< draft-ietf-oauth-pop-key-distribution-02.txt		draft-ietf-oauth-pop-key-distribution-03.txt >
	Network Working Group J. Bradley		Network Working Group J. Bradley
	Internet-Draft Ping Identity		Internet-Draft Ping Identity
	Intended status: Standards Track P. Hunt		Intended status: Standards Track P. Hunt
	Expires: April 21, 2016 Oracle Corporation		Expires: August 28, 2017 Oracle Corporation
	M. Jones		M. Jones
	Microsoft		Microsoft
	H. Tschofenig		H. Tschofenig
	ARM Limited		ARM Limited
	October 19, 2015		February 24, 2017
	OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key		OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key
	Distribution		Distribution
	draft-ietf-oauth-pop-key-distribution-02.txt		draft-ietf-oauth-pop-key-distribution-03
	Abstract		Abstract
	RFC 6750 specified the bearer token concept for securing access to		RFC 6750 specified the bearer token concept for securing access to
	protected resources. Bearer tokens need to be protected in transit		protected resources. Bearer tokens need to be protected in transit
	as well as at rest. When a client requests access to a protected		as well as at rest. When a client requests access to a protected
	resource it hands-over the bearer token to the resource server.		resource it hands-over the bearer token to the resource server.
	The OAuth 2.0 Proof-of-Possession security concept extends bearer		The OAuth 2.0 Proof-of-Possession security concept extends bearer
	token security and requires the client to demonstrate possession of a		token security and requires the client to demonstrate possession of a
	skipping to change at page 1, line 46 ¶		skipping to change at page 1, line 46 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on April 21, 2016.		This Internet-Draft will expire on August 28, 2017.
	Copyright Notice		Copyright Notice
	Copyright (c) 2015 IETF Trust and the persons identified as the		Copyright (c) 2017 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	carefully, as they describe your rights and restrictions with respect		carefully, as they describe your rights and restrictions with respect
	to this document. Code Components extracted from this document must		to this document. Code Components extracted from this document must
	include Simplified BSD License text as described in Section 4.e of		include Simplified BSD License text as described in Section 4.e of
	the Trust Legal Provisions and are provided without warranty as		the Trust Legal Provisions and are provided without warranty as
	skipping to change at page 15, line 43 ¶		skipping to change at page 15, line 43 ¶
	9. Acknowledgements		9. Acknowledgements
	We would like to thank Chuck Mortimore for his review comments.		We would like to thank Chuck Mortimore for his review comments.
	10. References		10. References
	10.1. Normative References		10.1. Normative References
	[1] Bradner, S., "Key words for use in RFCs to Indicate		[1] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/		Requirement Levels", BCP 14, RFC 2119,
	RFC2119, March 1997,		DOI 10.17487/RFC2119, March 1997,
	<http://www.rfc-editor.org/info/rfc2119>.		<http://www.rfc-editor.org/info/rfc2119>.
	[2] Hardt, D., Ed., "The OAuth 2.0 Authorization Framework",		[2] Hardt, D., Ed., "The OAuth 2.0 Authorization Framework",
	RFC 6749, DOI 10.17487/RFC6749, October 2012,		RFC 6749, DOI 10.17487/RFC6749, October 2012,
	<http://www.rfc-editor.org/info/rfc6749>.		<http://www.rfc-editor.org/info/rfc6749>.
	[3] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform		[3] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
	Resource Identifier (URI): Generic Syntax", STD 66, RFC		Resource Identifier (URI): Generic Syntax", STD 66,
	3986, DOI 10.17487/RFC3986, January 2005,		RFC 3986, DOI 10.17487/RFC3986, January 2005,
	<http://www.rfc-editor.org/info/rfc3986>.		<http://www.rfc-editor.org/info/rfc3986>.
