--- 1/draft-ietf-ace-oauth-authz-38.txt 2021-04-16 00:13:16.169587740 -0700 +++ 2/draft-ietf-ace-oauth-authz-39.txt 2021-04-16 00:13:16.325591626 -0700 @@ -1,26 +1,26 @@ ACE Working Group L. Seitz Internet-Draft Combitech Intended status: Standards Track G. Selander -Expires: September 9, 2021 Ericsson +Expires: October 18, 2021 Ericsson E. Wahlstroem S. Erdtman Spotify AB H. Tschofenig Arm Ltd. - March 8, 2021 + April 16, 2021 Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth) - draft-ietf-ace-oauth-authz-38 + draft-ietf-ace-oauth-authz-39 Abstract This specification defines a framework for authentication and authorization in Internet of Things (IoT) environments called ACE- OAuth. The framework is based on a set of building blocks including OAuth 2.0 and the Constrained Application Protocol (CoAP), thus transforming a well-known and widely used authorization solution into a form suitable for IoT devices. Existing specifications are used where possible, but extensions are added and profiles are defined to @@ -34,21 +34,21 @@ Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on September 9, 2021. + This Internet-Draft will expire on October 18, 2021. Copyright Notice Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents @@ -59,142 +59,119 @@ described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5 3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.1. OAuth 2.0 . . . . . . . . . . . . . . . . . . . . . . . . 7 3.2. CoAP . . . . . . . . . . . . . . . . . . . . . . . . . . 10 4. Protocol Interactions . . . . . . . . . . . . . . . . . . . . 11 - 5. Framework . . . . . . . . . . . . . . . . . . . . . . . . . . 15 + 5. Framework . . . . . . . . . . . . . . . . . . . . . . . . . . 14 5.1. Discovering Authorization Servers . . . . . . . . . . . . 16 - 5.2. Unauthorized Resource Request Message . . . . . . . . . . 17 + 5.2. Unauthorized Resource Request Message . . . . . . . . . . 16 5.3. AS Request Creation Hints . . . . . . . . . . . . . . . . 17 5.3.1. The Client-Nonce Parameter . . . . . . . . . . . . . 19 5.4. Authorization Grants . . . . . . . . . . . . . . . . . . 20 5.5. Client Credentials . . . . . . . . . . . . . . . . . . . 21 5.6. AS Authentication . . . . . . . . . . . . . . . . . . . . 21 5.7. The Authorization Endpoint . . . . . . . . . . . . . . . 21 - 5.8. The Token Endpoint . . . . . . . . . . . . . . . . . . . 22 + 5.8. The Token Endpoint . . . . . . . . . . . . . . . . . . . 21 5.8.1. Client-to-AS Request . . . . . . . . . . . . . . . . 22 5.8.2. AS-to-Client Response . . . . . . . . . . . . . . . . 25 5.8.3. Error Response . . . . . . . . . . . . . . . . . . . 27 5.8.4. Request and Response Parameters . . . . . . . . . . . 28 - 5.8.4.1. Grant Type . . . . . . . . . . . . . . . . . . . 29 + 5.8.4.1. Grant Type . . . . . . . . . . . . . . . . . . . 28 5.8.4.2. Token Type . . . . . . . . . . . . . . . . . . . 29 5.8.4.3. Profile . . . . . . . . . . . . . . . . . . . . . 29 5.8.4.4. Client-Nonce . . . . . . . . . . . . . . . . . . 30 5.8.5. Mapping Parameters to CBOR . . . . . . . . . . . . . 30 5.9. The Introspection Endpoint . . . . . . . . . . . . . . . 31 5.9.1. Introspection Request . . . . . . . . . . . . . . . . 32 5.9.2. Introspection Response . . . . . . . . . . . . . . . 33 5.9.3. Error Response . . . . . . . . . . . . . . . . . . . 34 - 5.9.4. Mapping Introspection parameters to CBOR . . . . . . 35 + 5.9.4. Mapping Introspection Parameters to CBOR . . . . . . 35 5.10. The Access Token . . . . . . . . . . . . . . . . . . . . 35 5.10.1. The Authorization Information Endpoint . . . . . . . 36 5.10.1.1. Verifying an Access Token . . . . . . . . . . . 37 5.10.1.2. Protecting the Authorization Information Endpoint . . . . . . . . . . . . . . . . . . . . 39 5.10.2. Client Requests to the RS . . . . . . . . . . . . . 39 5.10.3. Token Expiration . . . . . . . . . . . . . . . . . . 40 - 5.10.4. Key Expiration . . . . . . . . . . . . . . . . . . . 41 + 5.10.4. Key Expiration . . . . . . . . . . . . . . . . . . . 42 6. Security Considerations . . . . . . . . . . . . . . . . . . . 42 6.1. Protecting Tokens . . . . . . . . . . . . . . . . . . . . 42 6.2. Communication Security . . . . . . . . . . . . . . . . . 43 6.3. Long-Term Credentials . . . . . . . . . . . . . . . . . . 44 - 6.4. Unprotected AS Request Creation Hints . . . . . . . . . . 44 - 6.5. Minimal security requirements for communication . 45 + 6.4. Unprotected AS Request Creation Hints . . . . . . . . . . 45 + 6.5. Minimal Security Requirements for Communication . 45 6.6. Token Freshness and Expiration . . . . . . . . . . . . . 46 - 6.7. Combining profiles . . . . . . . . . . . . . . . . . . . 46 + 6.7. Combining Profiles . . . . . . . . . . . . . . . . . . . 47 6.8. Unprotected Information . . . . . . . . . . . . . . . . . 47 - 6.9. Identifying audiences . . . . . . . . . . . . . . . . . . 47 - 6.10. Denial of service against or with Introspection . . 48 + 6.9. Identifying Audiences . . . . . . . . . . . . . . . . . . 48 + 6.10. Denial of Service Against or with Introspection . . 48 7. Privacy Considerations . . . . . . . . . . . . . . . . . . . 49 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 50 8.1. ACE Authorization Server Request Creation Hints . . . . . 50 - 8.2. CoRE Resource Type registry . . . . . . . . . . . . . . . 50 + 8.2. CoRE Resource Type Registry . . . . . . . . . . . . . . . 51 8.3. OAuth Extensions Error Registration . . . . . . . . . . . 51 8.4. OAuth Error Code CBOR Mappings Registry . . . . . . . . . 51 - 8.5. OAuth Grant Type CBOR Mappings . . . . . . . . . . . . . 51 + 8.5. OAuth Grant Type CBOR Mappings . . . . . . . . . . . . . 52 8.6. OAuth Access Token Types . . . . . . . . . . . . . . . . 52 8.7. OAuth Access Token Type CBOR Mappings . . . . . . . . . . 52 8.7.1. Initial Registry Contents . . . . . . . . . . . . . . 53 8.8. ACE Profile Registry . . . . . . . . . . . . . . . . . . 53 - 8.9. OAuth Parameter Registration . . . . . . . . . . . . . . 53 + 8.9. OAuth Parameter Registration . . . . . . . . . . . . . . 54 8.10. OAuth Parameters CBOR Mappings Registry . . . . . . . . . 54 8.11. OAuth Introspection Response Parameter Registration . . . 54 8.12. OAuth Token Introspection Response CBOR Mappings Registry 55 8.13. JSON Web Token Claims . . . . . . . . . . . . . . . . . . 55 8.14. CBOR Web Token Claims . . . . . . . . . . . . . . . . . . 56 8.15. Media Type Registrations . . . . . . . . . . . . . . . . 57 - 8.16. CoAP Content-Format Registry . . . . . . . . . . . . . . 57 + 8.16. CoAP Content-Format Registry . . . . . . . . . . . . . . 58 8.17. Expert Review Instructions . . . . . . . . . . . . . . . 58 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 59 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 59 10.1. Normative References . . . . . . . . . . . . . . . . . . 59 10.2. Informative References . . . . . . . . . . . . . . . . . 62 Appendix A. Design Justification . . . . . . . . . . . . . . . . 65 Appendix B. Roles and Responsibilities . . . . . . . . . . . . . 68 Appendix C. Requirements on Profiles . . . . . . . . . . . . . . 71 - Appendix D. Assumptions on AS knowledge about C and RS . . . . . 71 - Appendix E. Deployment Examples . . . . . . . . . . . . . . . . 72 - E.1. Local Token Validation . . . . . . . . . . . . . . . . . 72 - E.2. Introspection Aided Token Validation . . . . . . . . . . 76 - Appendix F. Document Updates . . . . . . . . . . . . . . . . . . 80 - F.1. Version -21 to 22 . . . . . . . . . . . . . . . . . . . . 81 - F.2. Version -20 to 21 . . . . . . . . . . . . . . . . . . . . 81 - F.3. Version -19 to 20 . . . . . . . . . . . . . . . . . . . . 81 - F.4. Version -18 to -19 . . . . . . . . . . . . . . . . . . . 81 - F.5. Version -17 to -18 . . . . . . . . . . . . . . . . . . . 81 - F.6. Version -16 to -17 . . . . . . . . . . . . . . . . . . . 81 - F.7. Version -15 to -16 . . . . . . . . . . . . . . . . . . . 82 - F.8. Version -14 to -15 . . . . . . . . . . . . . . . . . . . 82 - F.9. Version -13 to -14 . . . . . . . . . . . . . . . . . . . 82 - F.10. Version -12 to -13 . . . . . . . . . . . . . . . . . . . 82 - F.11. Version -11 to -12 . . . . . . . . . . . . . . . . . . . 83 - F.12. Version -10 to -11 . . . . . . . . . . . . . . . . . . . 83 - F.13. Version -09 to -10 . . . . . . . . . . . . . . . . . . . 83 - F.14. Version -08 to -09 . . . . . . . . . . . . . . . . . . . 83 - F.15. Version -07 to -08 . . . . . . . . . . . . . . . . . . . 83 - F.16. Version -06 to -07 . . . . . . . . . . . . . . . . . . . 84 - F.17. Version -05 to -06 . . . . . . . . . . . . . . . . . . . 84 - F.18. Version -04 to -05 . . . . . . . . . . . . . . . . . . . 84 - F.19. Version -03 to -04 . . . . . . . . . . . . . . . . . . . 85 - F.20. Version -02 to -03 . . . . . . . . . . . . . . . . . . . 85 - F.21. Version -01 to -02 . . . . . . . . . . . . . . . . . . . 85 - F.22. Version -00 to -01 . . . . . . . . . . . . . . . . . . . 86 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 86 + Appendix D. Assumptions on AS Knowledge about C and RS . . . . . 72 + Appendix E. Differences to OAuth 2.0 . . . . . . . . . . . . . . 72 + Appendix F. Deployment Examples . . . . . . . . . . . . . . . . 73 + F.1. Local Token Validation . . . . . . . . . . . . . . . . . 73 + F.2. Introspection Aided Token Validation . . . . . . . . . . 77 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 81 1. Introduction Authorization is the process for granting approval to an entity to access a generic resource [RFC4949]. The authorization task itself can best be described as granting access to a requesting client, for a resource hosted on a device, the resource server (RS). This exchange is mediated by one or multiple authorization servers (AS). Managing authorization for a large number of devices and users can be a complex task. While prior work on authorization solutions for the Web and for the mobile environment also applies to the Internet of Things (IoT) environment, many IoT devices are constrained, for example, in terms - of processing capabilities, available memory, etc. For web - applications on constrained nodes, this specification RECOMMENDS the - use of the Constrained Application Protocol (CoAP) [RFC7252] as - replacement for HTTP. + of processing capabilities, available memory, etc. For such devices + the Constrained Application Protocol (CoAP) [RFC7252] can alleviate + some resource concerns when used instead of HTTP to implement the + communication flows of this specification. Appendix A gives an overview of the constraints considered in this design, and a more detailed treatment of constraints can be found in [RFC7228]. This design aims to accommodate different IoT deployments and thus a continuous range of device and network capabilities. - Taking energy consumption as an example: At one end there are energy- harvesting or battery powered devices which have a tight power budget, on the other end there are mains-powered devices, and all levels in between. Hence, IoT devices may be very different in terms of available processing and message exchange capabilities and there is a need to support many different authorization use cases [RFC7744]. This specification describes a framework for authentication and @@ -196,29 +173,34 @@ Hence, IoT devices may be very different in terms of available processing and message exchange capabilities and there is a need to support many different authorization use cases [RFC7744]. This specification describes a framework for authentication and authorization in constrained environments (ACE) built on re-use of OAuth 2.0 [RFC6749], thereby extending authorization to Internet of Things devices. This specification contains the necessary building blocks for adjusting OAuth 2.0 to IoT environments. - More detailed, interoperable specifications can be found in separate - profile specifications. Implementations may claim conformance with a + Profiles of this framework are available in separate specifications, + such as [I-D.ietf-ace-dtls-authorize] or + [I-D.ietf-ace-oscore-profile]. Such profiles may specify the use of + the framework for a specific security protocol and the underlying + transports for use in a specific deployment environment to improve + interoperability. Implementations may claim conformance with a specific profile, whereby implementations utilizing the same profile - interoperate while implementations of different profiles are not - expected to be interoperable. Some devices, such as mobile phones - and tablets, may implement multiple profiles and will therefore be - able to interact with a wider range of low end devices. Requirements - on profiles are described at contextually appropriate places - throughout this specification, and also summarized in Appendix C. + interoperate, while implementations of different profiles are not + expected to be interoperable. More powerful devices, such as mobile + phones and tablets, may implement multiple profiles and will + therefore be able to interact with a wider range of constrained + devices. Requirements on profiles are described at contextually + appropriate places throughout this specification, and also summarized + in Appendix C. 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. Certain security-related terms such as "authentication", @@ -238,25 +220,25 @@ for a definition of the authz-info endpoint). The CoAP [RFC7252] definition, which is "An entity participating in the CoAP protocol" is not used in this specification. The specifications in this document is called the "framework" or "ACE framework". When referring to "profiles of this framework" it refers to additional specifications that define the use of this specification with concrete transport and communication security protocols (e.g., CoAP over DTLS). - We use the term "Access Information" for parameters other than the - access token provided to the client by the AS to enable it to access + The term "Access Information" is used for parameters, other than the + access token, provided to the client by the AS to enable it to access the RS (e.g. public key of the RS, profile supported by RS). - We use the term "Authorization Information" to denote all + The term "Authorization Information" is used to denote all information, including the claims of relevant access tokens, that an RS uses to determine whether an access request should be granted. 