Subject: [OAUTH-WG] Authorization Code Log File Attack (was DPoP Interim Meeting Minutes)

From: Pieter Kasselman <[email-masked]>
Date: Mon, 29 Nov 2021 14:29:39 +0000

All

There was an action item from the meeting on 27 October to document the log file attack and how binding the DPoP key to the authorization code mitigates against it.

Please find attached a short (2-page) write-up of the attack and mitigation.

We also hope to discuss this in the OAUTH Security Workshop session on DPoP (OAuth Security Workshop 2021 (barcamps.eu)<https://barcamps.eu/osw2021/>).

Please let me or Mike Jones know if you have any questions or concerns.

Cheers

Pieter

From: OAuth <[email-masked]> On Behalf Of Rifaat Shekh-Yusef
Sent: Wednesday 27 October 2021 18:43
To: oauth <[email-masked]>
Subject: [EXTERNAL] [OAUTH-WG] DPoP Interim Meeting Minutes

All,

Thanks to Hannes and Dick for taking the following notes during the DPoP Interim meeting today.
https://notes.ietf.org/s/notes-ietf-interim-2021-oauth-14-oauth<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnotes.ietf.org%2Fs%2Fnotes-ietf-interim-2021-oauth-14-oauth&data=04%7C01%7Cpieter.kasselman%40microsoft.com%7Cd58049044e5944e8144f08d999714bfe%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637709534217052392%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ca9oUifPAjTkfdSAIFFWrt1v2ufeBQ6VN0v2tm1f6VE%3D&reserved=0>

Regards,
 Rifaat