Subject: [kitten] Joel Jaeggli's No Objection on draft-ietf-kitten-sasl-oauth-22: (with COMMENT)

From: "Joel Jaeggli" <[email-masked]>
Date: Mon, 25 May 2015 08:57:53 -0700

Joel Jaeggli has entered the following ballot position for
draft-ietf-kitten-sasl-oauth-22: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-kitten-sasl-oauth/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

SASL mechanisms using this document as their definition do not
   provide a data security layer; that is, they cannot provide integrity
   or confidentiality protection for application messages after the
   initial authentication.  If such protection is needed, TLS or some
   similar solution should be used.  Additionally, for the two
   mechanisms specified in this document, TLS MUST be used for
   OAUTHBEARER to protect the bearer token; for OAUTH10A the use of TLS
   is RECOMMENDED.

Can someone explain to me situation were intergrity protection is not
desirable (possibly rhetorical). it seems like it might be better to
clarify what the exception is and use a blanket must for everything else.

---

From: Bill Mills <[email-masked]>
Date: Mon, 25 May 2015 16:40:25 +0000

" Can someone explain to me situation were intergrity protection is not desirable (possibly rhetorical). it seems like it might be better to clarify what the exception is and use a blanket must for everything else."

In OAuth there's no guarantee of a shared context that has a secret that can be used to provide integrity protection.  Some OAuth mechanisms like the "holder of key/proof of possession" tokens do have one but not all. 

Regards,

-bill

-----Original Message-----
From: Joel Jaeggli [mailto:[email-masked]] 
Sent: Monday, May 25, 2015 8:58 AM
To: The IESG
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Joel Jaeggli's No Objection on draft-ietf-kitten-sasl-oauth-22: (with COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

Can someone explain to me situation were intergrity protection is not desirable (possibly rhetorical). it seems like it might be better to clarify what the exception is and use a blanket must for everything else.