3. Overview This specification defines the ACE framework for authorization in the Internet of Things environment. It consists of a set of building blocks. The basic block is the OAuth 2.0 [RFC6749] framework, which enjoys @@ -283,22 +265,22 @@ sufficiently compact. CBOR is a binary encoding designed for small code and message size, which may be used for encoding of self contained tokens, and also for encoding payloads transferred in protocol messages. A fourth building block is CBOR Object Signing and Encryption (COSE) [RFC8152], which enables object-level layer security as an alternative or complement to transport layer security (DTLS [RFC6347] or TLS [RFC8446]). COSE is used to secure self-contained tokens such as proof-of-possession (PoP) tokens, which are an extension to the - OAuth bearer tokens. The default token format is defined in CBOR web - token (CWT) [RFC8392]. Application layer security for CoAP using + OAuth bearer tokens. The default token format is defined in CBOR Web + Token (CWT) [RFC8392]. Application-layer security for CoAP using COSE can be provided with OSCORE [RFC8613]. With the building blocks listed above, solutions satisfying various IoT device and network constraints are possible. A list of constraints is described in detail in [RFC7228] and a description of how the building blocks mentioned above relate to the various constraints can be found in Appendix A. Luckily, not every IoT device suffers from all constraints. The ACE framework nevertheless takes all these aspects into account and @@ -314,102 +296,98 @@ The OAuth 2.0 authorization framework enables a client to obtain scoped access to a resource with the permission of a resource owner. Authorization information, or references to it, is passed between the nodes using access tokens. These access tokens are issued to clients by an authorization server with the approval of the resource owner. The client uses the access token to access the protected resources hosted by the resource server. A number of OAuth 2.0 terms are used within this specification: - The token and introspection Endpoints: - The AS hosts the token endpoint that allows a client to request - access tokens. The client makes a POST request to the token - endpoint on the AS and receives the access token in the response - (if the request was successful). - In some deployments, a token introspection endpoint is provided by - the AS, which can be used by the RS if it needs to request - additional information regarding a received access token. The RS - makes a POST request to the introspection endpoint on the AS and - receives information about the access token in the response. (See - "Introspection" below.) - Access Tokens: Access tokens are credentials needed to access protected resources. An access token is a data structure representing authorization permissions issued by the AS to the client. Access tokens are generated by the AS and consumed by the RS. The access token content is opaque to the client. Access tokens can have different formats, and various methods of utilization e.g., cryptographic properties) based on the security requirements of the given deployment. + Introspection: + Introspection is a method for a resource server or potentially a + client, to query the authorization server for the active state and + content of a received access token. This is particularly useful + in those cases where the authorization decisions are very dynamic + and/or where the received access token itself is an opaque + reference rather than a self-contained token. More information + about introspection in OAuth 2.0 can be found in [RFC7662]. + Refresh Tokens: Refresh tokens are credentials used to obtain access tokens. Refresh tokens are issued to the client by the authorization server and are used to obtain a new access token when the current - access token becomes invalid or expires, or to obtain additional - access tokens with identical or narrower scope (such access tokens - may have a shorter lifetime and fewer permissions than authorized - by the resource owner). Issuing a refresh token is optional at - the discretion of the authorization server. If the authorization - server issues a refresh token, it is included when issuing an - access token (i.e., step (B) in Figure 1). + access token expires, or to obtain additional access tokens with + identical or narrower scope (such access tokens may have a shorter + lifetime and fewer permissions than authorized by the resource + owner). Issuing a refresh token is optional at the discretion of + the authorization server. If the authorization server issues a + refresh token, it is included when issuing an access token (i.e., + step (B) in Figure 1). A refresh token in OAuth 2.0 is a string representing the authorization granted to the client by the resource owner. The string is usually opaque to the client. The token denotes an identifier used to retrieve the authorization information. Unlike access tokens, refresh tokens are intended for use only with authorization servers and are never sent to resource servers. In this framework, refresh tokens are encoded in binary instead of strings, if used. Proof of Possession Tokens: A token may be bound to a cryptographic key, which is then used to bind the token to a request authorized by the token. Such tokens are called proof-of-possession tokens (or PoP tokens). - The proof-of-possession (PoP) security concept used here assumes - that the AS acts as a trusted third party that binds keys to - tokens. In the case of access tokens, these so called PoP keys - are then used by the client to demonstrate the possession of the - secret to the RS when accessing the resource. The RS, when - receiving an access token, needs to verify that the key used by - the client matches the one bound to the access token. When this + The proof-of-possession security concept used here assumes that + the AS acts as a trusted third party that binds keys to tokens. + In the case of access tokens, these so called PoP keys are then + used by the client to demonstrate the possession of the secret to + the RS when accessing the resource. The RS, when receiving an + access token, needs to verify that the key used by the client + matches the one bound to the access token. When this specification uses the term "access token" it is assumed to be a - PoP access token token unless specifically stated otherwise. + PoP access token unless specifically stated otherwise. The key bound to the token (the PoP key) may use either symmetric or asymmetric cryptography. The appropriate choice of the kind of cryptography depends on the constraints of the IoT devices as well as on the security requirements of the use case. Symmetric PoP key: The AS generates a random symmetric PoP key. The key is either - stored to be returned on introspection calls or encrypted and - included in the token. The PoP key is also encrypted for the - token recipient and sent to the recipient together with the - token. + stored to be returned on introspection calls or included in the + token. Either the whole token or only the key MUST be + encrypted in the latter case. The PoP key is also returned to + client together with the token. Asymmetric PoP key: - An asymmetric key pair is generated on the token's recipient - and the public key is sent to the AS (if it does not already - have knowledge of the recipient's public key). Information - about the public key, which is the PoP key in this case, is - either stored to be returned on introspection calls or included - inside the token and sent back to the requesting party. The - consumer of the token can identify the public key from the - information in the token, which allows the recipient of the - token to use the corresponding private key for the proof of - possession. + An asymmetric key pair is generated by the client and the + public key is sent to the AS (if it does not already have + knowledge of the client's public key). Information about the + public key, which is the PoP key in this case, is either stored + to be returned on introspection calls or included inside the + token and sent back to the client. The resource server + consuming the token can identify the public key from the + information in the token, which allows the client to use the + corresponding private key for the proof of possession. The token is either a simple reference, or a structured information object (e.g., CWT [RFC8392]) protected by a cryptographic wrapper (e.g., COSE [RFC8152]). The choice of PoP key does not necessarily imply a specific credential type for the integrity protection of the token. Scopes and Permissions: In OAuth 2.0, the client specifies the type of permissions it is seeking to obtain (via the scope parameter) in the access token @@ -430,35 +408,38 @@ An access token may, for example, include a claim identifying the AS that issued the token (via the "iss" claim) and what audience the access token is intended for (via the "aud" claim). The audience of an access token can be a specific resource or one or many resource servers. The resource owner policies influence what claims are put into the access token by the authorization server. While the structure and encoding of the access token varies throughout deployments, a standardized format has been defined with the JSON Web Token (JWT) [RFC7519] where claims are encoded - as a JSON object. In [RFC8392], an equivalent format using CBOR - encoding (CWT) has been defined. + as a JSON object. In [RFC8392] the CBOR Web Token (CWT) has been + defined as an equivalent format using CBOR encoding. - Introspection: - Introspection is a method for a resource server to query the - authorization server for the active state and content of a - received access token. This is particularly useful in those cases - where the authorization decisions are very dynamic and/or where - the received access token itself is an opaque reference rather - than a self-contained token. More information about introspection - in OAuth 2.0 can be found in [RFC7662]. + The token and introspection Endpoints: + The AS hosts the token endpoint that allows a client to request + access tokens. The client makes a POST request to the token + endpoint on the AS and receives the access token in the response + (if the request was successful). + In some deployments, a token introspection endpoint is provided by + the AS, which can be used by the RS and potentially the client, if + they need to request additional information regarding a received + access token. The requesting entity makes a POST request to the + introspection endpoint on the AS and receives information about + the access token in the response. (See "Introspection" above.) 3.2. CoAP - CoAP is an application layer protocol similar to HTTP, but + CoAP is an application-layer protocol similar to HTTP, but specifically designed for constrained environments. CoAP typically uses datagram-oriented transport, such as UDP, where reordering and loss of packets can occur. A security solution needs to take the latter aspects into account. While HTTP uses headers and query strings to convey additional information about a request, CoAP encodes such information into header parameters called 'options'. CoAP supports application-layer fragmentation of the CoAP payloads @@ -473,163 +454,102 @@ communication end-to-end through proxies, and also to support security for CoAP over a different transport in a uniform way, is to provide security at the application layer using an object-based security mechanism such as COSE [RFC8152]. One application of COSE is OSCORE [RFC8613], which provides end-to- end confidentiality, integrity and replay protection, and a secure binding between CoAP request and response messages. In OSCORE, the CoAP messages are wrapped in COSE objects and sent using CoAP. - This framework RECOMMENDS the use of CoAP as replacement for HTTP for - use in constrained environments. For communication security this - framework does not make an explicit protocol recommendation, since - the choice depends on the requirements of the specific application. - DTLS [RFC6347], [I-D.ietf-tls-dtls13] and OSCORE [RFC8613] are - mentioned as examples, other protocols fulfilling the requirements - from Section 6.5 are also applicable. + In this framework the use of CoAP as replacement for HTTP is + RECOMMENDED for use in constrained environments. For communication + security this framework does not make an explicit protocol + recommendation, since the choice depends on the requirements of the + specific application. DTLS [RFC6347], [I-D.ietf-tls-dtls13] and + OSCORE [RFC8613] are mentioned as examples, other protocols + fulfilling the requirements from Section 6.5 are also applicable. 4. Protocol Interactions The ACE framework is based on the OAuth 2.0 protocol interactions using the token endpoint and optionally the introspection endpoint. A client obtains an access token, and optionally a refresh token, from an AS using the token endpoint and subsequently presents the access token to an RS to gain access to a protected resource. In most deployments the RS can process the access token locally, however in some cases the RS may present it to the AS via the introspection endpoint to get fresh information. These interactions are shown in Figure 1. An overview of various OAuth concepts is provided in Section 3.1. - The OAuth 2.0 framework defines a number of "protocol flows" via - grant types, which have been extended further with extensions to - OAuth 2.0 (such as [RFC7521] and [RFC8628]). What grant types works - best depends on the usage scenario and [RFC7744] describes many - different IoT use cases but there are two preferred grant types, - namely the Authorization Code Grant (described in Section 4.1 of - [RFC7521]) and the Client Credentials Grant (described in Section 4.4 - of [RFC7521]). The Authorization Code Grant is a good fit for use - with apps running on smart phones and tablets that request access to - IoT devices, a common scenario in the smart home environment, where - users need to go through an authentication and authorization phase - (at least during the initial setup phase). The native apps - guidelines described in [RFC8252] are applicable to this use case. - The Client Credential Grant is a good fit for use with IoT devices - where the OAuth client itself is constrained. In such a case, the - resource owner has pre-arranged access rights for the client with the - authorization server, which is often accomplished using a - commissioning tool. - - The consent of the resource owner, for giving a client access to a - protected resource, can be provided dynamically as in the traditional - OAuth flows, or it could be pre-configured by the resource owner as - authorization policies at the AS, which the AS evaluates when a token - request arrives. The resource owner and the requesting party (i.e., - client owner) are not shown in Figure 1. - - This framework supports a wide variety of communication security - mechanisms between the ACE entities, such as client, AS, and RS. It - is assumed that the client has been registered (also called enrolled - or onboarded) to an AS using a mechanism defined outside the scope of - this document. In practice, various techniques for onboarding have - been used, such as factory-based provisioning or the use of - commissioning tools. Regardless of the onboarding technique, this - provisioning procedure implies that the client and the AS exchange - credentials and configuration parameters. These credentials are used - to mutually authenticate each other and to protect messages exchanged - between the client and the AS. - - It is also assumed that the RS has been registered with the AS, - potentially in a similar way as the client has been registered with - the AS. Established keying material between the AS and the RS allows - the AS to apply cryptographic protection to the access token to - ensure that its content cannot be modified, and if needed, that the - content is confidentiality protected. - - The keying material necessary for establishing communication security - between C and RS is dynamically established as part of the protocol - described in this document. - - At the start of the protocol, there is an optional discovery step - where the client discovers the resource server and the resources this - server hosts. In this step, the client might also determine what - permissions are needed to access the protected resource. A generic - procedure is described in Section 5.1; profiles MAY define other - procedures for discovery. - - In Bluetooth Low Energy, for example, advertisements are broadcasted - by a peripheral, including information about the primary services. - - In CoAP, as a second example, a client can make a request to "/.well- - known/core" to obtain information about available resources, which - are returned in a standardized format as described in [RFC6690]. - +--------+ +---------------+ | |---(A)-- Token Request ------->| | | | | Authorization | | |<--(B)-- Access Token ---------| Server | | | + Access Information | | | | + Refresh Token (optional) +---------------+ | | ^ | | | Introspection Request (D)| | - | Client | (optional) | | - | | Response | |(E) - | | (optional) | v + | Client | Response | |(E) + | | (optional exchange) | | + | | | v | | +--------------+ | |---(C)-- Token + Request ----->| | | | | Resource | | |<--(F)-- Protected Resource ---| Server | | | | | +--------+ +--------------+ Figure 1: Basic Protocol Flow. Requesting an Access Token (A): The client makes an access token request to the token endpoint at the AS. This framework assumes the use of PoP access tokens (see Section 3.1 for a short description) wherein the AS binds a key to an access token. The client may include permissions it seeks to - obtain, and information about the credentials it wants to use - (e.g., symmetric/asymmetric cryptography or a reference to a - specific credential). + obtain, and information about the credentials it wants to use for + proof-of-possession (e.g., symmetric/asymmetric cryptography or