<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Inline<div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 6, 2016, at 8:27 AM, GONZALO FERNANDEZ RODRIGUEZ <<a href="mailto:gonzalo.fernandezrodriguez@telefonica.com" class="">gonzalo.fernandezrodriguez@telefonica.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Hi John, </div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Comments in line…</div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Best,</div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Gonza.</div><span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div style="font-family: Calibri; font-size: 11pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);" class=""><span style="font-weight: bold;" class="">De:<span class="Apple-converted-space"> </span></span>John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" class="">ve7jtb@ve7jtb.com</a>><br class=""><span style="font-weight: bold;" class="">Fecha:<span class="Apple-converted-space"> </span></span>viernes, 5 de febrero de 2016, 17:27<br class=""><span style="font-weight: bold;" class="">Para:<span class="Apple-converted-space"> </span></span>"Lodderstedt, Torsten" <<a href="mailto:t.lodderstedt@telekom.de" class="">t.lodderstedt@telekom.de</a>><br class=""><span style="font-weight: bold;" class="">CC:<span class="Apple-converted-space"> </span></span>Gonzalo Fernandez Rodriguez <<a href="mailto:gonzalo.fernandezrodriguez@telefonica.com" class="">gonzalo.fernandezrodriguez@telefonica.com</a>>, "<a href="mailto:openid-specs-mobile-profile@lists.openid.net" class="">openid-specs-mobile-profile@lists.openid.net</a>" <<a href="mailto:openid-specs-mobile-profile@lists.openid.net" class="">openid-specs-mobile-profile@lists.openid.net</a>><br class=""><span style="font-weight: bold;" class="">Asunto:<span class="Apple-converted-space"> </span></span>Re: [Openid-specs-mobile-profile] Preliminary Minutes WG Call 27.1.2016<br class=""></div><div class=""><br class=""></div><div class=""><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Yes the problem is what if the authenticator requested is not available on the users device. <div class=""><br class=""></div><div class="">Do you really want to return an error or have the user use the closest authenticator they have and report what the user used to authenticate.</div></div></div></span><span style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""></span><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><font color="#0000ff" class="">[Gonzalo] —> I think the problem would be the same if the user doesn’t have any authenticator that matches with what you are specifying in the acr_values list. The difference in this case is that you specify in the list the authenticators. In case of the use wouldn’t have any of them, then an error should be returned.</font></div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div></div></blockquote>The default behaviour unless you are using the essential flag is to still authenticate the user with what they have and return that as the values You would not return an error by default. </div><div>Returning an error takes away the choice the RP/SP has of letting the user in at a lower level and continuing a dialog. The SP can say sorry you can’t access anything go back to your provider and get this sort of authenticator etc. If they get an error they don’t even know if the user has an account with that IdP so it is much harder to recover.</div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class=""><span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><br class=""></div><div class="">The SP almost never really wants a user turned away.</div><div class=""><br class=""></div><div class="">That might mean that for some operators requesting mod-mf will only be accepted if the SP is paying. </div></div></div></div></span><span style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""></span><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><font color="#0000ff" class="">[Gonzalo] —> Yes, you are right, this is the aim of business :-)</font></div><span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><br class=""></div><div class="">What we don’t want is every SP needing to code different logic for every IdP. </div><div class=""><br class=""></div><div class="">As for accepting the acr that is not part of the wire protocol. Nothing stops a IdP from having client specific rules about how they process acr. </div><div class=""><br class=""></div><div class="">If a client is not registered to send mod-mf then they only get mod-pr in the response. The user may have actually used multi-factor on the device if that is all that is installed, but the </div><div class="">IdP can always report a lower value.</div></div></div></div></span><span style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""></span><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><font color="#0000ff" class="">[Gonzalo] —> I don’t think it makes sense to have this behaviour. What business want is that if an SP asks for a kind of authentication which it is not paying for, it receives an error, or authenticate the user if there is another in the list which it is paying for or use a policy to do a default authentication.</font></div></div></blockquote><div><br class=""></div>The problem for clients/RP/SP is that operators will all have different policies around payment, returning errors is going to effect the user experience. </div><div>It is better to be consistent. If the client asks for mod-mf and the IdP only supports it with an extra charge, then you would let them through with a default mod-pr.</div><div><br class=""></div><div>Now it may be that we are missing a way of reporting back to the client that they need to do something if they want mod-mf honoured. </div><div><br class=""></div><div>Perhaps we need a new claim in the id-token with a pointer to a if you want mod-mf etc then you need to do x.</div><div><br class=""></div><div>A requested a pay service please upgrade message. </div><div><br class=""></div><div>This is the first time we have talked about pay services.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><br class=""></div><div class="">If the user only has a authenticator that uses a pin on the device you don’t want the IdP to return a error if the SP only requests mod-mf.