Subject: [kitten] OAuth SASL mec hanism and Channel binding.

From: William Mills <[email-masked]>
Date: Fri, 4 Mar 2011 13:10:03 -0800

There was some discussion about channel binding being a requirement for the proposed OAuth SASL mechanism.   The mechanism as it stands does not have any message integrity guarantee.   As I understand channel binding it requires message integrity guarantees to be provably correct, otherwise a MITM could simply alter the channel binding messages if that MITM is able to parse down into the protocol.

Some of the auth schemes on the OAuth 2 framework are capable of message integrity, but not all.  It would be  possible to define channel binding for just those auth schemes.

Is removing channel binding from the OAuth mechanism a deal breaker?

Thanks,

-bill