a + reference to a specific key) of the access token. Access Token Response (B): - If the AS successfully processes the request from the client, it - returns an access token and optionally a refresh token (note that - only certain grant types support refresh tokens). It can also - return additional parameters, referred to as "Access Information". - In addition to the response parameters defined by OAuth 2.0 and - the PoP access token extension, this framework defines parameters - that can be used to inform the client about capabilities of the - RS, e.g. the profiles the RS supports. More information about - these parameters can be found in Section 5.8.4. + If the request from the client has been successfully verified, + authenticated, and authorized, the AS returns an access token and + optionally a refresh token. Note that only certain grant types + support refresh tokens. The AS can also return additional + parameters, referred to as "Access Information". In addition to + the response parameters defined by OAuth 2.0 and the PoP access + token extension, this framework defines parameters that can be + used to inform the client about capabilities of the RS, e.g. the + profile the RS supports. More information about these parameters + can be found in Section 5.8.4. Resource Request (C): The client interacts with the RS to request access to the protected resource and provides the access token. The protocol to use between the client and the RS is not restricted to CoAP. - HTTP, HTTP/2, QUIC, MQTT, Bluetooth Low Energy, etc., are also - viable candidates. + HTTP, HTTP/2 [RFC7540], QUIC [I-D.ietf-quic-transport], MQTT + [MQTT5.0], Bluetooth Low Energy [BLE], etc., are also viable + candidates. Depending on the device limitations and the selected protocol, this exchange may be split up into two parts: (1) the client sends the access token containing, or - referencing, the authorization information to the RS, that may + referencing, the authorization information to the RS, that will be used for subsequent resource requests by the client, and (2) the client makes the resource access request, using the communication security protocol and other Access Information obtained from the AS. - The Client and the RS mutually authenticate using the security + The client and the RS mutually authenticate using the security protocol specified in the profile (see step B) and the keys obtained in the access token or the Access Information. The RS verifies that the token is integrity protected and originated by the AS. It then compares the claims contained in the access token with the resource request. If the RS is online, validation can be handed over to the AS using token introspection (see messages D and E) over HTTP or CoAP. Token Introspection Request (D): A resource server may be configured to introspect the access token @@ -646,33 +566,98 @@ such as scope, audience, validity etc. associated with it back to the RS. The RS then uses the received parameters to process the request to either accept or to deny it. Protected Resource (F): If the request from the client is authorized, the RS fulfills the request and returns a response with the appropriate response code. The RS uses the dynamically established keys to protect the response, according to the communication security protocol used. + The OAuth 2.0 framework defines a number of "protocol flows" via + grant types, which have been extended further with extensions to + OAuth 2.0 (such as [RFC7521] and [RFC8628]). What grant type works + best depends on the usage scenario and [RFC7744] describes many + different IoT use cases but there are two grant types that cover a + majority of these scenarios, namely the Authorization Code Grant + (described in Section 4.1 of [RFC7521]) and the Client Credentials + Grant (described in Section 4.4 of [RFC7521]). The Authorization + Code Grant is a good fit for use with apps running on smart phones + and tablets that request access to IoT devices, a common scenario in + the smart home environment, where users need to go through an + authentication and authorization phase (at least during the initial + setup phase). The native apps guidelines described in [RFC8252] are + applicable to this use case. The Client Credential Grant is a good + fit for use with IoT devices where the OAuth client itself is + constrained. In such a case, the resource owner has pre-arranged + access rights for the client with the authorization server, which is + often accomplished using a commissioning tool. + + The consent of the resource owner, for giving a client access to a + protected resource, can be provided dynamically as in the traditional + OAuth flows, or it could be pre-configured by the resource owner as + authorization policies at the AS, which the AS evaluates when a token + request arrives. The resource owner and the requesting party (i.e., + client owner) are not shown in Figure 1. + + This framework supports a wide variety of communication security + mechanisms between the ACE entities, such as client, AS, and RS. It + is assumed that the client has been registered (also called enrolled + or onboarded) to an AS using a mechanism defined outside the scope of + this document. In practice, various techniques for onboarding have + been used, such as factory-based provisioning or the use of + commissioning tools. Regardless of the onboarding technique, this + provisioning procedure implies that the client and the AS exchange + credentials and configuration parameters. These credentials are used + to mutually authenticate each other and to protect messages exchanged + between the client and the AS. + + It is also assumed that the RS has been registered with the AS, + potentially in a similar way as the client has been registered with + the AS. Established keying material between the AS and the RS allows + the AS to apply cryptographic protection to the access token to + ensure that its content cannot be modified, and if needed, that the + content is confidentiality protected. Confidentiality protection of + the access token content would be provided on top of confidentiality + protection via a communication security protocol. + + The keying material necessary for establishing communication security + between C and RS is dynamically established as part of the protocol + described in this document. + + At the start of the protocol, there is an optional discovery step + where the client discovers the resource server and the resources this + server hosts. In this step, the client might also determine what + permissions are needed to access the protected resource. A generic + procedure is described in Section 5.1; profiles MAY define other + procedures for discovery. + + In Bluetooth Low Energy, for example, advertisements are broadcast by + a peripheral, including information about the primary services. In + CoAP, as a second example, a client can make a request to "/.well- + known/core" to obtain information about available resources, which + are returned in a standardized format as described in [RFC6690]. + 5. Framework The following sections detail the profiling and extensions of OAuth 2.0 for constrained environments, which constitutes the ACE framework. Credential Provisioning - For IoT, it cannot be assumed that the client and RS are part of a - common key infrastructure, so the AS provisions credentials or - associated information to allow mutual authentication between - client and RS. The resulting security association between client - and RS may then also be used to bind these credentials to the - access tokens the client uses. + In constrained environments it cannot be assumed that the client + and the RS are part of a common key infrastructure. Therefore, + the AS provisions credentials and associated information to allow + mutual authentication between the client and the RS. The + resulting security association between the client and the RS may + then also be used to bind these credentials to the access tokens + the client uses. Proof-of-Possession The ACE framework, by default, implements proof-of-possession for access tokens, i.e., that the token holder can prove being a holder of the key bound to the token. The binding is provided by the "cnf" claim [RFC8747] indicating what key is used for proof- of-possession. If a client needs to submit a new access token, e.g., to obtain additional access rights, they can request that the AS binds this token to the same key as the previous one. @@ -714,148 +699,153 @@ In OAuth 2.0 the communication with the Token and the Introspection endpoints at the AS is assumed to be via HTTP and may use Uri-query parameters. When profiles of this framework use CoAP instead, it is REQUIRED to use of the following alternative instead of Uri-query parameters: The sender (client or RS) encodes the parameters of its request as a CBOR map and submits that map as the payload of the POST request. Profiles that use CBOR encoding of protocol message parameters at the - outermost encoding layer MUST use the media format 'application/ + outermost encoding layer MUST use the content format 'application/ ace+cbor'. If CoAP is used for communication, the Content-Format MUST be abbreviated with the ID: 19 (see Section 8.16). The OAuth 2.0 AS uses a JSON structure in the payload of its responses both to client and RS. If CoAP is used, it is REQUIRED to use CBOR [RFC8949] instead of JSON. Depending on the profile, the CBOR payload MAY be enclosed in a non-CBOR cryptographic wrapper. 5.1. Discovering Authorization Servers C must discover the AS in charge of RS to determine where to request the access token. To do so, C must 1. find out the AS URI to which the token request message must be sent and 2. MUST validate that the AS with this URI is authorized to provide access tokens for this RS. In order to determine the AS URI, C MAY send an initial Unauthorized Resource Request message to RS. RS then denies the request and sends the address of its AS back to C (see Section 5.2). How C validates the AS authorization is not in scope for this document. C may, e.g., - ask it's owner if this AS is authorized for this RS. C may also use - a mechanism that addresses both problems at once. + ask its owner if this AS is authorized for this RS. C may also use a + mechanism that addresses both problems at once (e.g. by querying a + dedicated secure service provided by the client owner) . 5.2. Unauthorized Resource Request Message An Unauthorized Resource Request message is a request for any resource hosted by RS for which the client does not have authorization granted. RSes MUST treat any request for a protected resource as an Unauthorized Resource Request message when any of the following hold: - o The request has been received on an unprotected channel. + o The request has been received on an unsecured channel. o The RS has no valid access token for the sender of the request regarding the requested action on that resource. o The RS has a valid access token for the sender of the request, but that token does not authorize the requested action on the requested resource. Note: These conditions ensure that the RS can handle requests autonomously once access was granted and a secure channel has been established between C and RS. The authz-info endpoint, as part of the process for authorizing to protected resources, is not itself a protected resource and MUST NOT be protected as specified above (cf. Section 5.10.1). Unauthorized Resource Request messages MUST be denied with an "unauthorized_client" error response. In this response, the Resource - Server SHOULD provide proper AS Request Creation Hints to enable the - Client to request an access token from RS's AS as described in + Server SHOULD provide proper "AS Request Creation Hints" to enable + the client to request an access token from RS's AS as described in Section 5.3. The handling of all client requests (including unauthorized ones) by the RS is described in Section 5.10.2. 5.3. AS Request Creation Hints - The AS Request Creation Hints message is sent by an RS as a response - to an Unauthorized Resource Request message (see Section 5.2) to help - the sender of the Unauthorized Resource Request message acquire a - valid access token. The AS Request Creation Hints message is a CBOR - map, with an OPTIONAL element "AS" specifying an absolute URI (see - Section 4.3 of [RFC3986]) that identifies the appropriate AS for the - RS. + The "AS Request Creation Hints" message is sent by an RS as a + response to an Unauthorized Resource Request message (see + Section 5.2) to help the sender of the Unauthorized Resource Request + message acquire a valid access token. The "AS Request Creation + Hints" message is a CBOR or JSON map, with an OPTIONAL element "AS" + specifying an absolute URI (see Section 4.3 of [RFC3986]) that + identifies the appropriate AS for the RS. The message can also contain the following OPTIONAL parameters: - o A "audience" element containing a suggested audience that the - client should request at the AS. + o A "audience" element contains an identifier the client should + request at the AS, as suggested by the RS. With this parameter, + when included in the access token request to the AS, the AS is + able to restrict the use of access token to specific RSs. See + Section 6.9 for a discussion of this parameter. o A "kid" element containing the key identifier of a key used in an existing security association between the client and the RS. The RS expects the client to request an access token bound to this key, in order to avoid having to re-establish the security association. o A "cnonce" element containing a client-nonce. See Section 5.3.1. o A "scope" element containing the suggested scope that the client should request towards the AS. - Figure 2 summarizes the parameters that may be part of the AS Request - Creation Hints. + Figure 2 summarizes the parameters that may be part of the "AS + Request Creation Hints". /-----------+----------+---------------------\ | Name | CBOR Key | Value Type | |-----------+----------+---------------------| | AS | 1 | text string | | kid | 2 | byte string | | audience | 5 | text string | | scope | 9 | text or byte string | | cnonce | 39 | byte string | \-----------+----------+---------------------/ Figure 2: AS Request Creation Hints Note that the schema part of the AS parameter may need to be adapted to the security protocol that is used between the client and the AS. Thus the example AS value "coap://as.example.com/token" might need to be transformed to "coaps://as.example.com/token". It is assumed that the client can determine the correct schema part on its own depending on the way it communicates with the AS. - Figure 3 shows an example for an AS Request Creation Hints message + Figure 3 shows an example for an "AS Request Creation Hints" message payload using CBOR [RFC8949] diagnostic notation, using the parameter names instead of the CBOR keys for better human readability. 