< draft-ietf-oauth-pop-key-distribution-01.txt		draft-ietf-oauth-pop-key-distribution-02.txt >
	Network Working Group J. Bradley		Network Working Group J. Bradley
	Internet-Draft Ping Identity		Internet-Draft Ping Identity
	Intended status: Standards Track P. Hunt		Intended status: Standards Track P. Hunt
	Expires: September 6, 2015 Oracle Corporation		Expires: April 21, 2016 Oracle Corporation
	M. Jones		M. Jones
	Microsoft		Microsoft
	H. Tschofenig		H. Tschofenig
	ARM Limited		ARM Limited
	March 5, 2015		October 19, 2015
	OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key		OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key
	Distribution		Distribution
	draft-ietf-oauth-pop-key-distribution-01.txt		draft-ietf-oauth-pop-key-distribution-02.txt
	Abstract		Abstract
	RFC 6750 specified the bearer token concept for securing access to		RFC 6750 specified the bearer token concept for securing access to
	protected resources. Bearer tokens need to be protected in transit		protected resources. Bearer tokens need to be protected in transit
	as well as at rest. When a client requests access to a protected		as well as at rest. When a client requests access to a protected
	resource it hands-over the bearer token to the resource server.		resource it hands-over the bearer token to the resource server.
	The OAuth 2.0 Proof-of-Possession security concept extends bearer		The OAuth 2.0 Proof-of-Possession security concept extends bearer
	token security and requires the client to demonstrate possession of a		token security and requires the client to demonstrate possession of a
	skipping to change at page 1, line 46 ¶		skipping to change at page 1, line 46 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on September 6, 2015.		This Internet-Draft will expire on April 21, 2016.
	Copyright Notice		Copyright Notice
	Copyright (c) 2015 IETF Trust and the persons identified as the		Copyright (c) 2015 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 2, line 42 ¶		skipping to change at page 2, line 42 ¶
	5.2. Client-to-AS Response . . . . . . . . . . . . . . . . . . 11		5.2. Client-to-AS Response . . . . . . . . . . . . . . . . . . 11
	6. Token Types and Algorithms . . . . . . . . . . . . . . . . . 12		6. Token Types and Algorithms . . . . . . . . . . . . . . . . . 12
	7. Security Considerations . . . . . . . . . . . . . . . . . . . 13		7. Security Considerations . . . . . . . . . . . . . . . . . . . 13
	8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14		8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14
	9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 15		9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 15
	10. References . . . . . . . . . . . . . . . . . . . . . . . . . 15		10. References . . . . . . . . . . . . . . . . . . . . . . . . . 15
	10.1. Normative References . . . . . . . . . . . . . . . . . . 15		10.1. Normative References . . . . . . . . . . . . . . . . . . 15
	10.2. Informative References . . . . . . . . . . . . . . . . . 16		10.2. Informative References . . . . . . . . . . . . . . . . . 16
	Appendix A. Augmented Backus-Naur Form (ABNF) Syntax . . . . . . 17		Appendix A. Augmented Backus-Naur Form (ABNF) Syntax . . . . . . 17
	A.1. 'aud' Syntax . . . . . . . . . . . . . . . . . . . . . . 17		A.1. 'aud' Syntax . . . . . . . . . . . . . . . . . . . . . . 17
	A.2. 'key' Syntax . . . . . . . . . . . . . . . . . . . . . . 17		A.2. 'key' Syntax . . . . . . . . . . . . . . . . . . . . . . 18
	A.3. 'alg' Syntax . . . . . . . . . . . . . . . . . . . . . . 17		A.3. 'alg' Syntax . . . . . . . . . . . . . . . . . . . . . . 18
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 18		Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 18
	1. Introduction		1. Introduction
	The work on additional security mechanisms beyond OAuth 2.0 bearer		The work on additional security mechanisms beyond OAuth 2.0 bearer
	tokens [12] is motivated in [17], which also outlines use cases,		tokens [12] is motivated in [17], which also outlines use cases,
	requirements and an architecture. This document defines the ability		requirements and an architecture. This document defines the ability
	for the client indicate support for this functionality and to obtain		for the client indicate support for this functionality and to obtain
	keying material from the authorization server. As an outcome of the		keying material from the authorization server. As an outcome of the
	exchange between the client and the authorization server is an access		exchange between the client and the authorization server is an access
	skipping to change at page 15, line 43 ¶		skipping to change at page 15, line 43 ¶
	9. Acknowledgements		9. Acknowledgements
	We would like to thank Chuck Mortimore for his review comments.		We would like to thank Chuck Mortimore for his review comments.
