Skip to content

Commit 4f975c5

Browse files
PieterKasPieterKas
authored
Split normative from informative references
Split normative from informative references (shepherd feedback see #153
1 parent fd97c87 commit 4f975c5

File tree

1 file changed

+96
-86
lines changed

1 file changed

+96
-86
lines changed

‎draft-ietf-oauth-cross-device-security.md‎

Lines changed: 96 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -886,6 +886,8 @@ The authors would like to thank Tim Cappalli, Nick Ludwig, Adrian Frei, Nikhil R
886886

887887
-latest
888888
* Shepherd feedback: Describe unauthenticated channel
889+
* Updated references for FIDO
890+
* Seperated references between normative and informative
889891

890892
-09
891893
* Affiliation change to allow publication to Datatracker.
@@ -976,25 +978,82 @@ The authors would like to thank Tim Cappalli, Nick Ludwig, Adrian Frei, Nikhil R
976978
* Initial draft adopted from document circulated to the OAuth Security Workshop Slack Channel
977979
* Upload as draft-ietf-oauth-cross-device-security-best-practice-00
978980

979-
<reference anchor="OpenID.Core" target="http://openid.net/specs/openid-connect-core-1_0.html">
981+
# Normative References
982+
RFC6749: # OAuth 2.0 Authorization Framework
983+
RFC8628: # OAuth 2.0 Device Authorization Grant
984+
RFC7662: # OAuth 2.0 Token Introspection
985+
986+
<reference anchor="FIDOCTAP22" target="https://fidoalliance.org/specs/fido-v2.2-ps-20250228/fido-client-to-authenticator-protocol-v2.2-ps-20250228.html">
980987
<front>
981-
<title>OpenID Connect Core 1.0</title>
982-
<author initials="N." surname="Sakimura" fullname="Nat Sakimura">
983-
<organization></organization>
984-
</author>
988+
<title>Client to Authenticator Protocol (CTAP)</title>
985989
<author initials="J." surname="Bradley" fullname="John Bradley">
986-
<organization></organization>
990+
<organization>Yubico</organization>
987991
</author>
988-
<author initials="M.B." surname="Jones" fullname="Michael B. Jones">
989-
<organization></organization>
992+
<author initials="M." surname="Jones" fullname="Michael B. Jones">
993+
<organization>Microsoft</organization>
990994
</author>
991-
<author initials="B.d." surname="Medeiros" fullname="Breno de Medeiros">
992-
<organization></organization>
995+
<author initials="A." surname="Kumar" fullname="Akshay Kumar">
996+
<organization>Microsoft</organization>
993997
</author>
994-
<author initials="C." surname="Mortimore" fullname="Chuck Mortimore">
995-
<organization></organization>
998+
<author initials="R." surname="Lindemann" fullname="Rolf Lindemann">
999+
<organization>Nok Nok Labs</organization>
9961000
</author>
997-
<date year="2014" month="November"/>
1001+
<author initials="S." surname="Verrept" fullname="Johan Verrept">
1002+
<organization>OneSpan</organization>
1003+
</author>
1004+
</author>
1005+
<author initials="D." surname="Waite" fullname="David Waite">
1006+
<organization>Ping Identity</organization>
1007+
</author>
1008+
<date year="2025" month="February"/>
1009+
</front>
1010+
</reference>
1011+
1012+
<reference anchor="W3CWebAuthn" target="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/">
1013+
<front>
1014+
<title>Web Authentication: An API for accessing Public Key Credentials Level 3</title>
1015+
<author initials="T." surname="Cappalli" fullname="Tim Cappalli">
1016+
<organization>Okta</organization>
1017+
</author>
1018+
<author initials="M." surname="Jones" fullname="Michael B. Jones">
1019+
<organization>Microsoft</organization>
1020+
</author>
1021+
<author initials="A." surname="Kumar" fullname="Akshay Kumar">
1022+
<organization>Microsoft</organization>
1023+
</author>
1024+
<author initials="E." surname="Lundberg" fullname="Emil Lundberg">
1025+
<organization>Yubico</organization>
1026+
</author>
1027+
<author initials="M." surname="Miller" fullname="Matthew Miller">
1028+
<organization>Cisco</organization>
1029+
</author>
1030+
</author>
1031+
<date year="2025" month="January"/>
1032+
</front>
1033+
</reference>
1034+
1035+
<reference anchor="IEEE802154" target="https://standards.ieee.org/standard/802_15_4-2020.html">
1036+
<front>
1037+
<title>IEEE Std 802.15.4-2020: IEEE Standard for Low-Rate Wireless Networks</title>
1038+
<seriesInfo name="IEEE" value="802.15.4-2020"/>
1039+
<author>
1040+
<organization>Institute of Electrical and Electronics Engineers</organization>
1041+
</author>
1042+
<date year="2020"/>
1043+
</front>
1044+
<annotation>This standard defines the physical layer and media access control for low-rate wireless personal area networks (LR-WPANs) and is maintained by the IEEE 802.15 working group.</annotation>
1045+
</reference>
1046+
1047+
<reference anchor="CAEP" target="https://openid.net/specs/openid-caep-specification-1_0-01.html">
1048+
<front>
1049+
<title>OpenID Continuous Access Evaluation Profile 1.0 - draft 01</title>
1050+
<author initials="A." surname="Tulshibagwale" fullname="Atul Tulshibagwale">
1051+
<organization>Google</organization>
1052+
</author>
1053+
<author initials="T." surname="Cappalli" fullname="Tim Cappalli">
1054+
<organization>Microsoft</organization>
1055+
</author>
1056+
<date year="2021" month="June"/>
9981057
</front>
9991058
</reference>
10001059

