I-D Action: draft-winmagic-oauth-condition-bound-keys-00.txt

Internet-Draft draft-winmagic-oauth-condition-bound-keys-00.txt is now
available.

   Title:   Condition-Bound Keys for Mutual-TLS Client Authentication and DPoP
   Authors: Thi Nguyen-Huu
            Sergei Nikitin
            John O'Leary
   Name:    draft-winmagic-oauth-condition-bound-keys-00.txt
   Pages:   23
   Dates:   2026-08-12

Abstract:

   Login and session protection are two markets solving one problem:
   verify identity before giving access.  Online, access is mostly the
   transaction, so that is where identity should be verified.  Done this
   way, there is no session and no login; identity assurance is embedded
   in the transaction: it is encrypted by a key only the right identity
   has.

   The key that does this exists only where an actor -- human or machine
   -- a platform, and local policy hold, now.  It disappears when the
   conditions are no longer met.  All three are observed on the
   endpoint.  It is hardware-rooted by default and non-exfiltratable,
   existing nowhere else, and its presence means validity: the identity
   is live now.

   This document specifies that key and its uses: under mutual TLS, in a
   DPoP proof, as a raw public key, in Device Bound Session Credentials,
   and as a FIDO2 passkey, or in a non-FIDO mode carrying user
   verification without user interaction.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-winmagic-oauth-condition-bound-keys/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-winmagic-oauth-condition-bound-keys-00.html

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]