	[4] Dierks, T. and E. Rescorla, "The Transport Layer Security		[4] Dierks, T. and E. Rescorla, "The Transport Layer Security
	(TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/		(TLS) Protocol Version 1.2", RFC 5246,
	RFC5246, August 2008,		DOI 10.17487/RFC5246, August 2008,
	<http://www.rfc-editor.org/info/rfc5246>.		<http://www.rfc-editor.org/info/rfc5246>.
	[5] Jones, M., "JSON Web Key (JWK)", RFC 7517, DOI 10.17487/		[5] Jones, M., "JSON Web Key (JWK)", RFC 7517,
	RFC7517, May 2015,		DOI 10.17487/RFC7517, May 2015,
	<http://www.rfc-editor.org/info/rfc7517>.		<http://www.rfc-editor.org/info/rfc7517>.
	[6] Jones, M., Bradley, J., and N. Sakimura, "JSON Web		[6] Jones, M., Bradley, J., and N. Sakimura, "JSON Web
	Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May		Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May
	2015, <http://www.rfc-editor.org/info/rfc7515>.		2015, <http://www.rfc-editor.org/info/rfc7515>.
	[7] Jones, M., "JSON Web Algorithms (JWA)", RFC 7518, DOI		[7] Jones, M., "JSON Web Algorithms (JWA)", RFC 7518,
	10.17487/RFC7518, May 2015,		DOI 10.17487/RFC7518, May 2015,
	<http://www.rfc-editor.org/info/rfc7518>.		<http://www.rfc-editor.org/info/rfc7518>.
	[8] Jones, M. and J. Hildebrand, "JSON Web Encryption (JWE)",		[8] Jones, M. and J. Hildebrand, "JSON Web Encryption (JWE)",
	RFC 7516, DOI 10.17487/RFC7516, May 2015,		RFC 7516, DOI 10.17487/RFC7516, May 2015,
	<http://www.rfc-editor.org/info/rfc7516>.		<http://www.rfc-editor.org/info/rfc7516>.
	[9] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token		[9] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token
	(JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015,		(JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015,
	<http://www.rfc-editor.org/info/rfc7519>.		<http://www.rfc-editor.org/info/rfc7519>.
	[10] Jones, M., Bradley, J., and H. Tschofenig, "Proof-of-		[10] Jones, M., Bradley, J., and H. Tschofenig, "Proof-of-
	Possession Key Semantics for JSON Web Tokens (JWTs)",		Possession Key Semantics for JSON Web Tokens (JWTs)",
	draft-ietf-oauth-proof-of-possession-04 (work in		RFC 7800, DOI 10.17487/RFC7800, April 2016,
	progress), August 2015.		<http://www.rfc-editor.org/info/rfc7800>.
	[11] Jones, M. and N. Sakimura, "JSON Web Key (JWK)		[11] Jones, M. and N. Sakimura, "JSON Web Key (JWK)
	Thumbprint", RFC 7638, DOI 10.17487/RFC7638, September		Thumbprint", RFC 7638, DOI 10.17487/RFC7638, September
	2015, <http://www.rfc-editor.org/info/rfc7638>.		2015, <http://www.rfc-editor.org/info/rfc7638>.
	10.2. Informative References		10.2. Informative References
	[12] Jones, M. and D. Hardt, "The OAuth 2.0 Authorization		[12] Jones, M. and D. Hardt, "The OAuth 2.0 Authorization
	Framework: Bearer Token Usage", RFC 6750, DOI 10.17487/		Framework: Bearer Token Usage", RFC 6750,
	RFC6750, October 2012,		DOI 10.17487/RFC6750, October 2012,
	<http://www.rfc-editor.org/info/rfc6750>.		<http://www.rfc-editor.org/info/rfc6750>.
	[13] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax		[13] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
	Specifications: ABNF", STD 68, RFC 5234, DOI 10.17487/		Specifications: ABNF", STD 68, RFC 5234,
	RFC5234, January 2008,		DOI 10.17487/RFC5234, January 2008,
	<http://www.rfc-editor.org/info/rfc5234>.		<http://www.rfc-editor.org/info/rfc5234>.
