From nobody Sat Oct 3 08:47:58 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDACA1B2ADA for ; Sat, 3 Oct 2015 08:47:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.039 X-Spam-Level: * X-Spam-Status: No, score=1.039 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kr_i60si4Q8p for ; Sat, 3 Oct 2015 08:47:55 -0700 (PDT) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30BFE1B2AD7 for ; Sat, 3 Oct 2015 08:47:55 -0700 (PDT) Received: from smtp1.sunet.se (smtp1.sunet.se [192.36.171.214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t93FlqJE008617 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Sat, 3 Oct 2015 17:47:52 +0200 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.9/8.14.7) with ESMTP id t93FlnDr021045 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 3 Oct 2015 17:47:52 +0200 (CEST) VBR-Info: md=sunet.se; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sunet.se; s=default; t=1443887272; bh=opTeJKziTg8n6y7qIj7YCYgRbNO5xzewJn0ZttjC7PE=; h=To:From:Subject:Date; b=ShNmM/Nu5PgxZRSzkxnhAX1cX2mMBUrnJXMmF4h1LAIGDkJn5yLuTDpilIn3ETwRM C5J/wT6yaBH/mJbSPzYnhXKaZfYjmgnkCcXwxJvm0JYUQvDQvbl9rCbc3HqIYihPHj MpdVklbbNirJOQk+uIHehUmNxS8pDBeMrtvp4dMQ= X-Footer: c3VuZXQuc2U= Received: from [172.18.241.48] ([193.11.200.250]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.3.4 patch 1) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256 bits)) for unbearable@ietf.org; Sat, 3 Oct 2015 17:47:47 +0200 To: "unbearable@ietf.org" From: Leif Johansson Message-ID: <560FF8A3.7050308@sunet.se> Date: Sat, 3 Oct 2015 17:47:47 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, outbound-sunet-se:default, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09PoDLQJO - 87c6c155a6bd - 20151003 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter01.sunet.se: 192.36.171.210 is neither permitted nor denied by domain leifj@sunet.se) receiver=e-mailfilter01.sunet.se; client-ip=192.36.171.210; envelope-from=; helo=smtp1.sunet.se; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.36.171.201 Archived-At: Subject: [Unbearable] progress X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Oct 2015 15:47:57 -0000 Folks, Its awfully quiet on the list... does that mean we are all done? Are we waiting for review, what? Cheers Leif From nobody Sat Oct 3 13:16:35 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 877EF1B37A5 for ; Sat, 3 Oct 2015 13:16:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EOpExnq472Wv for ; Sat, 3 Oct 2015 13:16:30 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0785.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::785]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2A911B37A6 for ; Sat, 3 Oct 2015 13:16:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=AkLyjKQRvZTApDeaWL+bueD0/iawJQjV+n3mNAb8mss=; b=BBhzy5FN82E+5nlkS1Dz83CfCsOCCbZBN/sdTeTnJpbxp25Z4eQsNCh+N9YeEuKcbHiCbmvpojEh1E0O6nsuscZZGG8BdPTAvlSpQCLG89GZJbxqnt2tpOBHh9NF/VIg24+W8wYkh/b294WX4IO3knhl3wSYbnOALDC3k/mt7YE= Received: from BLUPR03MB1396.namprd03.prod.outlook.com (10.163.81.142) by BLUPR03MB1394.namprd03.prod.outlook.com (10.163.81.140) with Microsoft SMTP Server (TLS) id 15.1.280.20; Sat, 3 Oct 2015 20:16:09 +0000 Received: from BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) by BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) with mapi id 15.01.0280.021; Sat, 3 Oct 2015 20:16:09 +0000 From: Andrei Popov To: Leif Johansson , "unbearable@ietf.org" Thread-Topic: [Unbearable] progress Thread-Index: AQHQ/fLj0lkgg4iFM0q4g+0IM7OVNJ5aLx3w Date: Sat, 3 Oct 2015 20:16:09 +0000 Message-ID: References: <560FF8A3.7050308@sunet.se> In-Reply-To: <560FF8A3.7050308@sunet.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [50.46.233.208] x-microsoft-exchange-diagnostics: 1; BLUPR03MB1394; 5:Ss2xhAUDtXV8+wgdxddXsLAdj3+Xgcusc3JIv2WUNMf0iZJSFKW8RfcHRf0oVMekNkCMFJfLl+fOQeFaiYAcItX79BpBwjt4FBxw6xOV+DkG8oj2/8g4qdNC5m4C0PVA0/DvNGWu3EoLf6ZjHp9C3Q==; 24:t7wfqzUrGEKoLeZZZ6xkbJds0ZXbnCcg42fXmVb9p5B1p4im/SnxTZ/gBNpcz+Ra0ryWcsfw3/y2QCxcmraPGumE0tPURTmg6yBL5/de7Ug=; 20:RGZEkNZxtRHq4nWBWnHD+I9Hqcp9Yx/Er8QuTyUrlk5Xor+ebMr8NsjEbWyG5gylCDXWiacT6S63mwS2gs4KwA== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BLUPR03MB1394; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425024)(601004)(2401047)(8121501046)(520078)(5005006)(3002001)(61426024)(61427024); SRVR:BLUPR03MB1394; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB1394; x-forefront-prvs: 0718908305 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(13464003)(189002)(199003)(377454003)(2501003)(2900100001)(106356001)(5001960100002)(10290500002)(5007970100001)(5003600100002)(62966003)(5005710100001)(2950100001)(33656002)(5002640100001)(102836002)(105586002)(76576001)(77096005)(5001860100001)(5001830100001)(5008740100001)(5001770100001)(15975445007)(8990500004)(77156002)(5004730100002)(10400500002)(97736004)(11100500001)(81156007)(10090500001)(12110500001)(66066001)(107886002)(4001540100001)(122556002)(40100003)(76176999)(189998001)(46102003)(106116001)(54356999)(87936001)(92566002)(86362001)(99286002)(50986999)(101416001)(68736005)(86612001)(19580395003)(19580405001)(64706001)(74316001); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR03MB1394; H:BLUPR03MB1396.