4.01 Unauthorized Content-Format: application/ace+cbor Payload : { "AS" : "coaps://as.example.com/token", "audience" : "coaps://rs.example.com" "scope" : "rTempC", "cnonce" : h'e0a156bb3f' } Figure 3: AS Request Creation Hints payload example In the example above, the response parameter "AS" points the receiver of this message to the URI "coaps://as.example.com/token" to request - access tokens. The RS sending this response (i.e., RS) uses an - internal clock that is only loosely synchronized with the clock of - the AS. Therefore it can not reliably verify the expiration time of - access tokens it receives. To ensure a certain level of access token - freshness nevetheless, the RS has included a "cnonce" parameter (see - Section 5.3.1) in the response. + access tokens. The RS sending this response uses an internal clock + that is not synchronized with the clock of the AS. Therefore, it can + not reliably verify the expiration time of access tokens it receives. + To ensure a certain level of access token freshness nevertheless, the + RS has included a "cnonce" parameter (see Section 5.3.1) in the + response. (The hex-sequence of the cnonce parameter is encoded in + CBOR-based notation in this example.) Figure 4 illustrates the mandatory to use binary encoding of the message payload shown in Figure 3. a4 # map(4) 01 # unsigned(1) (=AS) 78 1c # text(28) 636f6170733a2f2f61732e657861 6d706c652e636f6d2f746f6b656e # "coaps://as.example.com/token" 05 # unsigned(5) (=audience) @@ -873,30 +863,30 @@ 5.3.1. The Client-Nonce Parameter If the RS does not synchronize its clock with the AS, it could be tricked into accepting old access tokens, that are either expired or have been compromised. In order to ensure some level of token freshness in that case, the RS can use the "cnonce" (client-nonce) parameter. The processing requirements for this parameter are as follows: - o An RS sending a "cnonce" parameter in an AS Request Creation Hints - message MUST store information to validate that a given cnonce is - fresh. How this is implemented internally is out of scope for - this specification. Expiration of client-nonces should be based - roughly on the time it would take a client to obtain an access - token after receiving the AS Request Creation Hints message, with - some allowance for unexpected delays. + o An RS sending a "cnonce" parameter in an "AS Request Creation + Hints" message MUST store information to validate that a given + cnonce is fresh. How this is implemented internally is out of + scope for this specification. Expiration of client-nonces should + be based roughly on the time it would take a client to obtain an + access token after receiving the "AS Request Creation Hints" + message, with some allowance for unexpected delays. - o A client receiving a "cnonce" parameter in an AS Request Creation - Hints message MUST include this in the parameters when requesting + o A client receiving a "cnonce" parameter in an "AS Request Creation + Hints" message MUST include this in the parameters when requesting an access token at the AS, using the "cnonce" parameter from Section 5.8.4.4. o If an AS grants an access token request containing a "cnonce" parameter, it MUST include this value in the access token, using the "cnonce" claim specified in Section 5.10. o An RS that is using the client-nonce mechanism and that receives an access token MUST verify that this token contains a cnonce claim, with a client-nonce value that is fresh according to the @@ -974,38 +964,38 @@ 5.8. The Token Endpoint In standard OAuth 2.0, the AS provides the token endpoint for submitting access token requests. This framework extends the functionality of the token endpoint, giving the AS the possibility to help the client and RS to establish shared keys or to exchange their public keys. Furthermore, this framework defines encodings using CBOR, as a substitute for JSON. - The endpoint may, however, be exposed over HTTPS as in classical - OAuth or even other transports. A profile MUST define the details of - the mapping between the fields described below, and these transports. - If HTTPS is used, JSON or CBOR payloads may be supported. If JSON - payloads are used, the semantics of Section 4 of the OAuth 2.0 - specification MUST be followed (with additions as described below). - If CBOR payload is supported, the semantics described below MUST be + The endpoint may also be exposed over HTTPS as in classical OAuth or + even other transports. A profile MUST define the details of the + mapping between the fields described below, and these transports. If + HTTPS is used, the semantics of Sections 4.1.3 and 4.1.4 of the OAuth + 2.0 specification MUST be followed (with additions as described + below). If the CoAP is some other transport with CBOR payload format + is supported, the semantics described in this section MUST be followed. For the AS to be able to issue a token, the client MUST be authenticated and present a valid grant for the scopes requested. Profiles of this framework MUST specify how the AS authenticates the client and how the communication between client and AS is protected, fulfilling the requirements specified in Section 5. - The default name of this endpoint in an url-path is '/token', however - implementations are not required to use this name and can define - their own instead. + The default name of this endpoint in an url-path SHOULD be '/token'. + However, implementations are not required to use this name and can + define their own instead. The figures of this section use CBOR diagnostic notation without the integer abbreviations for the parameters or their values for illustrative purposes. Note that implementations MUST use the integer abbreviations and the binary CBOR encoding, if the CBOR encoding is used. 5.8.1. Client-to-AS Request The client sends a POST request to the token endpoint at the AS. The @@ -1023,45 +1013,45 @@ access token bound to a specific audience. o The "cnonce" parameter defined in Section 5.8.4.4 is REQUIRED if the RS provided a client-nonce in the "AS Request Creation Hints" message Section 5.3 o The "scope" parameter MAY be encoded as a byte string instead of the string encoding specified in section 3.3 of [RFC6749], in order allow compact encoding of complex scopes. The syntax of such a binary encoding is explicitly not specified here and left - to profiles or applications, specifically note that a binary + to profiles or applications. Note specifically that a binary encoded scope does not necessarily use the space character '0x20' to delimit scope-tokens. o The client can send an empty (null value) "ace_profile" parameter to indicate that it wants the AS to include the "ace_profile" parameter in the response. See Section 5.8.4.3. o A client MUST be able to use the parameters from [I-D.ietf-ace-oauth-params] in an access token request to the token endpoint and the AS MUST be able to process these additional parameters. The default behavior, is that the AS generates a symmetric proof-of- possession key for the client. In order to use an asymmetric key pair or to re-use a key previously established with the RS, the client is supposed to use the "req_cnf" parameter from [I-D.ietf-ace-oauth-params]. - If CBOR is used then these parameters MUST be provided as a CBOR map. + If CoAP is used then these parameters MUST be provided in a CBOR map, + see Figure 12. When HTTP is used as a transport then the client makes a request to - the token endpoint by sending the parameters using the "application/ - x-www-form-urlencoded" format with a character encoding of UTF-8 in - the HTTP request entity-body, as defined in section 3.2 of [RFC6749]. + the token endpoint, the parameters MUST be encoded as defined in + Appendix B of [RFC6749]. The following examples illustrate different types of requests for proof-of-possession tokens. Figure 5 shows a request for a token with a symmetric proof-of- possession key. The content is displayed in CBOR diagnostic notation, without abbreviations for better readability. Header: POST (Code=0.02) Uri-Host: "as.example.com" @@ -1120,21 +1110,21 @@ Uri-Path: "token" Content-Format: "application/ace+cbor" Payload: { "client_id" : "myclient", "audience" : "valve424", "scope" : "read", "req_cnf" : { "kid" : b64'6kg0dXJM13U' } - }W + } Figure 7: Example request for an access token bound to a key reference. Refresh tokens are typically not stored as securely as proof-of- possession keys in requesting clients. Proof-of-possession based refresh token requests MUST NOT request different proof-of-possession keys or different audiences in token requests. Refresh token requests can only use to request access tokens bound to the same proof-of-possession key and the same audience as access tokens issued @@ -1153,23 +1143,25 @@ issuing a successful response. It is assumed that the AS has prior knowledge of the capabilities of the client and the RS (see Appendix D). This prior knowledge may, for example, be set by the use of a dynamic client registration protocol exchange [RFC7591]. If the client has requested a specific proof-of-possession key using the "req_cnf" parameter from [I-D.ietf-ace-oauth-params], this may also influence which profile the AS selects, as it needs to support the use of the key type requested the client. The content of the successful reply is the Access Information. When - using CBOR payloads, the content MUST be encoded as a CBOR map, - containing parameters as specified in Section 5.1 of [RFC6749], with - the following additions and changes: + using CoAP, the payload MUST be encoded as a CBOR map, when using + HTTP the encoding is a JSON map as specified in seciton 5.1 of + + [RFC6749]. In both cases the parameters specified in Section 5.1 of + [RFC6749] are used, with the following additions and changes: ace_profile: OPTIONAL unless the request included an empty ace_profile parameter in which case it is MANDATORY. This indicates the profile that the client MUST use towards the RS. See Section 5.8.4.3 for the formatting of this parameter. If this parameter is absent, the AS assumes that the client implicitly knows which profile to use towards the RS. token_type: @@ -1229,37 +1221,35 @@ "k" : b64'hJtXhkV8FJG+Onbc6mxCcQh' } } } Figure 9: Example AS response with an access token bound to a symmetric key. 5.8.3. Error Response - The error responses for CoAP-based interactions with the AS are - generally equivalent to the ones for HTTP-based interactions as - defined in Section 5.2 of [RFC6749], with the following exceptions: + The error responses for interactions with the AS are generally + equivalent to the ones defined in Section 5.2 of [RFC6749], with the + following exceptions: - o When using CBOR the raw payload before being processed by the - communication security protocol MUST be encoded as a CBOR map. + o When using CoAP the payload MUST be encoded as a CBOR map, with + the Content-Format "application/ace+cbor". When using HTTP the + payload is encoded in JSON as specified in section 5.2 of + [RFC6749]. o A response code equivalent to the CoAP code 4.00 (Bad Request) MUST be used for all error responses, except for invalid_client where a response code equivalent to the CoAP code 4.01 (Unauthorized) MAY be used under the same conditions as specified in Section 5.2 of [RFC6749]. - o The Content-Format (for CoAP-based interactions) or media type - (for HTTP-based interactions) "application/ace+cbor" MUST be used - for the error response. - o The parameters "error", "error_description" and "error_uri" MUST be abbreviated using the codes specified in Figure 12, when a CBOR encoding is used. o The error code (i.e., value of the "error" parameter) MUST be abbreviated as specified in Figure 10, when a CBOR encoding is used. /---------------------------+-------------\ | Name | CBOR Values | @@ -1275,70 +1265,71 @@ \---------------------------+-------------/ Figure 10: CBOR abbreviations for common error codes In addition to the error responses defined in OAuth 2.0, the following behavior MUST be implemented by the AS: o If the client submits an asymmetric key in the token request that the RS cannot process, the AS MUST reject that request with a response code equivalent to the CoAP code 4.00 (Bad Request) - including the error code "unsupported_pop_key" defined in + including the error code "unsupported_pop_key" specified in Figure 10. o If the client and the RS it has requested an access token for do not share a common profile, the AS MUST reject that request with a response code equivalent to the CoAP code 4.00 (Bad Request) - including the error code "incompatible_ace_profiles" defined in + including the error code "incompatible_ace_profiles" specified in Figure 10. 5.8.4. Request and Response Parameters This section provides more detail about the new parameters that can be used in access token requests and responses, as well as abbreviations for more compact encoding of existing parameters and common parameter values. 5.8.4.1. Grant Type The abbreviations specified in the registry defined in Section 8.5 MUST be used in CBOR encodings instead of the string values defined in [RFC6749], if CBOR payloads are used. /--------------------+------------+------------------------\ | Name | CBOR Value | Original Specification | |--------------------+------------+------------------------| - | password | 0 | [RFC6749] | - | authorization_code | 1 | [RFC6749] | - | client_credentials | 2 | [RFC6749] | - | refresh_token | 3 | [RFC6749] | + | password | 0 | s. 4.3.2 of [RFC6749] | + | authorization_code | 1 | s. 4.1.3 of [RFC6749] | + | client_credentials | 2 | s. 4.4.2 of [RFC6749] | + | refresh_token | 3 | s. 6 of [RFC6749] | \--------------------+------------+------------------------/ Figure 11: CBOR abbreviations for common grant types 5.8.4.2. Token Type The "token_type" parameter, defined in section 5.1 of [RFC6749], allows the AS to indicate to the client which type of access token it is receiving (e.g., a bearer token). This document registers the new value "PoP" for the OAuth Access Token Types registry, specifying a proof-of-possession token. How the proof-of-possession by the client to the RS is performed MUST be specified by the profiles. The values in the "token_type" parameter MUST use the CBOR abbreviations defined in the registry specified by Section 8.7, if a CBOR encoding is used. In this framework the "pop" value for the "token_type" parameter is - the default. The AS may, however, provide a different value. + the default. The AS may, however, provide a different value from + those registered in [IANA.OAuthAccessTokenTypes]. 5.8.4.3. Profile Profiles of this framework MUST define the communication protocol and the communication security protocol between the client and the RS. The security protocol MUST provide encryption, integrity and replay protection. It MUST also provide a binding between requests and responses. Furthermore profiles MUST define a list of allowed proof- of-possession methods, if they support proof-of-possession tokens. @@ -1348,32 +1339,31 @@ readability and for JSON-based interactions, it MUST NOT be used for CBOR-based interactions. Profiles MUST register their identifier in the registry defined in Section 8.8. Profiles MAY define additional parameters for both the token request and the Access Information in the access token response in order to support negotiation or signaling of profile specific parameters. Clients that want the AS to provide them with the "ace_profile" parameter in the access token response can indicate that by sending a - ace_profile parameter with a null value (for CBOR-based interactions) - or an empty string (for JSON based interactions) in the access token - request. + ace_profile parameter with a null value for CBOR-based interactions, + or an empty string if CBOR is not used, in the access token request. 5.8.4.4. Client-Nonce This parameter MUST be sent from the client to the AS, if it - previously received a "cnonce" parameter in the AS Request Creation - Hints Section 5.3. The parameter is encoded as a byte string for - CBOR-based interactions, and as a string (Base64 encoded binary) for - JSON-based interactions. It MUST copy the value from the cnonce - parameter in the AS Request Creation Hints. + previously received a "cnonce" parameter in the "AS Request Creation + Hints" Section 5.3. The parameter is encoded as a byte string for + CBOR-based interactions, and as a string (Base64 encoded binary) if + CBOR is not used. It MUST copy the value from the cnonce parameter + in the "AS Request Creation Hints". 