[Secdispatch] Re: draft-yossif-psea-02 posted — re-s coped as an EAT token profile (diff)
Mohamad Khalil-Yossif <[email protected]> Tue, 09 Jun 2026 18:20:57 +0300
| Newsgroups | gmane.ietf.secdispatch,gmane.ietf.saag |
|---|---|
| Message-ID | <[email protected]> |
--===============1094510580695684701== Content-Type: multipart/alternative; boundary="----=_NextPart_7225045.683631545924" ------=_NextPart_7225045.683631545924 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Fair question. I'd separate interest in the problem from commitments to imp= lement, and be honest that the latter is early. On the problem:=C2=A0 the transaction-confirmation gap shows up wherever a valid session is treat= ed as standing authority for a specific high-consequence action =E2=80=94 p= ayment initiation and step-up flows (the RFC 9470 motivation), attestation = consumers who can show a device was sound but not that a human approved thi= s operation, and the emerging case of automated agents acting on a user's b= ehalf, which the OAuth rechartering discussion touched on. Those are the constituencies the profile is aimed at. On implementers: this is an individual draft with early review, not adopted work, and I'm no= t going to overstate uptake. The right next step is exactly the dispatch qu= estion =E2=80=94 whether this belongs in an existing group or needs its own= discussion =E2=80=94 which is why I CC'd secdispatch rather than asserting= a home myself. If there are specific WGs or people you think should weigh in on whether th= e need is real, I'd welcome the pointer. [Mohamad Khalil Yossif, Founder & CEO of Yuthent] Mohamad Khalil Yossif Founder & CEO =C2=B7 Yuthent PSEA Spec Author =C2=B7 IETF draft-yossif-psea [Yuthent =E2=80=94 Execution Authority Infrastructure] =C2=A0 T: +972 50-931-1103 [tel:+972509311103] E: [email protected] [mailto:[email protected]] W: yuthent.com [https://yuthent.com] [LinkedIn] [https://www.linkedin.com/i= n/mohamadkhalilyossif] =C2=A0 [Yuthent =E2=80=94 Cryptographic proof of human authorization at execution = time] [https://yuthent.com] This email may contain confidential or sensitive information. If you are no= t the intended recipient, any review, use, disclosure, distribution, or cop= ying is prohibited. If you received this message in error, please delete it= immediately. On 09/06/2026 18:06:44, Salz, Rich <[email protected]> wr= ote: Are there other parties who are interested in the problem and your solution? ------=_NextPart_7225045.683631545924 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <div id=3D"__MailbirdStyleContent" style=3D"font-size: 10pt;font-family: Ca= scadia Code;color: #1A1A1A;text-align: left" dir=3D"ltr"> <span style=3D"font-size: 10pt">Fai= r question. I'd separate interest in the problem from commitments to implem= ent, and be honest that the latter is early.<br><br><b>On the problem: = ;</b></span><div><b><br></b><div><span style=3D"font-size: 10pt">the transa= ction-confirmation gap shows up wherever a valid session is treated as stan= ding authority for a specific high-consequence action =E2=80=94 payment ini= tiation and step-up flows (the RFC 9470 motivation), attestation consumers = who can show a device was sound but not that a human approved this operatio= n, and the emerging case of automated agents acting on a user's behalf, whi= ch the OAuth rechartering discussion touched on.<br>Those are the constitue= ncies the profile is aimed at.<br><br><b>On implementers:</b></span></div><= div><span style=3D"font-size: 10pt"><b><br></b></span></div><div><span styl= e=3D"font-size: 10pt">this is an individual draft with early review, not ad= opted work, and I'm not going to overstate uptake. The right next step is e= xactly the dispatch question =E2=80=94 whether this belongs in an existing = group or needs its own discussion =E2=80=94 which is why I CC'd secdispatch= rather than asserting a home myself.<br><br>If there are specific WGs or p= eople you think should weigh in on whether the need is real, I'd welcome th= e pointer.