Fwd: WebAuth - Replacement for HTTPS Client Certificate Authentication

FYI

---------- Forwarded message ----------
From: Anders Rundgren <anders.rundgren.net@gmail.com>
Date: 25 October 2013 12:48
Subject: WebAuth - Replacement for HTTPS Client Certificate Authentication
To: Web Payments CG <public-webpayments@w3.org>


Maybe of interest for authentication to payment systems
(although ideally you would rather just sign something):

http://webpki.org/papers/PKI/webauth.pdf

Comments are welcome!

There are 3 independent possible standards targets in this proposal:

1. Browser bindings for JSON protocol invocations

2. JSON Clear-text Signature:
https://openkeystore.googlecode.com/svn/resources/trunk/docs/JSON-Clear-Text-Signature-Scheme.pdf

3. And then WebAuth itself

Cheers
Anders