5.8.5. Mapping Parameters to CBOR If CBOR encoding is used, all OAuth parameters in access token requests and responses MUST be mapped to CBOR types as specified in the registry defined by Section 8.10, using the given integer abbreviation for the map keys. Note that we have aligned the abbreviations corresponding to claims with the abbreviations defined in [RFC8392]. @@ -1405,60 +1395,58 @@ | password | 36 | text string | | refresh_token | 37 | byte string | | ace_profile | 38 | integer | | cnonce | 39 | byte string | \-------------------+----------+---------------------/ Figure 12: CBOR mappings used in token requests and responses 5.9. The Introspection Endpoint - Token introspection [RFC7662] can be OPTIONALLY provided by the AS, - and is then used by the RS and potentially the client to query the AS + Token introspection [RFC7662] MAY be implemented by the AS, and the + RS. When implemented, it MAY be used by the RS and to query the AS for metadata about a given token, e.g., validity or scope. Analogous to the protocol defined in [RFC7662] for HTTP and JSON, this section defines adaptations to more constrained environments using CBOR and leaving the choice of the application protocol to the profile. Communication between the requesting entity and the introspection endpoint at the AS MUST be integrity protected and encrypted. The communication security protocol MUST also provide a binding between - requests and responses. Furthermore the two interacting parties MUST - perform mutual authentication. Finally the AS SHOULD verify that the - requesting entity has the right to access introspection information - about the provided token. Profiles of this framework that support - introspection MUST specify how authentication and communication - security between the requesting entity and the AS is implemented. - - The default name of this endpoint in an url-path is '/introspect', - however implementations are not required to use this name and can - define their own instead. + requests and responses. Furthermore, the two interacting parties + MUST perform mutual authentication. Finally, the AS SHOULD verify + that the requesting entity has the right to access introspection + information about the provided token. Profiles of this framework + that support introspection MUST specify how authentication and + communication security between the requesting entity and the AS is + implemented. - The figures of this section uses CBOR diagnostic notation without the - integer abbreviations for the parameters or their values for better - readability. + The default name of this endpoint in an url-path SHOULD be + '/introspect'. However, implementations are not required to use this + name and can define their own instead. - Note that supporting introspection is OPTIONAL for implementations of - this framework. + The figures of this section use the CBOR diagnostic notation without + the integer abbreviations for the parameters and their values for + better readability. 5.9.1. Introspection Request The requesting entity sends a POST request to the introspection endpoint at the AS. The profile MUST specify how the communication - is protected. If CBOR is used, the payload MUST be encoded as a CBOR + is protected. If CoAP is used, the payload MUST be encoded as a CBOR map with a "token" entry containing the access token. Further optional parameters representing additional context that is known by the requesting entity to aid the AS in its response MAY be included. For CoAP-based interaction, all messages MUST use the content type - "application/ace+cbor", while for HTTP-based interactions the - equivalent media type "application/ace+cbor" MUST be used. + "application/ace+cbor". For HTTP the encoding defined in section 2.1 + of [RFC7662] is used. The same parameters are required and optional as in Section 2.1 of [RFC7662]. For example, Figure 13 shows an RS calling the token introspection endpoint at the AS to query about an OAuth 2.0 proof-of-possession token. Note that object security based on OSCORE [RFC8613] is assumed in this example, therefore the Content-Format is "application/oscore". Figure 14 shows the decoded payload. @@ -1481,31 +1469,36 @@ 5.9.2. Introspection Response If the introspection request is authorized and successfully processed, the AS sends a response with the response code equivalent to the CoAP code 2.01 (Created). If the introspection request was invalid, not authorized or couldn't be processed the AS returns an error response as described in Section 5.9.3. In a successful response, the AS encodes the response parameters in a - map including with the same required and optional parameters as in - Section 2.2 of [RFC7662] with the following addition: + map. If CoAP is used, this MUST be encoded as a CBOR map, if HTTP is + used the JSON encoding specified in section 2.2 of [RFC7662] is used. + The map containing the response payload includes the same required + and optional parameters as in Section 2.2 of [RFC7662] with the + following additions: ace_profile OPTIONAL. This indicates the profile that the RS MUST use with the client. See Section 5.8.4.3 for more details on the - formatting of this parameter. + formatting of this parameter. If this parameter is absent, the AS + assumes that the RS implicitly knows which profile to use towards + the client. cnonce OPTIONAL. A client-nonce provided to the AS by the client. The RS MUST verify that this corresponds to the client-nonce - previously provided to the client in the AS Request Creation - Hints. See Section 5.3 and Section 5.8.4.4. + previously provided to the client in the "AS Request Creation + Hints". See Section 5.3 and Section 5.8.4.4. exi OPTIONAL. The "expires-in" claim associated to this access token. See Section 5.10.3. Furthermore [I-D.ietf-ace-oauth-params] defines more parameters that the AS MUST be able to use when responding to a request to the introspection endpoint. For example, Figure 15 shows an AS response to the introspection request in Figure 13. Note that this example contains the "cnf" @@ -1528,47 +1521,48 @@ } Figure 15: Example introspection response. 5.9.3. Error Response The error responses for CoAP-based interactions with the AS are equivalent to the ones for HTTP-based interactions as defined in Section 2.3 of [RFC7662], with the following differences: - o If content is sent and CBOR is used the payload MUST be encoded as + o If content is sent and CoAP is used the payload MUST be encoded as a CBOR map and the Content-Format "application/ace+cbor" MUST be - used. + used. For HTTP the encoding defined in section 2.3 of [RFC6749] + is used. o If the credentials used by the requesting entity (usually the RS) are invalid the AS MUST respond with the response code equivalent to the CoAP code 4.01 (Unauthorized) and use the required and - optional parameters from Section 5.2 in [RFC6749]. + optional parameters from Section 2.3 in [RFC7662]. o If the requesting entity does not have the right to perform this introspection request, the AS MUST respond with a response code equivalent to the CoAP code 4.03 (Forbidden). In this case no payload is returned. o The parameters "error", "error_description" and "error_uri" MUST be abbreviated using the codes specified in Figure 12. o The error codes MUST be abbreviated using the codes specified in the registry defined by Section 8.4. Note that a properly formed and authorized query for an inactive or otherwise invalid token does not warrant an error response by this specification. In these cases, the authorization server MUST instead respond with an introspection response with the "active" field set to "false". -5.9.4. Mapping Introspection parameters to CBOR +5.9.4. Mapping Introspection Parameters to CBOR If CBOR is used, the introspection request and response parameters MUST be mapped to CBOR types as specified in the registry defined by Section 8.12, using the given integer abbreviation for the map key. Note that we have aligned abbreviations that correspond to a claim with the abbreviations defined in [RFC8392] and the abbreviations of parameters with the same name from Section 5.8.5. /-------------------+----------+-------------------------\ @@ -1596,22 +1590,22 @@ | username | 35 | text string | | ace_profile | 38 | integer | | cnonce | 39 | byte string | | exi | 40 | unsigned integer | \-------------------+----------+-------------------------/ Figure 16: CBOR Mappings to Token Introspection Parameters. 5.10. The Access Token - This framework RECOMMENDS the use of CBOR web token (CWT) as - specified in [RFC8392]. + In this framework the use of CBOR Web Token (CWT) as specified in + [RFC8392] is RECOMMENDED. In order to facilitate offline processing of access tokens, this document uses the "cnf" claim from [RFC8747] and the "scope" claim from [RFC8693] for JWT- and CWT-encoded tokens. In addition to string encoding specified for the "scope" claim, a binary encoding MAY be used. The syntax of such an encoding is explicitly not specified here and left to profiles or applications, specifically note that a binary encoded scope does not necessarily use the space character '0x20' to delimit scope-tokens. @@ -1631,38 +1625,44 @@ information about the proof-of-possession method used by the client, needs to be transported to the RS so that the RS can authenticate and authorize the client request. This section defines a method for transporting the access token to the RS using a RESTful protocol such as CoAP. Profiles of this framework MAY define other methods for token transport. The method consists of an authz-info endpoint, implemented by the RS. A client using this method MUST make a POST request to the authz-info - endpoint at the RS with the access token in the payload. The RS - receiving the token MUST verify the validity of the token. If the - token is valid, the RS MUST respond to the POST request with 2.01 - (Created). Section Section 5.10.1.1 outlines how an RS MUST proceed - to verify the validity of an access token. + endpoint at the RS with the access token in the payload. The CoAP + Content-Format or HTTP Media Type MUST reflect the format of the + token, e.g. application/cwt for CBOR Web Tokens, if no Content-Format + or Media Type is defined for the token format, application/octet- + stream MUST be used. + + The RS receiving the token MUST verify the validity of the token. If + the token is valid, the RS MUST respond to the POST request with a + response code equivalent to CoAP's 2.01 (Created). Section 5.10.1.1 + outlines how an RS MUST proceed to verify the validity of an access + token. The RS MUST be prepared to store at least one access token for future use. This is a difference to how access tokens are handled in OAuth 2.0, where the access token is typically sent along with each request, and therefore not stored at the RS. - This specification RECOMMENDS that an RS stores only one token per - proof-of-possession key. This means that an additional token linked - to the same key will supersede any existing token at the RS, by - replacing the corresponding authorization information. The reason is - that this greatly simplifies (constrained) implementations, with - respect to required storage and resolving a request to the applicable - token. + When using this framework it is RECOMMENDED that an RS stores only + one token per proof-of-possession key. This means that an additional + token linked to the same key will supersede any existing token at the + RS, by replacing the corresponding authorization information. The + reason is that this greatly simplifies (constrained) implementations, + with respect to required storage and resolving a request to the + applicable token. If the payload sent to the authz-info endpoint does not parse to a token, the RS MUST respond with a response code equivalent to the CoAP code 4.00 (Bad Request). The RS MAY make an introspection request to validate the token before responding to the POST request to the authz-info endpoint, e.g. if the token is an opaque reference. Some transport protocols may provide a way to indicate that the RS is busy and the client should retry after an interval; this type of status update would be @@ -1677,64 +1677,65 @@ The default name of this endpoint in an url-path is '/authz-info', however implementations are not required to use this name and can define their own instead. 5.10.1.1. Verifying an Access Token When an RS receives an access token, it MUST verify it before storing it. The details of token verification depends on various aspects, including the token encoding, the type of token, the security protection applied to the token, and the claims. The token encoding - matters since the security wrapper differs between the token + matters since the security protection differs between the token encodings. For example, a CWT token uses COSE while a JWT token uses JOSE. The type of token also has an influence on the verification procedure since tokens may be self-contained whereby token verification may happen locally at the RS while a token-by-reference requires further interaction with the authorization server, for example using token introspection, to obtain the claims associated - with the token reference. Self-contained tokens MUST, at a minimum, - be integrity protected but they MAY also be encrypted. + with the token reference. Self-contained tokens MUST, at least be + integrity protected but they MAY also be encrypted. For self-contained tokens the RS MUST process the security protection of the token first, as specified by the respective token format. For CWT the description can be found in [RFC8392] and for JWT the relevant specification is [RFC7519]. This MUST include a verification that security protection (and thus the token) was generated by an AS that has the right to issue access tokens for this RS. In case the token is communicated by reference the RS needs to obtain the claims first. When the RS uses token introspection the relevant specification is [RFC7662] with CoAP transport specified in Section 5.9. Errors may happen during this initial processing stage: - o If token or claim verification fails, the RS MUST discard the - token and, if this was an interaction with authz-info, return an - error message with a response code equivalent to the CoAP code - 4.01 (Unauthorized). + o If the verification of the security wrapper fails, or the token + was issued by an AS that does not have the right to issue tokens + for the receiving RS, the RS MUST discard the token and, if this + was an interaction with authz-info, return an error message with a + response code equivalent to the CoAP code 4.01 (Unauthorized). o If the claims cannot be obtained the RS MUST discard the token and, in case of an interaction via the authz-info endpoint, return an error message with a response code equivalent to the CoAP code 4.00 (Bad Request). Next, the RS MUST verify claims, if present, contained in the access token. Errors are returned when claim checks fail, in the order of priority of this list: - iss The issuer claim must identify an AS that has the authority to - issue access tokens for the receiving RS. If that is not the case - the RS MUST discard the token. If this was an interaction with - authz-info, the RS MUST also respond with a response code - equivalent to the CoAP code 4.01 (Unauthorized). + iss The issuer claim (if present) must identify the AS that has + produced the security protection for the access token. If that is + not the case the RS MUST discard the token. If this was an + interaction with authz-info, the RS MUST also respond with a + response code equivalent to the CoAP code 4.01 (Unauthorized). exp The expiration date must be in the future. If that is not the case the RS MUST discard the token. If this was an interaction with authz-info the RS MUST also respond with a response code equivalent to the CoAP code 4.01 (Unauthorized). Note that the RS has to terminate access rights to the protected resources at the time when the tokens expire. aud The audience claim must refer to an audience that the RS identifies with. If that is not the case the RS MUST discard the @@ -1767,21 +1768,21 @@ client. 5.10.1.2. Protecting the Authorization Information Endpoint As this framework can be used in RESTful environments, it is important to make sure that attackers cannot perform unauthorized requests on the authz-info endpoints, other than submitting access tokens. Specifically it SHOULD NOT be possible to perform GET, DELETE or PUT - on the authz-info endpoint and on it's children (if any). + on the authz-info endpoint and on its children (if any). The POST method SHOULD NOT be allowed on children of the authz-info endpoint. The RS SHOULD implement rate limiting measures to mitigate attacks aiming to overload the processing capacity of the RS by repeatedly submitting tokens. For CoAP-based communication the RS could use the mechanisms from [RFC8516] to indicate that it is overloaded. 