I-D Action: draft-ambekar-oauth-epop-03.txt

Internet-Draft draft-ambekar-oauth-epop-03.txt is now available.

   Title:   JSON Web Token (JWT) Profile for OAuth 2.0 Enveloped Proof of Possession (EPOP)
   Author:  Ashwin Ambekar
   Name:    draft-ambekar-oauth-epop-03.txt
   Pages:   47
   Dates:   2026-07-23

Abstract:

   This specification defines a profile for OAuth 2.0 sender-constrained
   credentials in which access tokens and refresh tokens are
   cryptographically bound to the client's private key as a single
   inseparable envelope.  Authorization code flows are also covered: the
   client declares its public key binding via cnf.jkt in the EPOP token
   presented at the token endpoint, ensuring the authorization code can
   only be exchanged by the key-holding client; the code itself travels
   as the standard code form parameter.  Unlike existing mechanisms,
   EPOP provides proof-of-possession uniformly across both JWT and
   opaque access tokens, and across HTTP and non-HTTP transports.  The
   profile extends sender-constraining beyond HTTP to non-HTTP
   transports including MQTT, Kafka, the Model Context Protocol (MCP),
   gRPC, and SASL-based protocols such as those defined in [RFC7628].
   It introduces atomic proof-of-possession key rotation, enabling
   clients to rotate key pairs without disrupting active sessions, and
   an offline-derived client nonce (cnonce) that eliminates the server-
   issued nonce round-trip required by existing mechanisms — enabling
   stateless proof validation critical for non-HTTP and high-throughput
   deployments.  Authorization servers, resource servers, and clients
   from different vendors can implement this profile interoperably.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ambekar-oauth-epop/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ambekar-oauth-epop-03.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-ambekar-oauth-epop-03

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]