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Oct 2015 20:16:09.3265 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR03MB1394 Archived-At: Subject: Re: [Unbearable] progress X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Oct 2015 20:16:34 -0000 We have a number of changes in TBPROTO-02, the most significant is probably= the switch from TLS-UNIQUE to RFC5705 Keying Material Exporters. TBNEGO has been updated with minor corrections and posted as a WG item. Both I-Ds would benefit from review; comments are very welcome. So far I ha= ve two pieces of feedback: 1. TBPROTO: remove NamedCurve because it's already implied by key_parameter= s; 2. TBNEGO: drop "_sha256" suffixes from TokenBindingKeyParameters, because = we're no longer hashing TLS-UNIQUEs. Once I have some more feedback, I'll post the updated specs so that we can = discuss in Yokohama. Finally, to facilitate implementation, we need an IANA code point assignmen= t for the TB negotiation extension. Cheers, Andrei -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Leif Joh= ansson Sent: Saturday, October 3, 2015 8:48 AM To: unbearable@ietf.org Subject: [Unbearable] progress Folks, Its awfully quiet on the list... does that mean we are all done? Are we wai= ting for review, what? Cheers Leif _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Sun Oct 4 11:12:13 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 045E41B344E for ; Sun, 4 Oct 2015 11:12:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jk2P0AkRoVZZ for ; Sun, 4 Oct 2015 11:12:11 -0700 (PDT) Received: from mail-qg0-f46.google.com (mail-qg0-f46.google.com [209.85.192.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 043E91B3449 for ; Sun, 4 Oct 2015 11:12:11 -0700 (PDT) Received: by qgx61 with SMTP id 61so132958783qgx.3 for ; Sun, 04 Oct 2015 11:12:10 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-type :content-transfer-encoding; bh=pu1VN0W1wdtSeu0m6Fl+5NgcuED74EsmXBchpCsauUU=; b=D8IkjxJ9ddRuEoAI5cb6hU9Xe4ebTZJWW67Cm+Kj6JirtuC56qGwB/9GXCG6TAmfWS 2KgSSMdL4Qtlf0s9OFx5v/PtH41OyPMrgCEU809UL4uZVjjn03ce8FJrTfwY8kJW4d/Z PgshMncSph0Vy5A5HwL/5Dj/kmxLI+CGZS3rS0Mq5r9eweE3n9BJE54TSKCFUpjiTxId +1TJUWhTHer6RCn3lDjvaWw2lKlJ9HA3L+DE41+6KPKwu3ElAZrIgHei0raVqJKyZMgQ 6OhRBZGKoaFWn7nvvjKtopGGlrhZ4l5rCK3ucuFCCdA//yIzUbMWWGaqbQaYtWrnOkG0 7Kjg== X-Gm-Message-State: ALoCoQk560xtLvwXwU6enHdpJKmqGNgm5XYP4H+vyBPpNxTsH5tbhlJqEocSb7gtUfIXnOP/LwQq X-Received: by 10.140.237.14 with SMTP id i14mr35703250qhc.28.1443982330158; Sun, 04 Oct 2015 11:12:10 -0700 (PDT) Received: from [10.12.136.13] ([192.171.20.23]) by smtp.googlemail.com with ESMTPSA id a41sm8654687qka.15.2015.10.04.11.12.09 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 04 Oct 2015 11:12:09 -0700 (PDT) To: unbearable@ietf.org References: <560FF8A3.7050308@sunet.se> From: Leif Johansson Message-ID: <56116BF8.9000006@mnt.se> Date: Sun, 4 Oct 2015 20:12:08 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Unbearable] progress X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Oct 2015 18:12:13 -0000 On 2015-10-03 22:16, Andrei Popov wrote: > We have a number of changes in TBPROTO-02, the most significant is probably the switch from TLS-UNIQUE to RFC5705 Keying Material Exporters. > TBNEGO has been updated with minor corrections and posted as a WG item. > > Both I-Ds would benefit from review; comments are very welcome. So far I have two pieces of feedback: > 1. TBPROTO: remove NamedCurve because it's already implied by key_parameters; > 2. TBNEGO: drop "_sha256" suffixes from TokenBindingKeyParameters, because we're no longer hashing TLS-UNIQUEs. > > Once I have some more feedback, I'll post the updated specs so that we can discuss in Yokohama. I suggest you rev now and we can push people to review the new draft. > > Finally, to facilitate implementation, we need an IANA code point assignment for the TB negotiation extension. > I don't think we can get code points before publication though but maybe that was not what you meant... > Cheers, > > Andrei > > -----Original Message----- > From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Leif Johansson > Sent: Saturday, October 3, 2015 8:48 AM > To: unbearable@ietf.org > Subject: [Unbearable] progress > > > Folks, > > Its awfully quiet on the list... does that mean we are all done? Are we waiting for review, what? > > Cheers Leif > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > From nobody Mon Oct 5 10:25:51 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFD181B2A05 for ; Mon, 5 Oct 2015 10:25:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rdz6U5eLCJGj for ; Mon, 5 Oct 2015 10:25:43 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0727.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::727]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F7DD1B2A09 for ; Mon, 5 Oct 2015 10:25:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VojwWDCo0fqpSmrCbfqJobdHdMb0XEG15Z8240uQQBY=; b=QLYqZE4xXnJcx4rWViJ3+eIyBoB+1N2TmHP7iPP8wXxW+hG8jzPKTHnqaMWk2HENwLW1NYlSzuxtoQgPQ9KKLCD2xDxdv3am0GNG1J3G/Er0flifP132BLkJMPeoKE3sjwp3Io5HPQaAgHeLP3b+gfu944oYEVooUF6FmFZ6ZQg= Received: from BLUPR03MB1396.namprd03.prod.outlook.com (10.163.81.142) by BLUPR03MB1394.namprd03.prod.outlook.com (10.163.81.140) with Microsoft SMTP Server (TLS) id 15.1.286.20; Mon, 5 Oct 2015 17:25:19 +0000 Received: from BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) by BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) with mapi id 15.01.0280.021; Mon, 5 Oct 2015 17:25:19 +0000 From: Andrei Popov To: Leif Johansson , "unbearable@ietf.org" Thread-Topic: [Unbearable] progress Thread-Index: AQHQ/fLj0lkgg4iFM0q4g+0IM7OVNJ5aLx3wgAF1WgCAAYM/8A== Date: Mon, 5 Oct 2015 17:25:18 +0000 Message-ID: References: <560FF8A3.7050308@sunet.se> <56116BF8.9000006@mnt.se> In-Reply-To: <56116BF8.9000006@mnt.