	10. References		10. References
	10.1. Normative References		10.1. Normative References
	[1] Bradner, S., "Key words for use in RFCs to Indicate		[1] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, March 1997.		Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/
			RFC2119, March 1997,
			<http://www.rfc-editor.org/info/rfc2119>.
	[2] Hardt, D., "The OAuth 2.0 Authorization Framework", RFC		[2] Hardt, D., Ed., "The OAuth 2.0 Authorization Framework",
	6749, October 2012.		RFC 6749, DOI 10.17487/RFC6749, October 2012,
			<http://www.rfc-editor.org/info/rfc6749>.
	[3] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform		[3] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
	Resource Identifier (URI): Generic Syntax", STD 66, RFC		Resource Identifier (URI): Generic Syntax", STD 66, RFC
	3986, January 2005.		3986, DOI 10.17487/RFC3986, January 2005,
			<http://www.rfc-editor.org/info/rfc3986>.
	[4] Dierks, T. and E. Rescorla, "The Transport Layer Security		[4] Dierks, T. and E. Rescorla, "The Transport Layer Security
	(TLS) Protocol Version 1.2", RFC 5246, August 2008.		(TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/
			RFC5246, August 2008,
			<http://www.rfc-editor.org/info/rfc5246>.
	[5] Jones, M., "JSON Web Key (JWK)", draft-ietf-jose-json-web-		[5] Jones, M., "JSON Web Key (JWK)", RFC 7517, DOI 10.17487/
	key-41 (work in progress), January 2015.		RFC7517, May 2015,
			<http://www.rfc-editor.org/info/rfc7517>.
	[6] Jones, M., Bradley, J., and N. Sakimura, "JSON Web		[6] Jones, M., Bradley, J., and N. Sakimura, "JSON Web
	Signature (JWS)", draft-ietf-jose-json-web-signature-41		Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May
	(work in progress), January 2015.		2015, <http://www.rfc-editor.org/info/rfc7515>.
	[7] Jones, M., "JSON Web Algorithms (JWA)", draft-ietf-jose-		[7] Jones, M., "JSON Web Algorithms (JWA)", RFC 7518, DOI
	json-web-algorithms-40 (work in progress), January 2015.		10.17487/RFC7518, May 2015,
			<http://www.rfc-editor.org/info/rfc7518>.
	[8] Jones, M. and J. Hildebrand, "JSON Web Encryption (JWE)",		[8] Jones, M. and J. Hildebrand, "JSON Web Encryption (JWE)",
	draft-ietf-jose-json-web-encryption-40 (work in progress),		RFC 7516, DOI 10.17487/RFC7516, May 2015,
	January 2015.		<http://www.rfc-editor.org/info/rfc7516>.
	[9] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token		[9] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token
	(JWT)", draft-ietf-oauth-json-web-token-32 (work in		(JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015,
	progress), December 2014.		<http://www.rfc-editor.org/info/rfc7519>.
	[10] Jones, M., Bradley, J., and H. Tschofenig, "Proof-Of-		[10] Jones, M., Bradley, J., and H. Tschofenig, "Proof-of-
	Possession Semantics for JSON Web Tokens (JWTs)", draft-		Possession Key Semantics for JSON Web Tokens (JWTs)",
	jones-oauth-proof-of-possession-02 (work in progress),		draft-ietf-oauth-proof-of-possession-04 (work in
	July 2014.		progress), August 2015.
	[11] Jones, M., "JSON Web Key (JWK) Thumbprint", draft-jones-		[11] Jones, M. and N. Sakimura, "JSON Web Key (JWK)
	jose-jwk-thumbprint-01 (work in progress), July 2014.		Thumbprint", RFC 7638, DOI 10.17487/RFC7638, September
			2015, <http://www.rfc-editor.org/info/rfc7638>.