	[14] Campbell, B., Mortimore, C., Jones, M., and Y. Goland,		[14] Campbell, B., Mortimore, C., Jones, M., and Y. Goland,
	"Assertion Framework for OAuth 2.0 Client Authentication		"Assertion Framework for OAuth 2.0 Client Authentication
	and Authorization Grants", RFC 7521, DOI 10.17487/RFC7521,		and Authorization Grants", RFC 7521, DOI 10.17487/RFC7521,
	May 2015, <http://www.rfc-editor.org/info/rfc7521>.		May 2015, <http://www.rfc-editor.org/info/rfc7521>.
	[15] Sakimura, N., Ed., Bradley, J., and N. Agarwal, "Proof Key		[15] Sakimura, N., Ed., Bradley, J., and N. Agarwal, "Proof Key
	for Code Exchange by OAuth Public Clients", RFC 7636, DOI		for Code Exchange by OAuth Public Clients", RFC 7636,
	10.17487/RFC7636, September 2015,		DOI 10.17487/RFC7636, September 2015,
	<http://www.rfc-editor.org/info/rfc7636>.		<http://www.rfc-editor.org/info/rfc7636>.
	[16] Richer, J., Ed., Jones, M., Bradley, J., Machulak, M., and		[16] Richer, J., Ed., Jones, M., Bradley, J., Machulak, M., and
	P. Hunt, "OAuth 2.0 Dynamic Client Registration Protocol",		P. Hunt, "OAuth 2.0 Dynamic Client Registration Protocol",
	RFC 7591, DOI 10.17487/RFC7591, July 2015,		RFC 7591, DOI 10.17487/RFC7591, July 2015,
	<http://www.rfc-editor.org/info/rfc7591>.		<http://www.rfc-editor.org/info/rfc7591>.
	[17] Hunt, P., Richer, J., Mills, W., Mishra, P., and H.		[17] Hunt, P., Richer, J., Mills, W., Mishra, P., and H.
	Tschofenig, "OAuth 2.0 Proof-of-Possession (PoP) Security		Tschofenig, "OAuth 2.0 Proof-of-Possession (PoP) Security
	Architecture", draft-ietf-oauth-pop-architecture-03 (work		Architecture", draft-ietf-oauth-pop-architecture-08 (work
	in progress), September 2015.		in progress), July 2016.
	[18] Richer, J., "OAuth 2.0 Token Introspection", draft-ietf-		[18] Richer, J., Ed., "OAuth 2.0 Token Introspection",
	oauth-introspection-11 (work in progress), July 2015.		RFC 7662, DOI 10.17487/RFC7662, October 2015,
			<http://www.rfc-editor.org/info/rfc7662>.
	[19] Richer, J., Bradley, J., and H. Tschofenig, "A Method for		[19] Richer, J., Bradley, J., and H. Tschofenig, "A Method for
	Signing an HTTP Requests for OAuth", draft-ietf-oauth-		Signing HTTP Requests for OAuth", draft-ietf-oauth-signed-
	signed-http-request-01 (work in progress), March 2015.		http-request-03 (work in progress), August 2016.
	Appendix A. Augmented Backus-Naur Form (ABNF) Syntax		Appendix A. Augmented Backus-Naur Form (ABNF) Syntax
	This section provides Augmented Backus-Naur Form (ABNF) syntax		This section provides Augmented Backus-Naur Form (ABNF) syntax
	descriptions for the elements defined in this specification using the		descriptions for the elements defined in this specification using the
	notation of [13].		notation of [13].
	A.1. 'aud' Syntax		A.1. 'aud' Syntax
	The ABNF syntax is defined as follows where by the "URI-reference"		The ABNF syntax is defined as follows where by the "URI-reference"
End of changes. 17 change blocks.
	29 lines changed or deleted		30 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/