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; BLUPR03MB1394; 5:6VXUD9O3Mx3qQPl3V8hc66zgwGP8BbnjVGyfPgKC3K+5cm7ghbMS54kuXnQRErOpOdMn8jBi/3YMuKbAGbRsNAbHG0kET3jopipvQf3QF+78rz1eON29LYEstNbHK8VK3I5R0m7IUF7tN33mKZzLFg==; 24:4Y7DV7ZRJavzCAxhNPODLYbJG4fmu3EH7XtucO4CVtfcvGo0wJkRl2GBprb7hBvLb3PHC7+1IqBLs7yMbAh3ntgWSQWsqhUenBXLqUhYjlI=; 20:r8qNDmj3zzKpwW1/v195eC9ok4b+GZ3VpOxbC5E5g2W9PLSZ/f/Awf2sFKOrR/7lCQ5V1FA07hzUFKAtCAo54g== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BLUPR03MB1394; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425024)(601004)(2401047)(8121501046)(5005006)(520078)(3002001)(61426024)(61427024); SRVR:BLUPR03MB1394; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB1394; x-forefront-prvs: 07200C0526 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(189002)(377454003)(199003)(13464003)(377424004)(24454002)(68736005)(77096005)(87936001)(99286002)(19580405001)(19580395003)(64706001)(15975445007)(102836002)(40100003)(122556002)(10090500001)(86612001)(86362001)(105586002)(10290500002)(5005710100001)(106356001)(10400500002)(106116001)(5003600100002)(54356999)(50986999)(76176999)(33656002)(62966003)(77156002)(101416001)(74316001)(5002640100001)(46102003)(11100500001)(76576001)(97736004)(189998001)(92566002)(4001540100001)(5001830100001)(5001860100001)(2950100001)(81156007)(8990500004)(2900100001)(5001770100001)(5007970100001)(5001960100002)(107886002)(2501003)(5008740100001)(5004730100002)(5001920100001)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR03MB1394; H:BLUPR03MB1396.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Oct 2015 17:25:18.7638 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR03MB1394 Archived-At: Subject: Re: [Unbearable] progress X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Oct 2015 17:25:49 -0000 > I suggest you rev now and we can push people to review the new draft. Will do. > I don't think we can get code points before publication though but maybe = that was not what you meant... I am talking about an early IANA allocation of a TLS extension code point p= er RFC 7120. The TLS WG has used these on a number of occasions. There are at least two prototype implementations of the TB negotiation exte= nsion being worked on (by Google and Microsoft). An early IANA code point a= ssignment would facilitate implementation and deployment experience prior t= o the publication of the RFC. Cheers, Andrei -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Leif Joh= ansson Sent: Sunday, October 4, 2015 11:12 AM To: unbearable@ietf.org Subject: Re: [Unbearable] progress On 2015-10-03 22:16, Andrei Popov wrote: > We have a number of changes in TBPROTO-02, the most significant is probab= ly the switch from TLS-UNIQUE to RFC5705 Keying Material Exporters. > TBNEGO has been updated with minor corrections and posted as a WG item. >=20 > Both I-Ds would benefit from review; comments are very welcome. So far I = have two pieces of feedback: > 1. TBPROTO: remove NamedCurve because it's already implied by=20 > key_parameters; 2. TBNEGO: drop "_sha256" suffixes from TokenBindingKeyPa= rameters, because we're no longer hashing TLS-UNIQUEs. >=20 > Once I have some more feedback, I'll post the updated specs so that we ca= n discuss in Yokohama. I suggest you rev now and we can push people to review the new draft. >=20 > Finally, to facilitate implementation, we need an IANA code point assignm= ent for the TB negotiation extension. >=20 I don't think we can get code points before publication though but maybe th= at was not what you meant... > Cheers, >=20 > Andrei >=20 > -----Original Message----- > From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of=20 > Leif Johansson > Sent: Saturday, October 3, 2015 8:48 AM > To: unbearable@ietf.org > Subject: [Unbearable] progress >=20 >=20 > Folks, >=20 > Its awfully quiet on the list... does that mean we are all done? Are we w= aiting for review, what? >=20 > Cheers Leif >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable >=20 _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Mon Oct 5 10:47:22 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D93BA1B2A6B for ; Mon, 5 Oct 2015 10:47:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.661 X-Spam-Level: X-Spam-Status: No, score=-1.661 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lbh8ZIVGc9tR for ; Mon, 5 Oct 2015 10:47:19 -0700 (PDT) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 200D81B2A38 for ; Mon, 5 Oct 2015 10:47:18 -0700 (PDT) Received: from smtp1.sunet.se (smtp1.sunet.se [192.36.171.214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t95HlGhh009331 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Mon, 5 Oct 2015 19:47:16 +0200 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.9/8.14.7) with ESMTP id t95HlDjW023924 