[OAUTH-WG] RSA signing and web delegation

[Brian Eaton <beaton at google.com>]

I spent a bit of time today wondering how to integrate RSA signing in
OAuth (which has obvious key distribution advantages) with requests
that only send access tokens (which has obvious usability advantages).

The only way I can think of to resolve these conflicts goes like this:

1) Initial requests for user approval (using the web delegation flow)
are signed using RSA.

2) Data requests are either not signed, or are signed only with the
token secret using HMAC.

3) Requests to renew access tokens (if we adopt something like the
scalable OAuth extension) are again signed using RSA.

Thoughts?

Cheers,
Brian