FAPI2 + dpop nonces

Brian Campbell

That de facto sounds about right to me. Which would likewise mean that AS certifications tests need to handle dpop nonces from AS and resources correctly.

‌

2022-02-22T17:01:54+00:00

Joseph Heenan reporter

Thanks Brian. Yeah, that sounds right, at least at the resource endpoint.

Think further about it, I can’t see any compelling reason [when used with FAPI] for the use of dpop nonces at the token endpoint, but I may have missed something and there’s nothing in the standards to prevent servers doing it there.

2022-02-23T08:30:22+00:00

Nat Sakimura

changed status to open

In the Mar. 2 call, Daniel pointed out that not requiring nonce may open an attack surface.

2022-03-02T15:01:28+00:00

Dave Tonge

There was discussion about maybe removing the requirement to support nonces for the next draft of FAPI2 - this reduces implementation complexity

If the security analysis comes back that we need the nonce, we can add it back in

2022-03-16T15:15:19+00:00

Joseph Heenan reporter

Pull request opened: https://bitbucket.org/openid/fapi/pull-requests/326/fapi2base-disallow-dpop-nonces

2022-04-10T14:51:54+00:00

Pieter Kasselman

If we go down the road of not including the nonce due to the requirement for synchronised clocks in FAPI, it is important to not only make a strong assertion that the nonce is not needed, but also explain how the equivalent freshness guarantees are being achieved. If this information is not included, the strong assertion that nonces should not be included may be taken out of context in environments where synchronised clocks are not available.

2022-05-04T12:46:35+00:00

Dave Tonge

We discussed this yesterday, and decided that we should revert this change.

Part of the reason is that even though we only support confidential clients - these could still be clients on a user controlled device and therefore clocks may be out of sync.

Another reason is that we don’t want to cause fragmentation of the ecosystem with some clients supporting full DPoP and others only supporting DPoP without nonces.

A further reason is that the added complexity only happens if clients want to certify with DPoP, i.e. it is possible to certify just with mutual tls.

I will raise another issue for this to deal about clock sync re other parts of the spec (e.g. private_key_jwt)

‌

2022-05-05T06:43:59+00:00

Joseph Heenan reporter

As I mentioned briefly on yesterday’s call, I’d be keen to add a note/'MAY' clause/similar to FAPI just to draw attention to the nonces (e.g. “AS may use dpop nonces. Clients must support the dpop nonce mechanism.”. As the situation currently stands I suspect people are likely to develop clients that don’t send nonces (my gut feeling is most servers won’t require nonces for confidential clients), and only discover the complication of needing to support nonces when they certify or later try a server that does require nonces. This runs the risk of re-enforcing a “certification is difficult” myth.