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 5 Oct 2015 19:47:15 +0200 (CEST) VBR-Info: md=sunet.se; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sunet.se; s=default; t=1444067235; bh=+CUE33qdPgF+VBJJ8L67zOzjokLS8kmWZ+ZLIo7Y3+k=; h=Subject:To:References:From:Date:In-Reply-To; b=U4V99bgcSqIYI/tI8vPyW9Av2qKCRW106Bo4ZFOU5UyC0Xo9y2s4558JjjjGwxWw+ MzOi1bt2MQA6eTwB3wgh50/rS2gWnWW1z//2tBNFzNzen4GMpy1IeUy+/mJs2jFMvl qO3w1oqZmzUTXeI9dvXlvDsHW86zeb3c/rKfWbiE= X-Footer: c3VuZXQuc2U= Received: from [10.12.12.14] ([192.171.20.23]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.3.4 patch 1) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256 bits)) for unbearable@ietf.org; Mon, 5 Oct 2015 19:47:10 +0200 To: unbearable@ietf.org References: <560FF8A3.7050308@sunet.se> <56116BF8.9000006@mnt.se> From: Leif Johansson Message-ID: <5612B79C.8030909@sunet.se> Date: Mon, 5 Oct 2015 19:47:08 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, outbound-sunet-se:default, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09PptLgrS - 6fe9bf666ddb - 20151005 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter01.sunet.se: 192.36.171.210 is neither permitted nor denied by domain leifj@sunet.se) receiver=e-mailfilter01.sunet.se; client-ip=192.36.171.210; envelope-from=; helo=smtp1.sunet.se; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.36.171.201 Archived-At: Subject: Re: [Unbearable] progress X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Oct 2015 17:47:21 -0000 On 2015-10-05 19:25, Andrei Popov wrote: >> I suggest you rev now and we can push people to review the new draft. > Will do. > >> I don't think we can get code points before publication though but maybe that was not what you meant... > I am talking about an early IANA allocation of a TLS extension code point per RFC 7120. The TLS WG has used these on a number of occasions. > > There are at least two prototype implementations of the TB negotiation extension being worked on (by Google and Microsoft). An early IANA code point assignment would facilitate implementation and deployment experience prior to the publication of the RFC. > ok then we should pursue that, I guess this is a task for me and JB! From nobody Tue Oct 6 07:24:33 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DCF21B406B for ; Tue, 6 Oct 2015 07:24:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.388 X-Spam-Level: X-Spam-Status: No, score=-1.388 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N_H7L1U0Dl5V for ; Tue, 6 Oct 2015 07:24:31 -0700 (PDT) Received: from mail-yk0-x234.google.com (mail-yk0-x234.google.com [IPv6:2607:f8b0:4002:c07::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E51B31ACDBC for ; Tue, 6 Oct 2015 07:24:30 -0700 (PDT) Received: by ykdt18 with SMTP id t18so204286696ykd.3 for ; Tue, 06 Oct 2015 07:24:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :content-type; bh=zgDXI2vEAB9eTe1OlDwRCEX7w43rGnhqz5HJ4bcFQuQ=; b=gmX1KHQlLXCptmZ8Q7L3ks8s6qPpoEMdv3IwcpmCIt/MBqxFF1a1Ydh8T6LOjJ95z4 Q1Ap01SaXUy5gR8scuub84+h5WIC4XsZQY/OrNnqDTJFa99RG5kfYvliVQGpIJV5jOom LpMcbX3quhW55Rzdfn+I0MWAUAmWWPnbfhgAIqPYxAExBdNrenibwuxGosgfLv9bw+fW 0/nV7L2KGVWrdtU0HbZR94vOqO3xZWKzNMTAj7xrkPcd/xlsOUWkIy3yAZ6ROmhN3Rxa yjvDDInvxOeCX3KLRnd7m84irwIA+MAFSFNfVzoBJI8q9DPeS3ok6C5SsVwXM4vW9Yu2 0Tiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:content-type; bh=zgDXI2vEAB9eTe1OlDwRCEX7w43rGnhqz5HJ4bcFQuQ=; b=Glpw9gLa1Yief9N5DpekUn9MZJiqmkdyCQ+TLskYVOTzgoMHPZZWjtIqK8CmeuliNO x79SdDH4co4u498YAMxfCvLAB0vLTy1C/EV7eXF7Hezc/VkY3XyGAOJS4iUShjuk0F0g 6BTzmfn2Leuq/vcRsjZXZcVLBi72Pi9kuhn9nZtw2gd4Z0DQ7fRLe5Udua7bYonfS8Eu /t+aX22V9/LoMGg8hvoMC5g2hYgmoMlAohdQztvyYkVLl7a8F57chPKDGTDvX8yWM33Y Vtp1NxfW7C/4qo1vKiSUOu98uFTEycpD4dP3RBE1ozhFqrmy6iTE2/OvpFrwUTp2VNve 3e1A== X-Gm-Message-State: ALoCoQmQKrGlIp4rrxUugccvS65Ap9NpOG/3aAOVDEIXkhDQu7vfbk9uS1By9WtA6N5R92IPip27 X-Received: by 10.13.243.194 with SMTP id c185mr1752544ywf.237.1444141470031; Tue, 06 Oct 2015 07:24:30 -0700 (PDT) MIME-Version: 1.0 References: <560FF8A3.7050308@sunet.se> In-Reply-To: <560FF8A3.7050308@sunet.se> From: Dirk Balfanz Date: Tue, 06 Oct 2015 14:24:20 +0000 Message-ID: To: Leif Johansson , "unbearable@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c032f94540e5f05217063ed Archived-At: Subject: Re: [Unbearable] progress X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Oct 2015 14:24:32 -0000 --94eb2c032f94540e5f05217063ed Content-Type: text/plain; charset=UTF-8 My to-do before Yokohama was to expand the Security Considerations section in the Token Binding over HTTP to explain (1) The issues around making the HTTP header settable (or not settable) by Javascript, and (2) Explain why for federation we need _two_ signed statements for different keys (why we can't just mention the RP's key to the IdP at the application layer). I'll add those soon. Dirk. On Sat, Oct 3, 2015 at 11:48 AM Leif Johansson wrote: > > Folks, > > Its awfully quiet on the list... does that mean we are all done? Are we > waiting for review, what? > > Cheers Leif > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > --94eb2c032f94540e5f05217063ed Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
My to-do before Yokohama was to expand the Security Consid= erations section in the Token Binding over HTTP to explain=C2=A0