5.10.2. Client Requests to the RS @@ -1799,26 +1800,26 @@ The response code MUST be 4.01 (Unauthorized) in case the client has not performed the proof-of-possession, or if RS has no valid access token for the client. If RS has an access token for the client but the token does not authorize access for the resource that was requested, RS MUST reject the request with a 4.03 (Forbidden). If RS has an access token for the client but it does not cover the action that was requested on the resource, RS MUST reject the request with a 4.05 (Method Not Allowed). Note: The use of the response codes 4.03 and 4.05 is intended to - prevent infinite loops where a dumb Client optimistically tries to + prevent infinite loops where a dumb client optimistically tries to access a requested resource with any access token received from AS. As malicious clients could pretend to be C to determine C's privileges, these detailed response codes must be used only when a certain level of security is already available which can be achieved - only when the Client is authenticated. + only when the client is authenticated. Note: The RS MAY use introspection for timely validation of an access token, at the time when a request is presented. Note: Matching the claims of the access token (e.g., scope) to a specific request is application specific. If the request matches a valid token and the client has performed the proof-of-possession for that token, the RS continues to process the request as specified by the underlying application. @@ -1842,23 +1843,23 @@ introspection request as specified in Section 5.9. This requires the RS to have a reliable network connection to the AS and to be able to handle two secure sessions in parallel (C to RS and RS to AS). o In order to support token expiration for devices that have no reliable way of synchronizing their internal clocks, this specification defines the following approach: The claim "exi" ("expires in") can be used, to provide the RS with the lifetime of the token in seconds from the time the RS first receives the - token. For CBOR-based interaction this parameter is encoded as - unsigned integer, while JSON-based interactions encode this as - JSON number. + token. This mechanism only works for self-contained tokens, i.e. + CWTs and JWTs. For CWTs this parameter is encoded as unsigned + integer, while JWTs encode this as JSON number. o Processing this claim requires that the RS does the following: * For each token the RS receives, that contains an "exi" claim: Keep track of the time it received that token and revisit that list regularly to expunge expired tokens. * Keep track of the identifiers of tokens containing the "exi" claim that have expired (in order to avoid accepting them again). In order to avoid an unbounded memory usage growth, @@ -1867,21 +1868,26 @@ + When creating the token, the AS MUST add a 'cti' claim ( or 'jti' for JWTs) to the access token. The value of this claim MUST be created as the binary representation of the concatenation of the identifier of the RS with a sequence number counting the tokens containing an 'exi' claim, issued by this AS for the RS. + The RS MUST store the highest sequence number of an expired token containing the "exi" claim that it has seen, and treat - tokens with lower sequence numbers as expired. + tokens with lower sequence numbers as expired. Note that + this could lead to discarding valid tokens with lower + sequence numbers, if the AS where to issue tokens of + different validity time for the same RS. The assumption is + that typically tokens in such a scenario would all have the + same validity time. If a token that authorizes a long running request such as a CoAP Observe [RFC7641] expires, the RS MUST send an error response with the response code equivalent to the CoAP code 4.01 (Unauthorized) to the client and then terminate processing the long running request. 5.10.4. Key Expiration The AS provides the client with key material that the RS uses. This can either be a common symmetric PoP-key, or an asymmetric key used @@ -1980,28 +1986,30 @@ to an eavesdropper thereby completely negating proof-of-possession security. The requirements for communication security of profiles are specified in Section 5. Additional protection for the access token can be applied by encrypting it, for example encryption of CWTs is specified in Section 5.1 of [RFC8392]. Such additional protection can be necessary if the token is later transferred over an insecure connection (e.g. when it is sent to the authz-info endpoint). - Developers MUST ensure that the ephemeral credentials (i.e., the - private key or the session key) are not leaked to third parties. An - adversary in possession of the ephemeral credentials bound to the - access token will be able to impersonate the client. Be aware that - this is a real risk with many constrained environments, since - adversaries can often easily get physical access to the devices. - This risk can also be mitigated to some extent by making sure that - keys are refreshed more frequently. + Care must by taken by developers to prevent leakage of the PoP + credentials (i.e., the private key or the symmetric key). An + adversary in possession of the PoP credentials bound to the access + token will be able to impersonate the client. Be aware that this is + a real risk with many constrained environments, since adversaries may + get physical access to the devices and can therefore use phyical + extraction techniques to gain access to memory contents. This risk + can be mitigated to some extent by making sure that keys are + refreshed frequently, by using software isolation techniques and by + using hardware security. 6.3. Long-Term Credentials Both clients and RSs have long-term credentials that are used to secure communications, and authenticate to the AS. These credentials need to be protected against unauthorized access. In constrained devices, deployed in publicly accessible places, such protection can be difficult to achieve without specialized hardware (e.g. secure key storage memory). @@ -2017,35 +2025,28 @@ credentials that are suspected to have been compromised or that have been lost. Operators also SHOULD have procedures for decommissioning devices, that include securely erasing credentials and other security critical material in the devices being decommissioned. 6.4. Unprotected AS Request Creation Hints Initially, no secure channel exists to protect the communication - between C and RS. Thus, C cannot determine if the AS Request - Creation Hints contained in an unprotected response from RS to an + between C and RS. Thus, C cannot determine if the "AS Request + Creation Hints" contained in an unprotected response from RS to an unauthorized request (see Section 5.3) are authentic. C therefore MUST determine if an AS is authorized to provide access tokens for a - certain RS. - - A compromised RS may use the hints for attempting to trick a client - into contacting an AS that is not supposed to be in charge of that - RS. Therefore, C must not communicate with an AS if it cannot - determine that this AS has the authority to issue access tokens for - this RS. Otherwise, a compromised RS may use this to perform a - denial of service attack against a specific AS, by redirecting a - large number of client requests to that AS. + certain RS. How this determination is implemented is out of scope + for this document and left to the applications. -6.5. Minimal security requirements for communication +6.5. Minimal Security Requirements for Communication This section summarizes the minimal requirements for the communication security of the different protocol interactions. C-AS All communication between the client and the Authorization Server MUST be encrypted, integrity and replay protected. Furthermore responses from the AS to the client MUST be bound to the client's request to avoid attacks where the attacker swaps the intended response for an older one valid for a previous request. This requires that the client and the Authorization Server have @@ -2087,49 +2088,48 @@ negotiation between C and RS, the client MUST have learned what profile the RS supports (e.g. from the AS or pre-configured) and initiate the communication accordingly. 6.6. Token Freshness and Expiration An RS that is offline faces the problem of clock drift. Since it cannot synchronize its clock with the AS, it may be tricked into accepting old access tokens that are no longer valid or have been compromised. In order to prevent this, an RS may use the nonce-based - mechanism defined in Section 5.3 to ensure freshness of an Access - Token subsequently presented to this RS. + mechanism (cnonce) defined in Section 5.3 to ensure freshness of an + Access Token subsequently presented to this RS. Another problem with clock drift is that evaluating the standard token expiration claim "exp" can give unpredictable results. Acceptable ranges of clock drift are highly dependent on the concrete application. Important factors are how long access tokens are valid, and how critical timely expiration of access token is. The expiration mechanism implemented by the "exi" claim, based on the first time the RS sees the token was defined to provide a more predictable alternative. The "exi" approach has some drawbacks that need to be considered: A malicious client may hold back tokens with the "exi" claim in order to prolong their lifespan. If an RS loses state (e.g. due to an unscheduled reboot), it may - loose the current values of counters tracking the "exi" claims of + lose the current values of counters tracking the "exi" claims of tokens it is storing. The first drawback is inherent to the deployment scenario and the "exi" solution. It can therefore not be mitigated without requiring - the the RS be online at times. The second drawback can be mitigated - by regularly storing the value of "exi" counters to persistent - memory. + the RS be online at times. The second drawback can be mitigated by + regularly storing the value of "exi" counters to persistent memory. -6.7. Combining profiles +6.7. Combining Profiles There may be use cases were different profiles of this framework are combined. For example, an MQTT-TLS profile is used between the client and the RS in combination with a CoAP-DTLS profile for interactions between the client and the AS. The security of a profile MUST NOT depend on the assumption that the profile is used for all the different types of interactions in this framework. 6.8. Unprotected Information @@ -2143,55 +2143,55 @@ who has intercepted this token. As far as error messages are concerned, this framework is written under the assumption that, in general, the benefits of detailed error messages outweigh the risk due to information leakage. For particular use cases, where this assessment does not apply, detailed error messages can be replaced by more generic ones. In some scenarios it may be possible to protect the communication with the authz-info endpoint (e.g. through DTLS with only server-side - authentication). In cases where this is not possible this framework - RECOMMENDS to use encrypted CWTs or tokens that are opaque references - and need to be subjected to introspection by the RS. + authentication). In cases where this is not possible, it is + RECOMMENDED to use encrypted CWTs or tokens that are opaque + references and need to be subjected to introspection by the RS. If the initial unauthorized resource request message (see Section 5.2) is used, the client MUST make sure that it is not sending sensitive content in this request. While GET and DELETE requests only reveal the target URI of the resource, POST and PUT requests would reveal the whole payload of the intended operation. Since the client is not authenticated at the point when it is submitting an access token to the authz-info endpoint, attackers may be pretending to be a client and trying to trick an RS to use an obsolete profile that in turn specifies a vulnerable security mechanism via the authz-info endpoint. Such an attack would require a valid access token containing an "ace_profile" claim requesting the use of said obsolete profile. Resource Owners should update the configuration of their RS's to prevent them from using such obsolete profiles. -6.9. Identifying audiences +6.9. Identifying Audiences The audience claim as defined in [RFC7519] and the equivalent "audience" parameter from [RFC8693] are intentionally vague on how to match the audience value to a specific RS. This is intended to allow application specific semantics to be used. This section attempts to give some general guidance for the use of audiences in constrained environments. URLs are not a good way of identifying mobile devices that can switch networks and thus be associated with new URLs. If the audience represents a single RS, and asymmetric keys are used, the RS can be uniquely identified by a hash of its public key. If this approach is - used this framework RECOMMENDS to apply the procedure from section 3 - of [RFC6920]. + used it is RECOMMENDED to apply the procedure from section 3 of + [RFC6920]. If the audience addresses a group of resource servers, the mapping of group identifier to individual RS has to be provisioned to each RS before the group-audience is usable. Managing dynamic groups could be an issue, if any RS is not always reachable when the groups' memberships change. Furthermore, issuing access tokens bound to symmetric proof-of-possession keys that apply to a group-audience is problematic, as an RS that is in possession of the access token can impersonate the client towards the other RSs that are part of the group. It is therefore NOT RECOMMENDED to issue access tokens bound @@ -2202,21 +2202,21 @@ intended RS. Errors in this process can lead to the client inadvertently obtaining a token for the wrong RS. The correct values for "audience" can either be provisioned to the client as part of its configuration, or dynamically looked up by the client in some directory. In the latter case the integrity and correctness of the directory data must be assured. Note that the "audience" hint provided by the RS as part of the "AS Request Creation Hints" Section 5.3 is not typically source authenticated and integrity protected, and should therefore not be treated a trusted value. -6.10. Denial of service against or with Introspection +6.10. Denial of Service Against or with Introspection The optional introspection mechanism provided by OAuth and supported in the ACE framework allows for two types of attacks that need to be considered by implementers. First, an attacker could perform a denial of service attack against the introspection endpoint at the AS in order to prevent validation of access tokens. To maintain the security of the system, an RS that is configured to use introspection MUST NOT allow access based on a token for which it couldn't reach the introspection endpoint. @@ -2266,23 +2266,23 @@ possession towards different RSs. A set of colluding RSs or an attacker able to obtain the access tokens will be able to link the requests, or even to determine the client's identity. An unprotected response to an unauthorized request (see Section 5.3) may disclose information about RS and/or its existing relationship with C. It is advisable to include as little information as possible in an unencrypted response. Even the absolute URI of the AS may reveal sensitive information about the service that RS provides. Developers must ensure that the RS does not disclose information that - has an impact on the privacy of the stakeholders in the AS Request - Creation Hints. They may choose to use a different mechanism for the - discovery of the AS if necessary. If means of encrypting + has an impact on the privacy of the stakeholders in the "AS Request + Creation Hints". They may choose to use a different mechanism for + the discovery of the AS if necessary. If means of encrypting communication between C and RS already exist, more detailed information may be included with an error response to provide C with sufficient information to react on that particular error. 