</div></div></div></div></span><span style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""></span><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">[Gonzalo] —> Yes I agree, it is not a problem because you return a lower value and then the SP decides wether give access to the user or not. The </div><span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""><div class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On Feb 5, 2016, at 1:09 PM, Lodderstedt, Torsten <<a href="mailto:t.lodderstedt@telekom.de" class="">t.lodderstedt@telekom.de</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="color: rgb(31, 73, 125);">Hi Gonzalo,<o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="color: rgb(31, 73, 125);"><o:p class=""> </o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="" style="color: rgb(31, 73, 125);">please see my comments inline.<o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="" style="color: rgb(31, 73, 125);"><o:p class=""> </o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="color: rgb(31, 73, 125);">best regards,<o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="color: rgb(31, 73, 125);">Torsten.<o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="color: rgb(31, 73, 125);"><o:p class=""> </o:p></span></div><div class=""><div class="" style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0cm 0cm;"><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b class=""><span class="" style="font-size: 10pt; font-family: Tahoma, sans-serif;">Von:</span></b><span class="" style="font-size: 10pt; font-family: Tahoma, sans-serif;"><span class="Apple-converted-space"> </span>GONZALO FERNANDEZ RODRIGUEZ [<a href="mailto:gonzalo.fernandezrodriguez@telefonica.com" class="" style="color: purple; text-decoration: underline;">mailto:gonzalo.fernandezrodriguez@telefonica.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Gesendet:</b><span class="Apple-converted-space"> </span>Freitag, 29. Januar 2016 14:22<br class=""><b class="">An:</b><span class="Apple-converted-space"> </span>Lodderstedt, Torsten;<span class="Apple-converted-space"> </span><a href="mailto:openid-specs-mobile-profile@lists.openid.net" class="" style="color: purple; text-decoration: underline;">openid-specs-mobile-profile@lists.openid.net</a><br class=""><b class="">Betreff:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-mobile-profile] Preliminary Minutes WG Call 27.1.2016<o:p class=""></o:p></span></div></div></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p class=""> </o:p></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;">Hi guys,<o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;">In our last call we were talking about different use cases we could come across the the MODRNA Profile spec.<o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;">I have had some meetings with product business from Telefónica, and I would like to share with you some of these use cases that can have impact in the MODRNA profile spec.<o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b class=""><span class="" style="font-size: 10.5pt;">ABILITY TO CHOOSE THE SPECIFIC AUTHENTICATOR</span></b><span class="" style="font-size: 10.5pt;"><o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;">As per the conversations that I have had with Biz Product, they want to have the ability to charge different prices to the Service Providers dependant on the authenticator used to authenticate the user, so it iwould be necessary that the RP would have the chance to choose it in the authentication request. The current draft of the spec only allows to specify “mod-pr” and “mod-mf” to request phising-resistant and multi-factor authentication respectivey, without taking into account the final authenticator that will be used.<o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="color: rgb(31, 73, 125);"><o:p class=""> </o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="" style="color: rgb(31, 73, 125);">What ist he expected behavior, if the particular MNO does not support the specific authenticator or if the particular user is not in possession of the specific authenticator?<o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b class=""><span class="" style="font-size: 10.5pt;">CONTROL OF ALLOWED AUTHENTICATORS</span></b><span class="" style="font-size: 10.5pt;"><o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class=""><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;">Apart from having different prices according with the used authenticator, there is another feature that they want to have, and it consist in having a control of the authenticators that a Service Provider can use. They see a need to agree the authenticators to use during the Service Provider onboarding process, in such way if a Service Provider doesn’t hire an authenticator it must not be able to use it. In such case we would need an scope or something similar to do it otherwise we would need to implement something “ad-hoc”in the specific MC implementation that wants to offer this feature.<o:p class=""></o:p></span></div></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="" style="font-size: 10.5pt; color: rgb(31, 73, 125);">From what I understand, this could be part of the SP-specific client policy. So the MNO knows upfront which authenticators to use/offer for a certain SP. Why do you see a need for a specific scope value?</span><span lang="EN-US" class="" style="font-size: 10.5pt;"><o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;">Best,<o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;">Gonza.<o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class="" style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0cm 0cm;"><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b class=""><span class="">De:<span class="Apple-converted-space"> </span></span></b><span class=""><Lodderstedt>, Torsten <<a href="mailto:t.lodderstedt@telekom.de" class="" style="color: purple; text-decoration: underline;">t.lodderstedt@telekom.de</a>><br class=""><b class="">Fecha:<span class="Apple-converted-space"> </span></b>jueves, 28 de enero de 2016, 8:08<br class=""><b class="">Para:<span class="Apple-converted-space"> </span></b>"<a href="mailto:openid-specs-mobile-profile@lists.openid.net" class="" style="color: purple; text-decoration: underline;">openid-specs-mobile-profile@lists.openid.net</a>" <<a href="mailto:openid-specs-mobile-profile@lists.openid.net" class="" style="color: purple; text-decoration: underline;">openid-specs-mobile-profile@lists.openid.net</a>><br class=""><b class="">Asunto:<span class="Apple-converted-space"> </span></b>[Openid-specs-mobile-profile] Preliminary Minutes WG Call 27.1.2016<o:p class=""></o:p></span></div></div><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div></div><div class=""><div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="">Hi all,<o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class=""> <o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">please find below the minutes of today’s call.