@@ -1020,6 +1079,30 @@ The authors would like to thank Tim Cappalli, Nick Ludwig, Adrian Frei, Nikhil R
10201079
</front>
10211080
</reference>
10221081

1082+
# Informative References
1083+
1084+
<reference anchor="OpenID.Core" target="http://openid.net/specs/openid-connect-core-1_0.html">
1085+
<front>
1086+
<title>OpenID Connect Core 1.0</title>
1087+
<author initials="N." surname="Sakimura" fullname="Nat Sakimura">
1088+
<organization></organization>
1089+
</author>
1090+
<author initials="J." surname="Bradley" fullname="John Bradley">
1091+
<organization></organization>
1092+
</author>
1093+
<author initials="M.B." surname="Jones" fullname="Michael B. Jones">
1094+
<organization></organization>
1095+
</author>
1096+
<author initials="B.d." surname="Medeiros" fullname="Breno de Medeiros">
1097+
<organization></organization>
1098+
</author>
1099+
<author initials="C." surname="Mortimore" fullname="Chuck Mortimore">
1100+
<organization></organization>
1101+
</author>
1102+
<date year="2014" month="November"/>
1103+
</front>
1104+
</reference>
1105+
10231106
<reference anchor="Exploit1" target="https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html">
10241107
<front>
10251108
<title>The Art of the Device Code Phish</title>
@@ -1112,19 +1195,6 @@ The authors would like to thank Tim Cappalli, Nick Ludwig, Adrian Frei, Nikhil R
11121195
</front>
11131196
</reference>
11141197

1115-
<reference anchor="CAEP" target="https://openid.net/specs/openid-caep-specification-1_0-01.html">
1116-
<front>
1117-
<title>OpenID Continuous Access Evaluation Profile 1.0 - draft 01</title>
1118-
<author initials="A." surname="Tulshibagwale" fullname="Atul Tulshibagwale">
1119-
<organization>Google</organization>
1120-
</author>
1121-
<author initials="T." surname="Cappalli" fullname="Tim Cappalli">
1122-
<organization>Microsoft</organization>
1123-
</author>
1124-
<date year="2021" month="June"/>
1125-
</front>
1126-
</reference>
1127-
11281198
<reference anchor="OpenID.SIOPV2" target="https://bitbucket.org/openid/connect/src/master/openid-connect-self-issued-v2/openid-connect-self-issued-v2-1_0.md">
11291199
<front>
11301200
<title>Self-Issued OpenID Provider v2</title>
@@ -1176,18 +1246,6 @@ The authors would like to thank Tim Cappalli, Nick Ludwig, Adrian Frei, Nikhil R
11761246
</front>
11771247
</reference>
11781248

