draft-ietf-oauth-attestation-based-client-auth-07

• remove restrictions to not allow MAC-based algorithms
• require iat in Client Attestation PoP JWT
• clarify use_attestation_challenge and add invalid_client_attestation
• add client_attestation_signing_alg_values_supported and client_attestation_pop_signing_alg_values_supported to IANA egistration
• add implementation consideration for Authorization Server Metadata
• clarify refresh token binding
• check client_id at PAR endpoint
• added use_fresh_attestation as an error to signal that the attestation was not deemed fresh enough by the server
• mandate the defined header fields if the attestation and pop are transferred via header fields

draft-ietf-oauth-attestation-based-client-auth-06

• clarify usage of client attestation outside of oauth2 applications
• add oauth error response values invalid_client_attestation and use_attestation_challenge
• revert the HTTP OPTIONS mechanism to fetch nonces and add a dedicated challenge endpoint
• rename nonce to challenge
• rewrite security consideration on replay attacks
• add implementation consideration on replay attacks
• remove exp from Client Attestation PoP JWT

draft-ietf-oauth-attestation-based-client-auth-04

• remove key attestation example
• restructured JWT Claims for better readability
• added JOSE typ values for Client Attestation and Client Attestation PoP
• add RATS relation
• add concatenated representation without headers
• add PAR endpoint example
• fix PoP examples to include jti and nonce
• add iana http field name registration