Skip to content

Commit 3ec4da2

Browse files
paulbastianpaulbastian
authored
Merge branch 'main' into pb/review
2 parents 027cdf3 + beadcf8 commit 3ec4da2

1 file changed

Lines changed: 106 additions & 96 deletions

File tree

‎draft-ietf-oauth-status-list.md‎

Lines changed: 106 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -145,17 +145,18 @@ The following diagram depicts the relationship between the artifacts:
145145

146146
~~~ ascii-art
147147

148-
┌────────────────┐ describes status ┌──────────────────┐
149-
│ Status List ├──────────────────►│ Referenced Token │
150-
│ (JSON or CBOR) │◄──────────────────┤ (JOSE, COSE, ..) │
151-
└─────┬──────────┘ references └──────────────────┘
152-
│
153-
│ embedded in
154-
▼
155-
┌───────────────────┐
156-
│ Status List Token │
157-
│ (JWT or CWT) │
158-
└───────────────────┘
148+
+----------------+ describes status +------------------+
149+
| Status List |------------------->| Referenced Token |
150+
| (JSON or CBOR) |<-------------------| (JOSE, COSE, ..) |
151+
+-------+--------+ references +------------------+
152+
|
153+
|
154+
| embedded in
155+
v
156+
+-------------------+
157+
| Status List Token |
158+
| (JWT or CWT) |
159+
+-------------------+
159160

160161
~~~
161162

@@ -169,17 +170,19 @@ The following diagram depicts the relationship between the involved roles (Relyi
169170

170171
issue present
171172
Referenced Referenced
172-
┌────────┐ Token ┌────────┐ Token ┌───────────────┐
173-
│ Issuer ├───────────►│ Holder ├───────────►│ Relying Party │
174-
└─┬──────┘ └───┬────┘ └──┬────────────┘
175-
▼ provide status │ │
176-
┌───────────────┐ │ │
177-
│ Status Issuer │ │ │
178-
└─┬─────────────┘ │ │
179-
▼ provide Status List │ │
180-
┌─────────────────┐ │ │
181-
│ Status Provider │◄──────┴────────────────────┘
182-
└─────────────────┘ fetch Status List Token
173+
+--------+ Token +--------+ Token +---------------+
174+
| Issuer |----------->| Holder |----------->| Relying Party |
175+
+---+----+ +---+----+ +-------+-------+
176+
| | |
177+
v provide status | |
178+
+---------------+ | |
179+
| Status Issuer | | |
180+
+---+-----------+ | |
181+
| | |
182+
v provide Status List | |
183+
+-----------------+ | |
184+
| Status Provider |<------+-------------------------+
185+
+-----------------+ fetch Status List Token
183186

184187
~~~
185188

@@ -302,14 +305,14 @@ These bits are concatenated:
302305

303306
~~~ ascii-art
304307

305-
byte no 0 1
306-
bit no 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
307-
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
308-
values |1|0|1|1|1|0|0|1| |1|0|1|0|0|0|1|1|
309-
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
310-
index 7 6 5 4 3 2 1 0 15 ... 10 9 8
311-
\_______________/ \_______________/
312-
byte value 0xB9 0xA3
308+
Byte Index 0 1
309+
Bit Position 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
310+
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
311+
Bit Values |1|0|1|1|1|0|0|1| |1|0|1|0|0|0|1|1|
312+
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
313+
List Index 7 6 5 4 3 2 1 0 15 ... 10 9 8
314+
\_______________/ \_______________/
315+
Hex Value 0xB9 0xA3
313316

314317
compressed array (hex): 78dadbb918000217015d
315318
~~~
@@ -336,16 +339,16 @@ These bits are concatenated:
336339

337340
~~~ ascii-art
338341

339-
byte no 0 1 2
340-
bit no 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
341-
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
342-
values |1|1|0|0|1|0|0|1| |0|1|0|0|0|1|0|0| |1|1|1|1|1|0|0|1|
343-
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
344-
\ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ /
345-
status 11 00 10 01 01 00 01 00 11 11 10 01
346-
index 3 2 1 0 7 6 5 4 11 10 9 8
347-
\___________/ \___________/ \___________/
348-
byte value 0xC9 0x44 0xF9
342+
Byte Index 0 1 2
343+
Bit Position 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
344+
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
345+
Bit Values |1|1|0|0|1|0|0|1| |0|1|0|0|0|1|0|0| |1|1|1|1|1|0|0|1|
346+
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
347+
\ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ /
348+
Status Value 11 00 10 01 01 00 01 00 11 11 10 01
349+
List Index 3 2 1 0 7 6 5 4 11 10 9 8
350+
\___________/ \___________/ \___________/
351+
Hex Value 0xC9 0x44 0xF9
349352