(1) The issues around making the HTTP header settable (or not sett= able) by Javascript, and=C2=A0
(2) Explain why for federation we = need _two_ signed statements for different keys (why we can't just ment= ion the RP's key to the IdP at the application layer).=C2=A0

I&#= 39;ll add those soon.

Dirk.

On Sat, Oct 3, 2015 at 11:48 AM Leif Johansson= <leifj@sunet.se> wrote:

Folks,

Its awfully quiet on the list... does that mean we are all done? Are we
waiting for review, what?

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Cheers Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable=
--94eb2c032f94540e5f05217063ed-- From nobody Tue Oct 6 11:53:24 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A32E81B29D9; Tue, 6 Oct 2015 11:53:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a7b2Zm11xyrh; Tue, 6 Oct 2015 11:53:20 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 86B041B29D4; Tue, 6 Oct 2015 11:53:20 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.4.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151006185320.6128.78563.idtracker@ietfa.amsl.com> Date: Tue, 06 Oct 2015 11:53:20 -0700 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-negotiation-01.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Oct 2015 18:53:21 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding Working Group of the IETF. Title : Transport Layer Security (TLS) Extension for Token Binding Protocol Negotiation Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Filename : draft-ietf-tokbind-negotiation-01.txt Pages : 8 Date : 2015-10-06 Abstract: This document specifies a Transport Layer Security (TLS) [RFC5246] extension for the negotiation of Token Binding protocol [I-D.ietf-tokbind-protocol] version and key parameters. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-negotiation/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-negotiation-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Oct 6 11:58:50 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B7771B2A05; Tue, 6 Oct 2015 11:58:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8uUxyANHdbuA; Tue, 6 Oct 2015 11:58:46 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6606E1ACC8A; Tue, 6 Oct 2015 11:58:46 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.4.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151006185846.9285.10500.idtracker@ietfa.amsl.com> Date: Tue, 06 Oct 2015 11:58:46 -0700 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-protocol-03.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Oct 2015 18:58:48 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding Working Group of the IETF. Title : The Token Binding Protocol Version 1.0 Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Filename : draft-ietf-tokbind-protocol-03.txt Pages : 13 Date : 2015-10-06 Abstract: This document specifies Version 1.0 of the Token Binding protocol. The Token Binding protocol allows client/server applications to create long-lived, uniquely identifiable TLS [RFC5246] bindings spanning multiple TLS sessions and connections. Applications are then enabled to cryptographically bind security tokens to the TLS layer, preventing token export and replay attacks. To protect privacy, the TLS Token Binding identifiers are only transmitted encrypted and can be reset by the user at any time. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-protocol-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-protocol-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Oct 6 12:10:44 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81F861B2A36 for ; Tue, 6 Oct 2015 12:10:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kd5FWjbCmo0m for ; Tue, 6 Oct 2015 12:10:37 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1bon0774.