1179-
<reference anchor="IEEE802154" target="https://standards.ieee.org/standard/802_15_4-2020.html">
1180-
<front>
1181-
<title>IEEE Std 802.15.4-2020: IEEE Standard for Low-Rate Wireless Networks</title>
1182-
<seriesInfo name="IEEE" value="802.15.4-2020"/>
1183-
<author>
1184-
<organization>Institute of Electrical and Electronics Engineers</organization>
1185-
</author>
1186-
<date year="2020"/>
1187-
</front>
1188-
<annotation>This standard defines the physical layer and media access control for low-rate wireless personal area networks (LR-WPANs) and is maintained by the IEEE 802.15 working group.</annotation>
1189-
</reference>
1190-
11911249
<reference anchor="Baki2023" target="https://doi.org/10.1109/TDSC.2022.3151103">
11921250
<front>
11931251
<title>Sixteen Years of Phishing User Studies: What Have We Learned?, IEEE Transactions on Dependable and Secure Computing, Volume 20, Number 2, Pages 1200-1212</title>
@@ -1242,51 +1300,3 @@ The authors would like to thank Tim Cappalli, Nick Ludwig, Adrian Frei, Nikhil R
12421300
</front>
12431301
</reference>
12441302

1245-
<reference anchor="FIDOCTAP22" target="https://fidoalliance.org/specs/fido-v2.2-ps-20250228/fido-client-to-authenticator-protocol-v2.2-ps-20250228.html">
1246-
<front>
1247-
<title>Client to Authenticator Protocol (CTAP)</title>
1248-
<author initials="J." surname="Bradley" fullname="John Bradley">
1249-
<organization>Yubico</organization>
1250-
</author>
1251-
<author initials="M." surname="Jones" fullname="Michael B. Jones">
1252-
<organization>Microsoft</organization>
1253-
</author>
1254-
<author initials="A." surname="Kumar" fullname="Akshay Kumar">
1255-
<organization>Microsoft</organization>
1256-
</author>
1257-
<author initials="R." surname="Lindemann" fullname="Rolf Lindemann">
1258-
<organization>Nok Nok Labs</organization>
1259-
</author>
1260-
<author initials="S." surname="Verrept" fullname="Johan Verrept">
1261-
<organization>OneSpan</organization>
1262-
</author>
1263-
</author>
1264-
<author initials="D." surname="Waite" fullname="David Waite">
1265-
<organization>Ping Identity</organization>
1266-
</author>
1267-
<date year="2025" month="February"/>
1268-
</front>
1269-
</reference>
1270-
1271-
<reference anchor="W3CWebAuthn" target="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/">
1272-
<front>
1273-
<title>Web Authentication: An API for accessing Public Key Credentials Level 3</title>
1274-
<author initials="T." surname="Cappalli" fullname="Tim Cappalli">
1275-
<organization>Okta</organization>
1276-
</author>
1277-
<author initials="M." surname="Jones" fullname="Michael B. Jones">
1278-
<organization>Microsoft</organization>
1279-
</author>
1280-
<author initials="A." surname="Kumar" fullname="Akshay Kumar">
1281-
<organization>Microsoft</organization>
1282-
</author>
1283-
<author initials="E." surname="Lundberg" fullname="Emil Lundberg">
1284-
<organization>Yubico</organization>
1285-
</author>
1286-
<author initials="M." surname="Miller" fullname="Matthew Miller">
1287-
<organization>Cisco</organization>
1288-
</author>
1289-
</author>
1290-
<date year="2025" month="January"/>
1291-
</front>
1292-
</reference>

0 commit comments

Comments
 (0)