Clarify 10.4.16 (v5.0.be-51.4.10)

[tghosth]

In 10.4.16 we currently have the following:

#	Description	Level	#v5.0.be
10.4.16	Verify that the client is confidential and the authorization server requires the use of strong client authentication methods (based on public-key cryptography and resistant to replay attacks), such as mutual TLS (mTLS) or private key JWT ('private_key_jwt').	3	v5.0.be-51.4.10

It appears that 'private_key_jwt' refers to a specific mode where as mTLS is a more general mechanism. I find that mix a little confusing, could we either refer to a couple of specific modes or a couple of general mechanism @randomstuff?

[elarlang]

#2897 ?

[tghosth]

doh 🤦‍♂️

It kind of feels like this point got lost so I would be tempted to close #2897 as it got mostly resolved by #2931 and there is just this point remaining. What do you think @elarlang ?

[oleksiidov]

Colleagues, I have some doubts regarding "confidential" in context of this requirement.
And to align mentioning of authentication mechanisms, I would like to stick to not go into details here.
Should we put this requirement in following way:

Verify that the client is authenticated and the authorization server requires the use of strong client authentication methods (based on public-key cryptography and resistant to replay attacks), such as mutual TLS (mTLS) or private key JWT.

Regarding capitalization we have discussion in #1875 .
Potentially it could be be put as "Mutual TLS (mTLS) or Private Key JWT", as it used in OAuth: https://oauth.net/private-key-jwt. But as agreed, we should wait for approach on capitalization and then make change, if needed.

[elarlang]

"confidential client" is specific term for OAuth, it is a client type (public client and confidential client), please see the chapter text.

[oleksiidov]

@elarlang thank you for explanation! This point is clear for me now.
And I noticed that this capitalization topic of m(M)utual TLS (mTLS)) is actual for other requirements in this chapter -- different approach used in requirements description. Will add this to (#1875 (comment)) also.