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::1:774]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC2DA1B2A1E for ; Tue, 6 Oct 2015 12:10:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=CtjNpOHIef49UxzWjGs71KbOti47V/vNUdCzZgpCJT8=; b=BlBF/NSZ9ULpFSX3C8wOkzCaBZY6w4gZLChd5u9tVdxzwZ9/kE3hQFCja+oyPyhMV4e5OMHGWRqhHQmhONbtVNX9oA/oEoJZ/AuGoJULs7UzyeucwGU0qZYLV6Mv3w3eLRhE2GXeaLcjMwfFouK9S/6QIzaJ+GCrITKJ+QX0o/Y= Received: from BN3PR03MB1398.namprd03.prod.outlook.com (10.163.34.17) by BN3PR03MB1397.namprd03.prod.outlook.com (10.163.34.16) with Microsoft SMTP Server (TLS) id 15.1.286.20; Tue, 6 Oct 2015 19:10:16 +0000 Received: from BN3PR03MB1398.namprd03.prod.outlook.com ([10.163.34.17]) by BN3PR03MB1398.namprd03.prod.outlook.com ([10.163.34.17]) with mapi id 15.01.0286.019; Tue, 6 Oct 2015 19:10:16 +0000 From: Andrei Popov To: "unbearable@ietf.org" Thread-Topic: New Versions of TBPROTO and TBNEGO I-Ds Thread-Index: AdEAabZlGVLrcQfzTjCuZqN1zcV3/g== Date: Tue, 6 Oct 2015 19:10:16 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; BN3PR03MB1397; 5:Wd7YpLc4J/uX6dW/30K1WD6tFwKnbMfCyuPTfJoKZTtVZC9s8sLfF5011ROsprtrsqs+/waI0ZtJ8GuWrBVBrrFjRCnO9+iUr3G5ZJkKXeO1AqibFJb53FqSDUmWs7IzvYqGFe+GOoLCZzdCls2Mfg==; 24:OsC30udvQY65EpSEIWf9wcyxOWz9F82iJuV96VnAmgWrx3IPcQ8hLghwEZR5zle4yPlMwhb1ySx5NosG84BCbZ/INLqq09wXA4F9Tf7IGEk=; 20:zPTk+o5+qApf0pqa7pgJghk9m23xZJREla3NZRJNieBBNKjvfuLWAdhkQPWMCYsxN4OZPAZkLu1yN1qOsP5m0g== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR03MB1397; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(108003899814671); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425024)(601004)(2401047)(5005006)(520078)(8121501046)(3002001)(61426024)(61427024); SRVR:BN3PR03MB1397; BCL:0; PCL:0; RULEID:; SRVR:BN3PR03MB1397; x-forefront-prvs: 07215D0470 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(199003)(189002)(2351001)(5002640100001)(19300405004)(19625215002)(33656002)(74316001)(15975445007)(54356999)(19617315012)(122556002)(101416001)(50986999)(99286002)(40100003)(86362001)(19580395003)(16236675004)(105586002)(5001960100002)(189998001)(5008740100001)(5004730100002)(5007970100001)(229853001)(2900100001)(450100001)(86612001)(110136002)(87936001)(102836002)(10400500002)(2501003)(76576001)(106356001)(81156007)(8990500004)(10290500002)(107886002)(92566002)(10090500001)(5005710100001)(64706001)(11100500001)(97736004)(5003600100002)(46102003)(77096005)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR03MB1397; H:BN3PR03MB1398.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN3PR03MB1398E9BDAF822C69D374A1F48C370BN3PR03MB1398namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Oct 2015 19:10:16.0835 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR03MB1397 Archived-At: Subject: [Unbearable] New Versions of TBPROTO and TBNEGO I-Ds X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Oct 2015 19:10:42 -0000 --_000_BN3PR03MB1398E9BDAF822C69D374A1F48C370BN3PR03MB1398namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The updated versions of TBPROTO and TBNEGO Internet-Drafts are available, with the following cha= nges suggested on the mailing list: 1. TBPROTO: remove NamedCurve because it's already implied by key_parameter= s. 2. TBNEGO: drop "_sha256" suffixes from TokenBindingKeyParameters, because = we're no longer hashing TLS-UNIQUEs. These documents are also available on GitHub. As always, review comments and suggestions are welcome! Cheers, Andrei --_000_BN3PR03MB1398E9BDAF822C69D374A1F48C370BN3PR03MB1398namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

The updated versions of TBPROTO and TBNEGO Internet-Drafts are available, with the following changes sugges= ted on the mailing list:

1. TBPROTO: remove NamedCurve because it's already i= mplied by key_parameters.

2. TBNEGO: drop "_sha256" suffixes from To= kenBindingKeyParameters, because we're no longer hashing TLS-UNIQUEs.<= /o:p>

 

These documents are also available on GitHub.

 

As always, review comments and suggestions are welco= me!

 

Cheers,

 