8. IANA Considerations This document creates several registries with a registration policy of "Expert Review"; guidelines to the experts are given in Section 8.17. @@ -2309,29 +2309,30 @@ Value Type The CBOR data types allowable for the values of this parameter. Reference This contains a pointer to the public specification of the request creation hint abbreviation, if one exists. This registry will be initially populated by the values in Figure 2. The Reference column for all of these entries will be this document. -8.2. CoRE Resource Type registry +8.2. CoRE Resource Type Registry IANA is requested to register a new Resource Type (rt=) Link Target Attribute in the "Resource Type (rt=) Link Target Attribute Values" subregistry under the "Constrained RESTful Environments (CoRE) Parameters" [IANA.CoreParameters] registry: - rt="ace.ai". This resource type describes an ACE-OAuth authz-info - endpoint resource. + o Value: "ace.ai" + o Description: ACE-OAuth authz-info endpoint resource. + o Reference: [this document] Specific ACE-OAuth profiles can use this common resource type for defining their profile-specific discovery processes. 8.3. OAuth Extensions Error Registration This specification registers the following error values in the OAuth Extensions Error registry [IANA.OAuthExtensionsErrorRegistry]. o Error name: "unsupported_pop_key" @@ -2629,21 +2630,21 @@ protocol parameters defined in [this document]. Security considerations: See Section 6 of [this document] Interoperability considerations: N/A Published specification: [this document] Applications that use this media type: The type is used by authorization servers, clients and resource servers that support the - ACE framework as specified in [this document]. + ACE framework with CBOR encoding as specified in [this document]. Fragment identifier considerations: N/A Additional information: N/A Person & email address to contact for further information: Intended usage: COMMON @@ -2722,33 +2722,36 @@ Thanks to Jim Schaad and Mike Jones for their comprehensive reviews. Thanks to Benjamin Kaduk for his input on various questions related to this work. Thanks to Cigdem Sengul for some very useful review comments. Thanks to Carsten Bormann for contributing the text for the CoRE Resource Type registry. + Thanks to Roman Danyliw for suggesting the Appendix E (including its + contents). + Ludwig Seitz and Goeran Selander worked on this document as part of the CelticPlus project CyberWI, with funding from Vinnova. Ludwig Seitz was also received further funding for this work by Vinnova in the context of the CelticNext project Critisec. 10. References 10.1. Normative References [I-D.ietf-ace-oauth-params] Seitz, L., "Additional OAuth Parameters for Authorization in Constrained Environments (ACE)", draft-ietf-ace-oauth- - params-13 (work in progress), April 2020. + params-14 (work in progress), March 2021. [IANA.CborWebTokenClaims] IANA, "CBOR Web Token (CWT) Claims", . [IANA.CoreParameters] IANA, "Constrained RESTful Environments (CoRE) Parameters", . @@ -2860,30 +2863,43 @@ [BLE] Bluetooth SIG, "Bluetooth Core Specification v5.1", Section 4.4, January 2019, . [I-D.erdtman-ace-rpcc] Seitz, L. and S. Erdtman, "Raw-Public-Key and Pre-Shared- Key as OAuth client credentials", draft-erdtman-ace- rpcc-02 (work in progress), October 2017. + [I-D.ietf-ace-dtls-authorize] + Gerdes, S., Bergmann, O., Bormann, C., Selander, G., and + L. Seitz, "Datagram Transport Layer Security (DTLS) + Profile for Authentication and Authorization for + Constrained Environments (ACE)", draft-ietf-ace-dtls- + authorize-16 (work in progress), March 2021. + + [I-D.ietf-ace-oscore-profile] + Palombini, F., Seitz, L., Selander, G., and M. Gunnarsson, + "OSCORE Profile of the Authentication and Authorization + for Constrained Environments Framework", draft-ietf-ace- + oscore-profile-18 (work in progress), April 2021. + [I-D.ietf-quic-transport] Iyengar, J. and M. Thomson, "QUIC: A UDP-Based Multiplexed and Secure Transport", draft-ietf-quic-transport-34 (work in progress), January 2021. [I-D.ietf-tls-dtls13] Rescorla, E., Tschofenig, H., and N. Modadugu, "The Datagram Transport Layer Security (DTLS) Protocol Version - 1.3", draft-ietf-tls-dtls13-40 (work in progress), January - 2021. + 1.3", draft-ietf-tls-dtls13-41 (work in progress), + February 2021. [Margi10impact] Margi, C., de Oliveira, B., de Sousa, G., Simplicio Jr, M., Barreto, P., Carvalho, T., Naeslund, M., and R. Gold, "Impact of Operating Systems on Wireless Sensor Networks (Security) Applications and Testbeds", Proceedings of the 19th International Conference on Computer Communications and Networks (ICCCN), August 2010. [MQTT5.0] Banks, A., Briggs, E., Borgendale, K., and R. Gupta, "MQTT @@ -3000,21 +3016,21 @@ messages (roughly by a factor of 10 compared to AES) [Margi10impact]. It is therefore important to keep the total communication overhead low, including minimizing the number and size of messages sent and received, which has an impact of choice on the message format and protocol. By using CoAP over UDP and CBOR encoded messages, some of these aspects are addressed. Security protocols contribute to the communication overhead and can, in some cases, be optimized. For example, authentication and key establishment may, in certain cases where security requirements allow, be replaced by provisioning of security - context by a trusted third party, using transport or application + context by a trusted third party, using transport or application- layer security. Low CPU Speed: Some IoT devices are equipped with processors that are significantly slower than those found in most current devices on the Internet. This typically has implications on what timely cryptographic operations a device is capable of performing, which in turn impacts, e.g., protocol latency. Symmetric key cryptography may be used instead of the computationally more @@ -3058,45 +3074,44 @@ Service attacks. The communication interactions this framework builds upon (as shown graphically in Figure 1) may be accomplished using a variety of different protocols, and not all parts of the message flow are used in all applications due to the communication constraints. Deployments making use of CoAP are expected, but this framework is not limited to them. Other protocols such as HTTP, or even protocols such as Bluetooth Smart communication that do not necessarily use IP, could also be used. The latter raises the - need for application layer security over the various interfaces. + need for application-layer security over the various interfaces. In the light of these constraints we have made the following design decisions: CBOR, COSE, CWT: - This framework RECOMMENDS the use of CBOR [RFC8949] as data - format. Where CBOR data needs to be protected, the use of COSE - [RFC8152] is RECOMMENDED. Furthermore, where self-contained - tokens are needed, this framework RECOMMENDS the use of CWT - [RFC8392]. These measures aim at reducing the size of messages - sent over the wire, the RAM size of data objects that need to be - kept in memory and the size of libraries that devices need to - support. + When using this framework, it is RECOMMENDED to use CBOR [RFC8949] + as data format. Where CBOR data needs to be protected, the use of + COSE [RFC8152] is RECOMMENDED. Furthermore, where self-contained + tokens are needed, it is RECOMMENDED to use of CWT [RFC8392]. + These measures aim at reducing the size of messages sent over the + wire, the RAM size of data objects that need to be kept in memory + and the size of libraries that devices need to support. CoAP: - This framework RECOMMENDS the use of CoAP [RFC7252] instead of - HTTP. This does not preclude the use of other protocols - specifically aimed at constrained devices, like, e.g., Bluetooth - Low Energy (see Section 3.2). This aims again at reducing the - size of messages sent over the wire, the RAM size of data objects - that need to be kept in memory and the size of libraries that - devices need to support. + When using this framework, it is RECOMMENDED to use of CoAP + [RFC7252] instead of HTTP. This does not preclude the use of + other protocols specifically aimed at constrained devices, like, + e.g., Bluetooth Low Energy (see Section 3.2). This aims again at + reducing the size of messages sent over the wire, the RAM size of + data objects that need to be kept in memory and the size of + libraries that devices need to support. Access Information: This framework defines the name "Access Information" for data concerning the RS that the AS returns to the client in an access token response (see Section 5.8.2). This aims at enabling scenarios where a powerful client, supporting multiple profiles, needs to interact with an RS for which it does not know the supported profiles and the raw public key. @@ -3121,36 +3136,36 @@ request message is problematic, since many constrained protocols have severe message size limitations at the physical layer (e.g., in the order of 100 bytes). This means that larger packets get fragmented, which in turn combines badly with the high rate of packet loss, and the need to retransmit the whole message if one packet gets lost. Thus separating sending of the request and sending of the access tokens helps to reduce fragmentation. Client Credentials Grant: - This framework RECOMMENDS the use of the client credentials grant - for machine-to-machine communication use cases, where manual - intervention of the resource owner to produce a grant token is not - feasible. The intention is that the resource owner would instead - pre-arrange authorization with the AS, based on the client's own - credentials. The client can then (without manual intervention) - obtain access tokens from the AS. + In this framework the use of the client credentials grant is + RECOMMENDED for machine-to-machine communication use cases, where + manual intervention of the resource owner to produce a grant token + is not feasible. The intention is that the resource owner would + instead pre-arrange authorization with the AS, based on the + client's own credentials. The client can then (without manual + intervention) obtain access tokens from the AS. Introspection: - This framework RECOMMENDS the use of access token introspection in - cases where the client is constrained in a way that it can not - easily obtain new access tokens (i.e. it has connectivity issues - that prevent it from communicating with the AS). In that case - this framework RECOMMENDS the use of a long-term token, that could - be a simple reference. The RS is assumed to be able to + In this framework the use of access token introspection is + RECOMMENDED in cases where the client is constrained in a way that + it can not easily obtain new access tokens (i.e. it has + connectivity issues that prevent it from communicating with the + AS). In that case it is RECOMMENDED to use a long-term token, + that could be a simple reference. The RS is assumed to be able to communicate with the AS, and can therefore perform introspection, in order to learn the claims associated with the token reference. The advantage of such an approach is that the resource owner can change the claims associated to the token reference without having to be in contact with the client, thus granting or revoking access rights. Appendix B. Roles and Responsibilities Resource Owner @@ -3294,21 +3310,21 @@ security protocol for introspection. Section 5.9 o Specify the communication and security protocol for interactions between client and AS. This must provide encryption, integrity protection, replay protection and a binding between requests and responses. Section 5 and Section 5.8 o Specify how/if the authz-info endpoint is protected, including how error responses are protected. Section 5.10.1 o Optionally define other methods of token transport than the authz- info endpoint. Section 5.10.1 -Appendix D. Assumptions on AS knowledge about C and RS +Appendix D. Assumptions on AS Knowledge about C and RS This section lists the assumptions on what an AS should know about a client and an RS in order to be able to respond to requests to the token and introspection endpoints. How this information is established is out of scope for this document. o The identifier of the client or RS. o The profiles that the client or RS supports. o The scopes that the RS supports. o The audiences that the RS identifies with. @@ -3320,63 +3335,92 @@ wrapper (e.g., algorithm, key-wrap algorithm, key-length) that the RS supports. o The expiration time for access tokens issued to this RS (unless the RS accepts a default time chosen by the AS). o The symmetric key shared between client and AS (if any). o The symmetric key shared between RS and AS (if any). o The raw public key of the client or RS (if any). o Whether the RS has synchronized time (and thus is able to use the 'exp' claim) or not. -Appendix E. Deployment Examples +Appendix E. Differences to OAuth 2.0 + + This document adapts OAuth 2.0 to be suitable for constrained + environments. This sections lists the main differences from the + normative requirements of OAuth 2.0. + + o Use of TLS -- OAuth 2.0 requires the use of TLS both to protect + the communication between AS and client when requesting an access + token; between client and RS when accessing a resource and between + AS and RS if introspection is used. This framework requires + similar security properties, but does not require that they be + realized with TLS. See Section 5. + o Cardinality of "grant_type" parameter -- In client-to-AS requests + using OAuth 2.0, the "grant_type" parameter is required (per + [RFC6749]). In this framework, this parameter is optional. See + Section 5.8.1. + o Encoding of "scope" parameter -- In client-to-AS requests using + OAuth 2.0, the "scope" parameter is string encoded (per + [RFC6749]). In this framework, this parameter may also be encoded + as a byte string. See Section 5.8.1. + o Cardinality of "token_type" parameter -- in AS-to-client responses + using OAuth 2.0, the token_type parameter is required (per + + [RFC6749]). In this framework, this parameter is optional. See + Section 5.8.2. + o Access token retention -- in OAuth 2.0, the access token is sent + with each request to the RS. In this framework, the RS must be + able to store these tokens for later use. See Section 5.10.1. + +Appendix F. Deployment Examples There is a large variety of IoT deployments, as is indicated in Appendix A, and this section highlights a few common variants. This section is not normative but illustrates how the framework can be applied. For each of the deployment variants, there are a number of possible security setups between clients, resource servers and authorization servers. The main focus in the following subsections is on how authorization of a client request for a resource hosted by an RS is performed. This requires the security of the requests and responses between the clients and the RS to be considered. Note: CBOR diagnostic notation is used for examples of requests and responses. -E.1. Local Token Validation +F.1. Local Token Validation In this scenario, the case where the resource server is offline is considered, i.e., it is not connected to the AS at the time of the access request. This access procedure involves steps A, B, C, and F of Figure 1. Since the resource server must be able to verify the access token locally, self-contained access tokens must be used. This example shows the interactions between a client, the authorization server and a temperature sensor acting as a resource server. Message exchanges A and B are shown in Figure 17. A: The client first generates a public-private key pair used for communication security with the RS. The client sends a CoAP POST request to the token endpoint at the AS. The security of this request can be transport or application - layer. It is up the the communication security profile to define. - - In the example it is assumed that both client and AS have - performed mutual authentication e.g. via DTLS. The request - contains the public key of the client and the Audience parameter - set to "tempSensorInLivingRoom", a value that the temperature - sensor identifies itself with. The AS evaluates the request and + layer. It is up the communication security profile to define. In + the example it is assumed that both client and AS have performed + mutual authentication e.g. via DTLS. The request contains the + public key of the client and the Audience parameter set to + "tempSensorInLivingRoom", a value that the temperature sensor + identifies