</span><br><div><br></div><div class=3D"mb_sig"><table dir=3D"ltr= " cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"direction: ltr = !important;unicode-bidi: embed;font-size: 14px;color: #000000;max-width: 60= 0px;width: 100%;border-collapse: collapse;text-align: left"> <tbody> <tr> <td style=3D"padding: 10px 0; text-align: left;"> <table dir=3D"ltr" cellpadding=3D"0" cellspacing=3D"0" bord= er=3D"0" width=3D"100%" style=3D"direction: ltr !important;"> <tbody><tr> <td valign=3D"middle" style=3D"text-align: left;"> <table dir=3D"ltr" cellpadding=3D"0" cellspacin= g=3D"0" border=3D"0" style=3D"direction: ltr !important;"> <tbody><tr> <td style=3D"padding-right: 15px; text-= align: left;"> <img src=3D"https://yuthent.com/pub= lic/assets/email-signature/profile-600.jpg" width=3D"60" height=3D"60" alt= =3D"Mohamad Khalil Yossif, Founder & CEO of Yuthent" style=3D"display: = block; border-radius: 50%; width: 60px; height: 60px; border: 0;"></img> </td> <td style=3D"line-height: 1.3; text-ali= gn: left;"> <div style=3D"font-size: 18px;font-= weight: bold;color: #002b5c">Mohamad Khalil Yossif</div> <div style=3D"font-size: 13px;color= : #333333;margin-top: 3px">Founder & CEO =C2=B7 Yuthent</div> <div style=3D"font-size: 11px;color= : #777777;margin-top: 3px">PSEA Spec Author =C2=B7 IETF draft-yossif-psea</= div> </td> </tr> </tbody></table> </td> <td align=3D"right" valign=3D"middle" style=3D"text= -align: right;"> <img src=3D"https://yuthent.com/assets/logo.png= " width=3D"90" height=3D"90" alt=3D"Yuthent =E2=80=94 Execution Authority I= nfrastructure" style=3D"display: inline-block; width: 90px; height: 90px; b= order: 0;"></img> </td> </tr> </tbody></table> </td> </tr> <tr> <td style=3D"border-top: 1px solid #d9d9d9;font-size: 1px;line-= height: 1px" height=3D"1"> </td> </tr> <tr> <td style=3D"padding: 10px 0; text-align: left;"> <table dir=3D"ltr" cellpadding=3D"0" cellspacing=3D"0" bord= er=3D"0" width=3D"100%" style=3D"direction: ltr !important;"> <tbody><tr> <td style=3D"font-size: 13px;color: #333333;line-he= ight: 1.5;text-align: left"> <strong>T:</strong> <a href=3D"tel:+97250931110= 3" style=3D"color: #002b5c; text-decoration: none;">+972 50-931-1103</a><br> <strong>E:</strong> <a href=3D"mailto:mohamad@y= uthent.com" style=3D"color: #002b5c; text-decoration: none;">mohamad@yuthen= t.com</a><br> <strong>W:</strong> <a href=3D"https://yuthent.= com" style=3D"color: #002b5c; text-decoration: none;">yuthent.com</a> </td> <td align=3D"right" valign=3D"middle" style=3D"text= -align: right;"> <a href=3D"https://www.linkedin.com/in/mohamadk= halilyossif" style=3D"text-decoration: none;"> <img src=3D"https://cdn-icons-png.flaticon.= com/512/174/174857.png" width=3D"24" height=3D"24" alt=3D"LinkedIn" style= =3D"border-radius: 4px; border: 0;"></img> </a> </td> </tr> </tbody></table> </td> </tr> <tr> <td style=3D"border-top: 1px solid #d9d9d9;font-size: 1px;line-= height: 1px" height=3D"1"> </td> </tr> <tr> <td style=3D"padding-top: 10px; text-align: left;"> <a href=3D"https://yuthent.com" style=3D"text-decoration: n= one;"> <img src=3D"https://yuthent.com/public/assets/email-sig= nature/banner-1200.png" width=3D"600" alt=3D"Yuthent =E2=80=94 Cryptographi= c proof of human authorization at execution time" style=3D"display: block; = width: 100%; max-width: 600px; height: auto; border: 0;"></img> </a> </td> </tr> <tr> <td style=3D"padding-top: 10px;font-size: 10px;color: #888888;l= ine-height: 1.4;text-align: left"> This email may contain confidential or sensitive informatio= n. If you are not the intended recipient, any review, use, disclosure, dist= ribution, or copying is prohibited. If you received this message in error, = please delete it immediately. </td> </tr> </tbody> </table></div> </div></div><blockquote class=3D"hi= story_container" type=3D"cite" style=3D"border-left-style: solid;border-wid= th: 1px;margin-top: 20px;margin-left: 0px;padding-left: 10px;min-width: 500= px"> <p style=3D"color: #AAAAAA; margin-top: 10px;">On 0= 9/06/2026 18:06:44, Salz, Rich <[email protected]> = wrote:</p><div style=3D"font-family:Arial,Helvetica,sans-serif"> <div style=3D"direction: ltr;font-family: Aptos, Arial, Helvetica, sans-ser= if;font-size: 12pt;color: rgb(0, 0, 0)"> Are there other parties who are interested in the problem and your solution= ?</div> <div id=3D"mail-editor-reference-message-container" dir=3D"ltr"> <div id=3D"__MailbirdStyleContent" dir=3D"ltr" style=3D"font-size: 10pt;fon= t-family: Cascadia Code;color: #1A1A1A;text-align: right"> </div> </div> </div></blockquote></div> ------=_NextPart_7225045.683631545924-- --===============1094510580695684701== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KU2VjZGlzcGF0 Y2ggbWFpbGluZyBsaXN0IC0tIHNlY2Rpc3BhdGNoQGlldGYub3JnClRvIHVuc3Vic2NyaWJlIHNl bmQgYW4gZW1haWwgdG8gc2VjZGlzcGF0Y2gtbGVhdmVAaWV0Zi5vcmcK --===============1094510580695684701==--