erdtman / rpcc Goto Github PK

Comment from Brian:
With Raw-Public-Key, you say that the authorization server must the derive a client identifier from RPK that the client uses. I think you are saying that the AS has to have some way to figure out the client from the key. One way might be to assign the client id based on the hash of the key, as you describe. Another might be to maintain a mapping/lookup from key (or keys) to the client. I think anyway. Some more explanation around this might be helpful with maybe more distinction between the protocol and implementation options or considerations for the AS.

Comment from Brian:
With PSK, you say that how the AS maps a client identifier to the pre-shared-key is out of scope but does or should the pre-shared-key relate to the client secret in some way? Like is the psk the client secret encoded to bytes with UTF-8? Or is the psk derived from the client secret with a KDF or hash or something? Or is it a new configuration thing for a client that's doing tls_client_psk? Some clarification/explanation would maybe be helpful.