new proposal for challenge endpoint

[paulbastian]

Closes #73
Closes #110
Closes #104
Closes #102
Closes #101
Closes #103
Closes #116
Closes #109

• include some security consideration comparing freshness and replay prevention @paulbastian
• discuss option to include some state parameter to the challenge request
• IANA registry entry @tplooker
• adapt header based syntax to Attestation-Challenge @paulbastian
• clarify that the response using the HTTP header may also be an error @c2bo
• introduce an use_attestation_challenge OAuth error @c2bo
• introduce invalid_client_attestation @c2bo
• consider namespacing headers etc @tplooker

[tplooker]

FYI
f1fef28 updates the iana registration.
803ea07 namespaces the Attestation-Challenge HTTP header by suffixing it with OAuth-Client- making it consistent with the other HTTP headers we've defined in the spec.

[tplooker]

Have updated the list of issues this PR closes as I think it also addresses #103, with this sentence.

If the Authorization Server offers a challenge endpoint, the Client MUST retrieve a challenge and MUST use this challenge in the OAuth-Attestation-PoP as defined in (#client-attestation-pop-jwt).

We could if we felt the need make this even clearer but I'm pretty comfortable with it, as it is.

[tplooker]

Also added #116 to the list of issues this PR closes.

[tplooker]

To discuss whether this also covers #109

[c2bo]

I think this is in a decent state now - at least good enough to get more feedback. Should we post this to the mailing list and ask for feedback?

[paulbastian]

I think this is in a decent state now - at least good enough to get more feedback. Should we post this to the mailing list and ask for feedback?

I agree. Next steps afterwards should be making PoP exp optional/removed and the processing & verification to round it up. However, this is ready for the mailing list. Wdyt @tplooker

[tplooker]

I agree. Next steps afterwards should be making PoP exp optional/removed and the processing & verification to round it up. However, this is ready for the mailing list. Wdyt @tplooker

I agree

[paulbastian]

@jricher would you be able to give this a review, as we've discussed this at EIC?

[panva]

Review as per @paulbastian's request. 🙏