b>John Bradley<br class=""><b class="">Gesendet:</b><span class="Apple-converted-space"> </span>Sonntag, 29. November 2015 21:10<br class=""><b class="">An:</b><span class="Apple-converted-space"> </span>Torsten Lodderstedt<br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-mobile-profile@lists.openid.net" class="">openid-specs-mobile-profile@lists.openid.net</a><br class=""><b class="">Betreff:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-mobile-profile] Comments on draft-mobile-authentication-1<o:p class=""></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">No by policy I was referring to the GSMA privacy policy requiring the use of a discovery service rather than clients just asking for the users phone number directly.<o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I was thinking asymmetric from the discovery service to the IdP. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">But give the IdP the flexibility on how they protect the tokens they put in account chooser for themselves. Those could be symmetric.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">So saying they must be signed and encrypted is probably the correct thing for the discovery service but not all tokens come from the discovery service.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">John B.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Nov 29, 2015, at 4:52 PM, Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net" style="color: purple; text-decoration: underline;" class="">torsten@lodderstedt.net</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">If it is a policy decision, do we need to specify some way for the client to discover the OP's respective policy?<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Regarding integrity protection: wouldn't that require a shared secret between discovery service and op? Not as easy to manage as an issuer url.<o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Am 29.11.2015 19:38 schrieb John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" style="color: purple; text-decoration: underline;" class="">ve7jtb@ve7jtb.com</a>>:<o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">For login_hint_token, The main reason to sign it is so that RP don’t start prompting users for phone numbers and creating there own tokens. <o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I can’t think of any security reason. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">For an example of a signed and encrypted JWT see : <a href="https://tools.ietf.org/html/rfc7519#page-26" style="color: purple; text-decoration: underline;" class="">https://tools.ietf.org/html/rfc7519#page-26</a> A.2.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">It is more of a policy decision than a technical one to require signing. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">We could require integrity protection instead. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">That would let the discovery service sign and then encrypt. The IdP could use a symmetric key to encrypt , and get sender verification in one operation. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">John B.<o:p class=""></o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Nov 29, 2015, at 3:19 PM, Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net" style="color: purple; text-decoration: underline;" class="">torsten@lodderstedt.net</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; background-color: white;" class="">Hi Jörg,</span><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class=""><br class=""><span style="background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">thanks for producing a new revision, which covers context and login_token_hint (@all: it's published at </span></span><a href="https://bitbucket.org/openid/mobile/raw/default/draft-mobile-authentication-01.txt" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">https://bitbucket.org/openid/mobile/raw/default/draft-mobile-authentication-01.txt</span></a><span style="font-size: 9pt; font-family: Helvetica, sans-serif; background-color: white;" class="">).</span><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class=""><br class=""><span style="background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">Please find attached my comments as well as proposed text for security/privacy considerations sections and other aspects. </span><br class=""><br class=""><span style="background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">I would like to bring one question to the group's attention: Do we want to require the login_token_hint to be signed? What is the main reason? Issuer authenticity?</span><br class=""><br class=""><span style="background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">best regards,</span><br class=""><span style="background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">Torsten.</span><br class=""></span><draft-mobile-authentication-01_tlt.docx><span style="font-size: 9pt; font-family: Helvetica, sans-serif; background-color: white;" class="">_______________________________________________</span><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class=""><span style="background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">Openid-specs-mobile-profile mailing list</span><br class=""></span><a href="mailto:Openid-specs-mobile-profile@lists.openid.net" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">Openid-specs-mobile-profile@lists.openid.net</span></a><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class=""></span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; background-color: white;" class="">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</span></a></div></div></blockquote></div></div></div></div></div></blockquote></div></div></div></div></blockquote></div><br class=""></div></body></html>