Andrei

--_000_BN3PR03MB1398E9BDAF822C69D374A1F48C370BN3PR03MB1398namp_-- From nobody Mon Oct 12 00:43:26 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 329931A21AB for ; Mon, 12 Oct 2015 00:43:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.661 X-Spam-Level: X-Spam-Status: No, score=-1.661 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hprGHr4zd9an for ; Mon, 12 Oct 2015 00:43:22 -0700 (PDT) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3810B1A21A9 for ; Mon, 12 Oct 2015 00:43:22 -0700 (PDT) Received: from smtp1.sunet.se (smtp1.sunet.se [192.36.171.214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t9C7hJpE003236 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Mon, 12 Oct 2015 09:43:19 +0200 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.9/8.14.7) with ESMTP id t9C7hGSc027954 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 12 Oct 2015 09:43:19 +0200 (CEST) VBR-Info: md=sunet.se; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sunet.se; s=default; t=1444635799; bh=G58/Xdj498A/hXIUpBQiGywXQKUraVxBGLLJrJ8im+4=; h=Subject:References:To:From:Date:In-Reply-To; b=zKspYigqlsjcSWjdHgKE0WBsve/ZA1bWwgUXevseEekN0I0L1v9rtJPKzcut1j9da kP2n9TWUsc2ofiMJgv9MSKHbW81T+/ArAHRit+ddnMwdexwEamjF2tdZlj0aUSOmOX KRJ9icJh49j0RQb+BaMLBv84eA9oQUIRTeVfNL3o= X-Footer: c3VuZXQuc2U= Received: from [109.105.104.216] ([109.105.104.216]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.5.2) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128 bits)) for unbearable@ietf.org; Mon, 12 Oct 2015 09:43:13 +0200 References: <20151010012850.29540.54283.idtracker@ietfa.amsl.com> To: "unbearable@ietf.org" From: Leif Johansson X-Forwarded-Message-Id: <20151010012850.29540.54283.idtracker@ietfa.amsl.com> Message-ID: <561B6491.4010903@sunet.se> Date: Mon, 12 Oct 2015 09:43:13 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <20151010012850.29540.54283.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, outbound-sunet-se:default, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09Ps7Hjdz - e6bdace5f4d7 - 20151012 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter01.sunet.se: 192.36.171.210 is neither permitted nor denied by domain leifj@sunet.se) receiver=e-mailfilter01.sunet.se; client-ip=192.36.171.210; envelope-from=; helo=smtp1.sunet.se; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.36.171.201 Archived-At: Subject: [Unbearable] Fwd: tokbind - Requested session has been scheduled for IETF 94 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Oct 2015 07:43:25 -0000 our session -------- Forwarded Message -------- Subject: tokbind - Requested session has been scheduled for IETF 94 Date: Fri, 09 Oct 2015 18:28:50 -0700 From: "IETF Secretariat" To: leifj@sunet.se CC: tokbind-ads@ietf.org, ve7jtb@ve7jtb.com, leifj@sunet.se Dear Leif Johansson, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. tokbind Session 1 (2:00:00) Monday, Afternoon Session III 1710-1910 Room Name: Room 302 size: 150 --------------------------------------------- Request Information: --------------------------------------------------------- Working Group Name: Token Binding Area Name: Security Area Session Requester: Leif Johansson Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 75 Conflicts to Avoid: First Priority: httpbis oauth Second Priority: jose Special Requests: Avoid entire SEC area --------------------------------------------------------- From nobody Mon Oct 12 11:40:58 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F1F71B2B3B for ; Mon, 12 Oct 2015 11:40:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.261 X-Spam-Level: X-Spam-Status: No, score=-0.261 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lf6HSIfbPmyS for ; Mon, 12 Oct 2015 11:40:54 -0700 (PDT) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B9A501B2B07 for ; Mon, 12 Oct 2015 11:34:20 -0700 (PDT) Received: from smtp1.sunet.se (smtp1.sunet.se [192.36.171.214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t9CIYHNb024432 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Mon, 12 Oct 2015 20:34:18 +0200 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.9/8.14.7) with ESMTP id t9CIYERb008370 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 12 Oct 2015 20:34:17 +0200 (CEST) VBR-Info: md=sunet.se; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sunet.se; s=default; t=1444674857; bh=zETnQFzjYalc4I56mNlGSScu04WENNbQzAEYMI1Nzxw=; h=From:Subject:Date:References:To:In-Reply-To; b=RFUoJq2x2V1XhhfAPPfkpi0DuwNKtyQiYfF/wPrMAVDlwRgFETI7d2Q4A/vZjURzC 9JN6erqj6fKfalI4m9I0MbnfyXqNTeAw9I22uNS1poKUGs5KWiw3UsDdC7wTdEEG73 EVt5AXjHxc15icN5Y1RctmQ3q1TqskX6jEidTzoA= X-Footer: c3VuZXQuc2U= Received: from [62.102.145.131] ([62.102.145.131]) by kerio.sunet.se (Kerio Connect 8.5.2) for unbearable@ietf.org; Mon, 12 Oct 2015 20:34:12 +0200 From: "Leif Johansson" Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (1.0) Message-Id: Date: Mon, 12 Oct 2015 20:34:12 +0200 References: <560FF8A3.7050308@sunet.se> <56116BF8.9000006@mnt.se> <5612B79C.8030909@sunet.se> To: "unbearable@ietf.org" In-Reply-To: <5612B79C.8030909@sunet.se> X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, outbound-sunet-se:default, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09Psiyie4 - 96afc47d47eb - 20151012 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter01.sunet.se: 192.36.171.210 is neither permitted nor denied by domain leifj@sunet.se) receiver=e-mailfilter01.sunet.se; client-ip=192.36.171.210; envelope-from=; helo=smtp1.sunet.se; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.36.171.201 Archived-At: Subject: Re: [Unbearable] progress X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Oct 2015 18:40:55 -0000 > 5 okt 2015 kl. 19:47 skrev Leif Johansson : >=20 > On 2015-10-05 19:25, Andrei Popov wrote: >>> I suggest you rev now and we can push people to review the new draft. >> Will do. >>=20 >>> I don't think we can get code