Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEC AD Review #535

Merged
merged 12 commits into from
Mar 9, 2024
Prev Previous commit
Next Next commit
change reject/request to process and add an example
jricher committed Mar 8, 2024
commit f58df3588496570a2874c558755a6de12634dcd6
5 changes: 3 additions & 2 deletions draft-ietf-gnap-core-protocol.md
Original file line number Diff line number Diff line change
@@ -1235,8 +1235,9 @@ If the same public key is sent by value on different access requests, the AS MUS
treat these requests as coming from the same client instance for purposes
of identification, authentication, and policy application.
If the AS does not know the client instance's public key ahead of time, the AS
MAY accept or reject the request based on attestations
within the `client` request and other AS policy mechanisms.
MAY process the request based on attestations
within the `client` request and other AS policy mechanisms. For example, the AS
could allow an unknown client instance key to access only limited resources or work for only specific RO's.

The client instance MUST NOT send a symmetric key by value in the request, as doing so would expose
the key directly instead of simply proving possession of it. See considerations on symmetric keys