Subject: [Ace] OSCORE Profile IANA questions

From: Francesca Palombini <[email-masked]>
Date: Mon, 31 Aug 2020 12:53:20 +0000

Hi all,

I have two quick questions concerning IANA actions to be done for the OSCORE profile:

1) The framework (-params) and the profile are currently conflicting on the registration of parameters, and we need to fix that.
In the framework, parameters that are sent from Client to AS (such as req_cnf) are registered in the OAuth Parameters Registry as having "Parameter Usage Location: token request". The OSCORE profile registers parameters sent from Client to RS (such as nonce1) with "Parameter Usage Location: token request". The possible "Parameter Usage Location" are "token request" "token response" "authorization request" "authorization response" (see https://tools.ietf.org/html/rfc6749#section-11.2.1 ). It seems that "authorization request/response" are to the Resource Owner, and "token request/response" are to the Authorization Server. I think the framework is using the right names, but I am not sure what other location to put there, I think there is no name for Client-to-RS and RS-to-Client in the registry right now.

2) The OSCORE profile defines a new registry, the OSCORE Security Context Parameters registry. The question is where to put this registry? My proposal is to put it under https://www.iana.org/assignments/core-parameters/core-parameters.xhtml . Any objections?

Thanks,
Francesca

---

From: Seitz Ludwig <[email-masked]>
Date: Mon, 31 Aug 2020 13:42:27 +0000

1.) I would not put these parameters in the "token request" category, they belong into a new category. Whether they should be registered in the OAuth parameters registry is doubtful to me, since I don't see them being used in a non-ACE OAuth context. Somewhere in the ACE registries?

2.)  I would propose to put it on ACE page to be created for the framework by IANA.

/Ludwig

-----Original Message-----
From: Ace <[email-masked]> On Behalf Of Francesca Palombini
Sent: den 31 augusti 2020 14:53
To: Ace Wg <[email-masked]>
Cc: [email-masked]
Subject: [Ace] OSCORE Profile IANA questions

Hi all,

Thanks,
Francesca

_______________________________________________
Ace mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ace

---

From: Jim Schaad <[email-masked]>
Date: Mon, 31 Aug 2020 08:28:56 -0700

-----Original Message-----
From: Francesca Palombini <[email-masked]> 
Sent: Monday, August 31, 2020 5:53 AM
To: Ace Wg <[email-masked]>
Cc: [email-masked]
Subject: OSCORE Profile IANA questions

Hi all,

[JLS] Look at the OAuth registries - they have some "standardized" names for these interactions as well as the RS-AS pair.
Jim

Thanks,
Francesca