</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class=""> </span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">best regards,</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Torsten.</span><span class=""><o:p class=""></o:p></span></div><div class="" style="border-style: none none solid; border-bottom-color: windowtext; border-bottom-width: 1pt; padding: 0cm 0cm 1pt;"><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class=""> </span><span class=""><o:p class=""></o:p></span></div></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class=""> </span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Participants:</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">John Bradley</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Nat Sakimura</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Florian Walter</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Jörg Connotte</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Gonzalo Fernandéz</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Matthieu Verdier</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Bjorn Hjelm</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Torsten Lodderstedt</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class=""> </span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Authentication spec</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- John guided us through the changes he made in the last revision</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- The following topics were discussed:</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">* ACR Values: examples for security keys and difference between keys and pwd/pin shall be added</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">* AMR values: add example for amr values (e.g SIM Applet+PIN is represented by “hpop” + “pin”)</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">* short and long form of ACRs: the short shall be used by clients, long form will be used to register the ACR values in the IANA registry (by MODRNA WG)</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">* order of acrs gives RP a way to express its preferences regarding authentication, i.e. bring ARC values in their preferred order</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">* we stay with two acr values for now, we could add the third (or a forth) value at any time based on experiences/discussions</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- how to handle TBDs</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- 6.1. replace by reference to respective OpenID Connect Discovery</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- 7 length of the binding message – replace by better explanation: message may be truncated</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- Mitigations for new security vulnerabilities</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- discussed different options</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">* copy text from oauth spec</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">* reference current oauth spec</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">* recommend to use “code id_token” instead of “code”</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">* general problem: discussions within OAuth WG are ongoing and outcome cannot really be predicted.</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">-> Conclusion: will pass spec to GSMA as is and discuss vulnerabilities and way forward with GSMA</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class=""> </span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">MWC</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- John, Torsten will attend</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- Nat will probably attend as well (as he will be in Paris at that time)</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- Gonzalo & Matthieu would attend if we setup a meeting regarding MODRNA</span><span class=""><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">- Torsten will talk to GSMA</span><span class=""><o:p class=""></o:p></span></div></div></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 10.5pt;"><o:p class=""> </o:p></span></div><div class="MsoNormal" align="center" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; text-align: center;"><span class="" style="font-size: 10.5pt;"><hr size="2" width="100%" align="center" class=""></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 7.5pt; font-family: Arial, sans-serif; color: gray;"><br class="">Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.<br class=""><br class="">The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.<br class=""><br class="">Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição</span><span class="" style="font-size: 10.5pt;"><o:p class=""></o:p></span></div></div><span class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">_______________________________________________</span><br class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">Openid-specs-mobile-profile mailing list</span><br class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><a href="mailto:Openid-specs-mobile-profile@lists.openid.net" class="" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Openid-specs-mobile-profile@lists.openid.net</a><br class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><a href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile" class="" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</a><br class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"></div></blockquote></div><br class=""></div></div></div></div></div></span><br style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><hr style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><font face="Arial" color="Gray" size="1" style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class="">Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.<br class=""><br class="">The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.<br class=""><br class="">Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição</font></div></blockquote></div><br class=""></div></body></html>