	10.2. Informative References		10.2. Informative References
	[12] Jones, M. and D. Hardt, "The OAuth 2.0 Authorization		[12] Jones, M. and D. Hardt, "The OAuth 2.0 Authorization
	Framework: Bearer Token Usage", RFC 6750, October 2012.		Framework: Bearer Token Usage", RFC 6750, DOI 10.17487/
			RFC6750, October 2012,
			<http://www.rfc-editor.org/info/rfc6750>.
	[13] Crocker, D. and P. Overell, "Augmented BNF for Syntax		[13] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
	Specifications: ABNF", STD 68, RFC 5234, January 2008.		Specifications: ABNF", STD 68, RFC 5234, DOI 10.17487/
			RFC5234, January 2008,
			<http://www.rfc-editor.org/info/rfc5234>.
	[14] Campbell, B., Mortimore, C., Jones, M., and Y. Goland,		[14] Campbell, B., Mortimore, C., Jones, M., and Y. Goland,
	"Assertion Framework for OAuth 2.0 Client Authentication		"Assertion Framework for OAuth 2.0 Client Authentication
	and Authorization Grants", draft-ietf-oauth-assertions-18		and Authorization Grants", RFC 7521, DOI 10.17487/RFC7521,
	(work in progress), October 2014.		May 2015, <http://www.rfc-editor.org/info/rfc7521>.
	[15] Sakimura, N., Bradley, J., and N. Agarwal, "OAuth		[15] Sakimura, N., Ed., Bradley, J., and N. Agarwal, "Proof Key
	Symmetric Proof of Posession for Code Extension", draft-		for Code Exchange by OAuth Public Clients", RFC 7636, DOI
	sakimura-oauth-tcse-03 (work in progress), April 2014.		10.17487/RFC7636, September 2015,
			<http://www.rfc-editor.org/info/rfc7636>.
	[16] ietf@justin.richer.org, i., Jones, M., Bradley, J.,		[16] Richer, J., Ed., Jones, M., Bradley, J., Machulak, M., and
	Machulak, M., and P. Hunt, "OAuth 2.0 Dynamic Client		P. Hunt, "OAuth 2.0 Dynamic Client Registration Protocol",
	Registration Protocol", draft-ietf-oauth-dyn-reg-24 (work		RFC 7591, DOI 10.17487/RFC7591, July 2015,
	in progress), February 2015.		<http://www.rfc-editor.org/info/rfc7591>.
	[17] Hunt, P., Richer, J., Mills, W., Mishra, P., and H.		[17] Hunt, P., Richer, J., Mills, W., Mishra, P., and H.
	Tschofenig, "OAuth 2.0 Proof-of-Possession (PoP) Security		Tschofenig, "OAuth 2.0 Proof-of-Possession (PoP) Security
	Architecture", draft-hunt-oauth-pop-architecture-02 (work		Architecture", draft-ietf-oauth-pop-architecture-03 (work
	in progress), June 2014.		in progress), September 2015.
	[18] Richer, J., "OAuth Token Introspection", draft-richer-		[18] Richer, J., "OAuth 2.0 Token Introspection", draft-ietf-
	oauth-introspection-06 (work in progress), July 2014.		oauth-introspection-11 (work in progress), July 2015.
	[19] Richer, J., Bradley, J., and H. Tschofenig, "A Method for		[19] Richer, J., Bradley, J., and H. Tschofenig, "A Method for
	Signing an HTTP Requests for OAuth", draft-richer-oauth-		Signing an HTTP Requests for OAuth", draft-ietf-oauth-
	signed-http-request-01 (work in progress), April 2014.		signed-http-request-01 (work in progress), March 2015.
	Appendix A. Augmented Backus-Naur Form (ABNF) Syntax		Appendix A. Augmented Backus-Naur Form (ABNF) Syntax
	This section provides Augmented Backus-Naur Form (ABNF) syntax		This section provides Augmented Backus-Naur Form (ABNF) syntax
	descriptions for the elements defined in this specification using the		descriptions for the elements defined in this specification using the
	notation of [13].		notation of [13].
	A.1. 'aud' Syntax		A.1. 'aud' Syntax
	The ABNF syntax is defined as follows where by the "URI-reference"		The ABNF syntax is defined as follows where by the "URI-reference"
End of changes. 24 change blocks.
	45 lines changed or deleted		59 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/