OAuth 2.0 Proof-of-Possession (PoP) Security Architecture
draft-hunt-oauth-pop-architecture-02
Document | Type |
Replaced Internet-Draft
(individual)
Expired & archived
|
|
---|---|---|---|
Authors | Phil Hunt , Justin Richer , William Mills , Prateek Mishra , Hannes Tschofenig | ||
Last updated | 2014-07-15 (Latest revision 2014-06-26) | ||
Replaced by | draft-ietf-oauth-pop-architecture | ||
RFC stream | Internet Engineering Task Force (IETF) | ||
Intended RFC status | Proposed Standard | ||
Formats | |||
Stream | WG state | Adopted by a WG | |
Document shepherd | (None) | ||
IESG | IESG state | Replaced by draft-ietf-oauth-pop-architecture | |
Consensus boilerplate | Unknown | ||
Telechat date | (None) | ||
Responsible AD | Kathleen Moriarty | ||
Send notices to | oauth-chairs@ietf.org |
This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:
Abstract
The OAuth 2.0 bearer token specification, as defined in RFC 6750, allows any party in possession of a bearer token (a "bearer") to get access to the associated resources (without demonstrating possession of a cryptographic key). To prevent misuse, bearer tokens must to be protected from disclosure in transit and at rest. Some scenarios demand additional security protection whereby a client needs to demonstrate possession of cryptographic keying material when accessing a protected resource. This document motivates the development of the OAuth 2.0 proof-of-possession security mechanism.
Authors
Phil Hunt
Justin Richer
William Mills
Prateek Mishra
Hannes Tschofenig
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)