itself with. The AS evaluates the request and authorizes the client to access the resource. + B: The AS responds with a 2.05 Content response containing the Access Information, including the access token. The PoP access token contains the public key of the client, and the Access Information contains the public key of the RS. For communication security this example uses DTLS RawPublicKey between the client and the RS. The issued token will have a short validity time, i.e., "exp" close to "iat", in order to mitigate attacks using stolen client credentials. The token includes the claim such as "scope" with the authorized access that an owner of the temperature device can enjoy. In this example, the "scope" claim, @@ -3454,27 +3498,27 @@ "COSE_Key" : { "kid" : b64'1Bg8vub9tLe1gHMzV76e8', "kty" : "EC", "crv" : "P-256", "x" : b64'f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU', "y" : b64'x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0' } } } - Figure 19: Access Token including Public Key of the Client. + Figure 19: Access Token including Public Key of the client. Messages C and F are shown in Figure 20 - Figure 21. C: The client then sends the PoP access token to the authz-info endpoint at the RS. This is a plain CoAP POST request, i.e., no - transport or application layer security is used between client and + transport or application-layer security is used between client and RS since the token is integrity protected between the AS and RS. The RS verifies that the PoP access token was created by a known and trusted AS, that it applies to this RS, and that it is valid. The RS caches the security context together with authorization information about this client contained in the PoP access token. Resource Client Server | | C: +-------->| Header: POST (Code=0.02) @@ -3505,21 +3549,21 @@ | GET | Uri-Path: "temperature" | | | | | | F: |<--------+ Header: 2.05 Content | 2.05 | Payload: | | Figure 21: Resource Request and Response protected by DTLS. -E.2. Introspection Aided Token Validation +F.2. Introspection Aided Token Validation In this deployment scenario it is assumed that a client is not able to access the AS at the time of the access request, whereas the RS is assumed to be connected to the back-end infrastructure. Thus the RS can make use of token introspection. This access procedure involves steps A-F of Figure 1, but assumes steps A and B have been carried out during a phase when the client had connectivity to AS. Since the client is assumed to be offline, at least for a certain period of time, a pre-provisioned access token has to be long-lived. @@ -3535,42 +3579,42 @@ corresponds to message exchanges A and B which are shown in Figure 22. Authorization consent from the resource owner can be pre-configured, but it can also be provided via an interactive flow with the resource owner. An example of this for the key fob case could be that the resource owner has a connected car, he buys a generic key that he wants to use with the car. To authorize the key fob he connects it to his computer that then provides the UI for the device. After that OAuth 2.0 implicit flow can used to authorize the key for his car at - the the car manufacturers AS. + the car manufacturers AS. Note: In this example the client does not know the exact door it will be used to access since the token request is not send at the time of access. So the scope and audience parameters are set quite wide to start with, while tailored values narrowing down the claims to the specific RS being accessed can be provided to that RS during an introspection step. A: The client sends a CoAP POST request to the token endpoint at AS. The request contains the Audience parameter set to "PACS1337" (PACS, Physical Access System), a value the that identifies the physical access control system to which the individual doors are connected. The AS generates an access token as an opaque string, which it can match to the specific client and the targeted audience. It furthermore generates a symmetric proof-of- possession key. The communication security and authentication between client and AS is assumed to have been provided at transport layer (e.g. via DTLS) using a pre-shared security context (psk, rpk or certificate). B: The AS responds with a CoAP 2.05 Content response, containing - as playload the Access Information, including the access token and + as payload the Access Information, including the access token and the symmetric proof-of-possession key. Communication security between C and RS will be DTLS and PreSharedKey. The PoP key is used as the PreSharedKey. Note: In this example we are using a symmetric key for a multi-RS audience, which is not recommended normally (see Section 6.9). However in this case the risk is deemed to be acceptable, since all the doors are part of the same physical access control system, and therefore the risk of a malicious RS impersonating the client towards another RS is low. @@ -3703,304 +3747,29 @@ +-------->| Header: PUT (Code=0.03) | PUT | Uri-Path: "state" | | Payload: | | F: |<--------+ Header: 2.04 Changed | 2.04 | Payload: | | Figure 26: Resource request and response protected by OSCORE -Appendix F. Document Updates - - RFC EDITOR: PLEASE REMOVE THIS SECTION. - -F.1. Version -21 to 22 - - o Provided section numbers in references to OAuth RFC. - o Updated IANA mapping registries to only use "Private Use" and - "Expert Review". - o Made error messages optional for RS at token submission since it - may not be able to send them depending on the profile. - o Corrected errors in examples. - -F.2. Version -20 to 21 - - o Added text about expiration of RS keys. - -F.3. Version -19 to 20 - - o Replaced "req_aud" with "audience" from the OAuth token exchange - draft. - o Updated examples to remove unnecessary elements. - -F.4. Version -18 to -19 - - o Added definition of "Authorization Information". - o Explicitly state that ACE allows encoding refresh tokens in binary - format in addition to strings. - o Renamed "AS Information" to "AS Request Creation Hints" and added - the possibility to specify req_aud and scope as hints. - o Added the "kid" parameter to AS Request Creation Hints. - o Added security considerations about the integrity protection of - tokens with multi-RS audiences. - o Renamed IANA registries mapping OAuth parameters to reflect the - mapped registry. - o Added JWT claim names to CWT claim registrations. - o Added expert review instructions. - o Updated references to TLS from 1.2 to 1.3. - -F.5. Version -17 to -18 - - o Added OSCORE options in examples involving OSCORE. - o Removed requirement for the client to send application/cwt, since - the client has no way to know. - o Clarified verification of tokens by the RS. - o Added exi claim CWT registration. - -F.6. Version -16 to -17 - - o Added references to (D)TLS 1.3. - o Added requirement that responses are bound to requests. - - o Specify that grant_type is OPTIONAL in C2AS requests (as opposed - to REQUIRED in OAuth). - o Replaced examples with hypothetical COSE profile with OSCORE. - o Added requirement for content type application/ace+cbor in error - responses for token and introspection requests and responses. - o Reworked abbreviation space for claims, request and response - parameters. - o Added text that the RS may indicate that it is busy at the authz- - info resource. - o Added section that specifies how the RS verifies an access token. - o Added section on the protection of the authz-info endpoint. - o Removed the expiration mechanism based on sequence numbers. - o Added reference to RFC7662 security considerations. - o Added considerations on minimal security requirements for - communication. - o Added security considerations on unprotected information sent to - authz-info and in the error responses. - -F.7. Version -15 to -16 - - o Added text the RS using RFC6750 error codes. - o Defined an error code for incompatible token request parameters. - o Removed references to the actors draft. - o Fixed errors in examples. - -F.8. Version -14 to -15 - - o Added text about refresh tokens. - o Added text about protection of credentials. - o Rephrased introspection so that other entities than RS can do it. - o Editorial improvements. - -F.9. Version -13 to -14 - - o Split out the 'aud', 'cnf' and 'rs_cnf' parameters to - [I-D.ietf-ace-oauth-params] - o Introduced the "application/ace+cbor" Content-Type. - o Added claim registrations from 'profile' and 'rs_cnf'. - o Added note on schema part of AS Information Section 5.3 - o Realigned the parameter abbreviations to push rarely used ones to - the 2-byte encoding size of CBOR integers. - -F.10. Version -12 to -13 - - o Changed "Resource Information" to "Access Information" to avoid - confusion. - o Clarified section about AS discovery. - o Editorial changes - -F.11. Version -11 to -12 - - o Moved the Request error handling to a section of its own. - o Require the use of the abbreviation for profile identifiers. - o Added rs_cnf parameter in the introspection response, to inform - RS' with several RPKs on which key to use. - o Allowed use of rs_cnf as claim in the access token in order to - inform an RS with several RPKs on which key to use. - o Clarified that profiles must specify if/how error responses are - protected. - o Fixed label number range to align with COSE/CWT. - o Clarified the requirements language in order to allow profiles to - specify other payload formats than CBOR if they do not use CoAP. - -F.12. Version -10 to -11 - - o Fixed some CBOR data type errors. - o Updated boilerplate text - -F.13. Version -09 to -10 - - o Removed CBOR major type numbers. - o Removed the client token design. - o Rephrased to clarify that other protocols than CoAP can be used. - o Clarifications regarding the use of HTTP - -F.14. Version -08 to -09 - - o Allowed scope to be byte strings. - o Defined default names for endpoints. - o Refactored the IANA section for briefness and consistency. - o Refactored tables that define IANA registry contents for - consistency. - o Created IANA registry for CBOR mappings of error codes, grant - types and Authorization Server Information. - o Added references to other document sections defining IANA entries - in the IANA section. - -F.15. Version -07 to -08 - - o Moved AS discovery from the DTLS profile to the framework, see - Section 5.1. - o Made the use of CBOR mandatory. If you use JSON you can use - vanilla OAuth. - o Made it mandatory for profiles to specify C-AS security and RS-AS - security (the latter only if introspection is supported). - o Made the use of CBOR abbreviations mandatory. - - o Added text to clarify the use of token references as an - alternative to CWTs. - o Added text to clarify that introspection must not be delayed, in - case the RS has to return a client token. - o Added security considerations about leakage through unprotected AS - discovery information, combining profiles and leakage through - error responses. - o Added privacy considerations about leakage through unprotected AS - discovery. - o Added text that clarifies that introspection is optional. - o Made profile parameter optional since it can be implicit. - o Clarified that CoAP is not mandatory and other protocols can be - used. - o Clarified the design justification for specific features of the - framework in appendix A. - o Clarified appendix E.2. - o Removed specification of the "cnf" claim for CBOR/COSE, and - replaced with references to [RFC8747] - -F.16. Version -06 to -07 - - o Various clarifications added. - o Fixed erroneous author email. - -F.17. Version -05 to -06 - - o Moved sections that define the ACE framework into a subsection of - the framework Section 5. - o Split section on client credentials and grant into two separate - sections, Section 5.4, and Section 5.5. - o Added Section 5.6 on AS authentication. - o Added Section 5.7 on the Authorization endpoint. - -F.18. Version -04 to -05 - - o Added RFC 2119 language to the specification of the required - behavior of profile specifications. - o Added Section 5.5 on the relation to the OAuth2 grant types. - o Added CBOR abbreviations for error and the error codes defined in - OAuth2. - o Added clarification about token expiration and long-running - requests in Section 5.10.3 - o Added security considerations about tokens with symmetric PoP keys - valid for more than one RS. - o Added privacy considerations section. - o Added IANA registry mapping the confirmation types from RFC 7800 - to equivalent COSE types. - - o Added appendix D, describing assumptions about what the AS knows - about the client and the RS. - -F.19. Version -03 to -04 - - o Added a description of the terms "framework" and "profiles" as - used in this document. - o Clarified protection of access tokens in section 3.1. - o Clarified uses of the "cnf" parameter in section 6.4.5. - o Clarified intended use of Client Token in section 7.4. - -F.20. Version -02 to -03 - - o Removed references to draft-ietf-oauth-pop-key-distribution since - the status of this draft is unclear. - o Copied and adapted security considerations from draft-ietf-oauth- - pop-key-distribution. - o Renamed "client information" to "RS information" since it is - information about the RS. - o Clarified the requirements on profiles of this framework. - o Clarified the token endpoint protocol and removed negotiation of - "profile" and "alg" (section 6). - o Renumbered the abbreviations for claims and parameters to get a - consistent numbering across different endpoints. - o Clarified the introspection endpoint. - o Renamed token, introspection and authz-info to "endpoint" instead - of "resource" to mirror the OAuth 2.0 terminology. - o Updated the examples in the appendices. - -F.21. Version -01 to -02 - - o Restructured to remove communication security parts. These shall - now be defined in profiles. - o Restructured section 5 to create new sections on the OAuth - endpoints token, introspection and authz-info. - o Pulled in material from draft-ietf-oauth-pop-key-distribution in - order to define proof-of-possession key distribution. - o Introduced the "cnf" parameter as defined in RFC7800 to reference - or transport keys used for proof of possession. - o Introduced the "client-token" to transport client information from - the AS to the client via the RS in conjunction with introspection. - o Expanded the IANA section to define parameters for token request, - introspection and CWT claims. - o Moved deployment scenarios to the appendix as examples. - -F.22. Version -00 to -01 - - o Changed 5.1. from "Communication Security Protocol" to "Client - Information". - o Major rewrite of 5.1 to clarify the information exchanged between - C and AS in the PoP access token request profile for IoT. - - * Allow the client to indicate preferences for the communication - security protocol. - * Defined the term "Client Information" for the additional - information returned to the client in addition to the access - token. - * Require that the messages between AS and client are secured, - either with (D)TLS or with COSE_Encrypted wrappers. - * Removed dependency on OSCOAP and added generic text about - object security instead. - * Defined the "rpk" parameter in the client information to - transmit the raw public key of the RS from AS to client. - * (D)TLS MUST use the PoP key in the handshake (either as PSK or - as client RPK with client authentication). - * Defined the use of x5c, x5t and x5tS256 parameters when a - client certificate is used for proof of possession. - * Defined "tktn" parameter for signaling for how to transfer the - access token. - o Added 5.2. the CoAP Access-Token option for transferring access - tokens in messages that do not have payload. - o 5.3.2. Defined success and error responses from the RS when - receiving an access token. - o 5.6.:Added section giving guidance on how to handle token - expiration in the absence of reliable time. - o Appendix B Added list of roles and responsibilities for C, AS and - RS. - Authors' Addresses - Ludwig Seitz Combitech Djaeknegatan 31 Malmoe 211 35 Sweden Email: ludwig.seitz@combitech.se + Goeran Selander Ericsson Faroegatan 6 Kista 164 80 Sweden Email: goran.selander@ericsson.com Erik Wahlstroem Sweden