350353
compressed array (hex): 78da3be9f2130003df0207
351354
~~~
@@ -731,22 +734,23 @@ An Issuer MAY support any of these mechanisms:
731734
- Status List Parameter: The Status Issuer includes an additional claim in the Status List Token that contains the Status List Aggregation URI.
732735

733736
~~~ ascii-art
734-
┌─────────────────┐
735-
│ │
736-
│ Issuer Metadata │
737-
│ │
738-
└───┬─────────────┘
739-
│
740-
┌───────────────────┐ │ link within metadata
741-
┌───────────────────┐│ link all ▼
742-
┌───────────────────┐││◄───────┐ ┌─────────────────────────┐
743-
│ ││◄────────┤ │ │
744-
│ Status List Token │◄┴────────┴──┤ Status List Aggregation │
745-
│ │┘ │ │
746-
└───────┬───────────┘ └─────────────────────────┘
747-
│ ▲
748-
│ link by aggregation_uri │
749-
└─────────────────────────────────┘
737+
+-----------------+
738+
| |
739+
| Issuer Metadata |
740+
| |
741+
+---------+-------+
742+
batch of |
743+
+-------------------+ | link within metadata
744+
+-------------------+| link all v
745+
+-------------------+||<-------+ +-------------------------+
746+
| ||<--------+ | |
747+
| Status List Token |<---------+--| Status List Aggregation |
748+
| |+ | |
749+
+-------+-----------+ +-------------------------+
750+
| ^
751+
| |
752+
| link by aggregation_uri |
753+
+-------------------------------------+
750754
~~~
751755

752756
## Issuer Metadata
@@ -826,36 +830,42 @@ Alternatively, the Status Issuer may use the same web-based key resolution that
826830
- an `x5u` or `kid` parameter referencing to a key using the same web-based resolution as used in the Referenced Token for COSE.
827831

828832
~~~ ascii-art
829-
┌────────┐ host keys ┌──────────────────────┐
830-
│ Issuer ├────────┬───►│ .well-known metadata │
831-
└─┬──────┘ │ └──────────────────────┘
832-
▼ update status │
833-
┌───────────────┐ │
834-
│ Status Issuer ├─┘
835-
└─┬─────────────┘
836-
▼ provide Status List
837-
┌─────────────────┐
838-
│ Status Provider │
839-
└─────────────────┘
833+
+--------+ host keys +----------------------+
834+
| Issuer |----------+----->| .well-known metadata |
835+
+---+----+ | +----------------------+
836+
| |
837+
v update status |
838+
+---------------+ |
839+
| Status Issuer |---+
840+
+---+-----------+
841+
|
842+
v provide Status List
843+
+-----------------+
844+
| Status Provider |
845+
+-----------------+
840846
~~~
841847
If the Issuer of the Referenced Token is a different entity than the Status Issuer, then the keys used for the Status List Token may be cryptographically linked, e.g. by a Certificate Authority through an x.509 PKI. The certificate of the Issuer for the Referenced Token and the Status Issuer should be issued by the same Certificate Authority and the Status Issuer's certificate should utilize [extended key usage](#eku).
842848

843849
~~~ ascii-art
844-
┌───────────────────────┐
845-
│ Certificate Authority │
846-
└─┬─────────────────────┘
847-
│ authorize
848-
│ ┌────────┐
849-
├─►│ Issuer │
850-
│ └─┬──────┘
851-
│ ▼ update status
852-
│ ┌───────────────┐
853-
└─►│ Status Issuer │
854-
└─┬─────────────┘
855-
▼ provide Status List
856-
┌─────────────────┐
857-
│ Status Provider │
858-
└─────────────────┘
850+
+-----------------------+
851+
| Certificate Authority |
852+
+---+-------------------+
853+
|
854+
| authorize
855+
|
856+
| +--------+
857+
+--->| Issuer |
858+
| +-+------+
859+
| |
860+
| v update status
861+
| +---------------+
862+
+--->| Status Issuer |
863+
+-+-------------+
864+
|
865+
v provide Status List
866+
+-----------------+
867+
| Status Provider |
868+
+-----------------+
859869
~~~
860870

861871
## Redirection 3xx {#redirects}
@@ -1016,23 +1026,22 @@ Ultimately, it's the Relying Parties decision how often to check for updates, ec
10161026
The following diagram illustrates the relationship between these claims and how they are designed to influence caching:
10171027

10181028
~~~ ascii-art
1019-
10201029
Time of Check for Check for Check for
10211030
Fetching updates updates updates
10221031

1023-
iat │ │ │ │ exp
1024-
│ │ │ │
1025-
│ │ │ │ │ │
1026-
│ │ │ │ │ │
1027-
│ │ │ │ │ │
1028-
│ │ │ │ │ │
1029-
│ │ ttl │ ttl │ ttl │ │
1030-
│ │ ─────────────► │ ─────────────► │ ─────────────► │ ──► │
1031-
│ │ │ │ │ │
1032-
│ │ │ │ │ │
1033-
│ │
1034-
──┼───────────────────────────────────────────────────────────────┼─►
1035-
│ │
1032+
iat | | | | exp
1033+
| | | |
1034+
| | | | | |
1035+
| | | | | |
1036+
| | | | | |
1037+
| | | | | |
1038+
| | ttl | ttl | ttl | |
1039+
| | -------------> | -------------> | -------------> | --> |
1040+
| | | | | |
1041+
| | | | | |
1042+
| |
1043+
--+---------------------------------------------------------------+-->
1044+
| |
10361045
~~~
10371046

10381047
## Relying Parties avoiding correlatable Information
@@ -1825,6 +1834,7 @@ CBOR encoding:
18251834

18261835
-19
18271836

1837+
* revert grapahics to ASCII
18281838
* grammar, spelling, nits
18291839

18301840
-18

0 commit comments

Comments
 (0)