Skip to main content

OAuth 2.0 Proof-of-Possession (PoP) Security Architecture
draft-ietf-oauth-pop-architecture-07

The information below is for an old version of the document.
Document Type
This is an older version of an Internet-Draft whose latest revision state is "Expired".
Expired & archived
Authors Phil Hunt , Justin Richer , William Mills , Prateek Mishra , Hannes Tschofenig
Last updated 2016-06-03 (Latest revision 2015-12-01)
Replaces draft-hunt-oauth-pop-architecture
RFC stream Internet Engineering Task Force (IETF)
Formats
Reviews
Additional resources Mailing list discussion
Stream WG state Submitted to IESG for Publication
Document shepherd Kepeng Li
Shepherd write-up Show Last changed 2015-10-20
IESG IESG state Expired (IESG: Dead)
Consensus boilerplate Yes
Telechat date (None)
Responsible AD Kathleen Moriarty
Send notices to draft-ietf-oauth-pop-architecture.all@tools.ietf.org
IANA IANA review state IANA OK - No Actions Needed

This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:

Abstract

The OAuth 2.0 bearer token specification, as defined in RFC 6750, allows any party in possession of a bearer token (a "bearer") to get access to the associated resources (without demonstrating possession of a cryptographic key). To prevent misuse, bearer tokens must be protected from disclosure in transit and at rest. Some scenarios demand additional security protection whereby a client needs to demonstrate possession of cryptographic keying material when accessing a protected resource. This document motivates the development of the OAuth 2.0 proof-of-possession security mechanism.

Authors

Phil Hunt
Justin Richer
William Mills
Prateek Mishra
Hannes Tschofenig

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)