points before publication though but maybe= that was not what you meant... >> I am talking about an early IANA allocation of a TLS extension code point= per RFC 7120. The TLS WG has used these on a number of occasions. >>=20 >> There are at least two prototype implementations of the TB negotiation ex= tension being worked on (by Google and Microsoft). An early IANA code point a= ssignment would facilitate implementation and deployment experience prior to= the publication of the RFC. >=20 > ok then we should pursue that, I guess this is a task for me and JB! >=20 We have pushed this frame on the IESG stack From nobody Thu Oct 15 20:12:44 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 83FFA1B2DBD; Thu, 15 Oct 2015 20:12:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XYn-pyBNaYxF; Thu, 15 Oct 2015 20:12:39 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CAC871B2DBE; Thu, 15 Oct 2015 20:12:34 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.6.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151016031234.1533.83161.idtracker@ietfa.amsl.com> Date: Thu, 15 Oct 2015 20:12:34 -0700 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-https-02.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Oct 2015 03:12:40 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding Working Group of the IETF. Title : Token Binding over HTTP Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Filename : draft-ietf-tokbind-https-02.txt Pages : 13 Date : 2015-10-15 Abstract: This document describes a collection of mechanisms that allow HTTP servers to cryptographically bind authentication tokens (such as cookies and OAuth tokens) to a TLS [RFC5246] connection. We describe both _first-party_ as well as _federated_ scenarios. In a first-party scenario, an HTTP server issues a security token (such as a cookie) to a client, and expects the client to send the security token back to the server at a later time in order to authenticate. Binding the token to the TLS connection between client and server protects the security token from theft, and ensures that the security token can only be used by the client that it was issued to. Federated token bindings, on the other hand, allow servers to cryptographically bind security tokens to a TLS [RFC5246] connection that the client has with a _different_ server than the one issuing the token. This Internet-Draft is a companion document to The Token Binding Protocol [TBPROTO] The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-https/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-https-02 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-https-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Oct 15 20:15:22 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB7511B2DBF for ; Thu, 15 Oct 2015 20:15:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.388 X-Spam-Level: X-Spam-Status: No, score=-1.388 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dwuFU81ykgTz for ; Thu, 15 Oct 2015 20:15:20 -0700 (PDT) Received: from mail-yk0-x22a.google.com (mail-yk0-x22a.google.com [IPv6:2607:f8b0:4002:c07::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC15F1B2DBC for ; Thu, 15 Oct 2015 20:15:19 -0700 (PDT) Received: by ykdt21 with SMTP id t21so36385917ykd.3 for ; Thu, 15 Oct 2015 20:15:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :content-type; bh=ZM6Q3NDr3mjN+wFOE3B9H35P1X5uvcPMWd1t5Dyw4zQ=; b=XJLs0WpYCEqUUYdk1d3yPcqZwGLOwf+MJNpASGu9or/e7aivKrrMoDVessRJMlSkM2 J0fJWtb5eUOmwlXzzBk4tN4TCy1xR5QtWBpTuja+pNId+xb8S6nLHh30GJtdjaoksgUW Rl6zzo/PocLzw6tH1Ep/O6to9QiBuhgfEQlFdTkehvG4HdonIO9Y3mX5oLxZf92kK1yr 9YDdrK+TSZIzjuSF2n2R5PIxnSHtslAzSo3Rp5RNkYM9WjWxx40SzX3Sojjw68DYPGbU vmSH1tKTeL5ax3I5Rg44GX0w97NSwhvudT8fcOsy3Mx/vIzvYJH4ZrkHTKRMdLSwzCkT 9h5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:content-type; bh=ZM6Q3NDr3mjN+wFOE3B9H35P1X5uvcPMWd1t5Dyw4zQ=; b=GO7LmKi0XvmIBunfFeV9v4Lq6nlHrgOrB7+55HIt9pEGbcpQOYv8B0JRikSNhOvNEy g8ThUAv7fnW1jawREkJ8Qe7bMLKMQFuH+yMBz/NO6uhERQpA/kaIFnq1oXqnIhQKc7Us 6L+jjpAf3i33hxmQe36oWytubyHYBHMuaG530CrlibSsImJu+/Ef+vdXZvQfz9IY2e/D at64kAl1tiNA74h/vPWvwzkZNBhHGwky55aPZcvYIPBXK8OCXc8MDbOdwMPCo6Leoitk lv+H3Jr/F4Fs3vJ9+dauUGNOeyaeur9YbkuM10+MbKrKw9MJvqSVTMpSGG7yJ12MnIAy c8BA== X-Gm-Message-State: ALoCoQl90gNAgXyKbUk6iDrxlimw5ZIekTT83VgalwUh0gFO5VZcEIFnqYrzL+2aGTga6IKwcmjx X-Received: by 10.13.244.199 with SMTP id d190mr9760125ywf.297.1444965319025; Thu, 15 Oct 2015 20:15:19 -0700 (PDT) MIME-Version: 1.0 References: <20151016031235.1533.32007.idtracker@ietfa.amsl.com> In-Reply-To: <20151016031235.1533.32007.idtracker@ietfa.amsl.com> From: Dirk Balfanz Date: Fri, 16 Oct 2015 03:15:09 +0000 Message-ID: To: Tokbind WG Content-Type: multipart/alternative; boundary=94eb2c0356d48e27f905223034f6 Archived-At: Subject: [Unbearable] Fwd: New Version Notification for draft-ietf-tokbind-https-02.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Oct 2015 03:15:21 -0000 --94eb2c0356d48e27f905223034f6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Dear fellow Unbearables, I uploaded a new version of draft-ietf-tokbind-https. Highlights of changes: - removed the Sec- prefix from the header name again. - Provided rationalization for why the header should not be settable by a DOM API, as well as why we have _two_ TokenBinding proofs in federated scenarios, in the Security Considerations section. Dirk. ---------- Forwarded message --------- From: Date: Thu, Oct 15, 2015 at 8:12 PM Subject: New Version Notification for draft-ietf-tokbind-https-02.txt To: Adam Langley , Dirk Balfanz , Andrei Popov , "Magnus Nystr=C3=B6m" < mnystrom@microsoft.com> A new version of I-D, draft-ietf-tokbind-https-02.txt has been successfully submitted by Dirk Balfanz and posted to the IETF repository. Name: draft-ietf-tokbind-https Revision: 02 Title: Token Binding over HTTP Document date: 2015-10-15 Group: tokbind Pages: 13 URL: https://www.ietf.org/internet-drafts/draft-ietf-tokbind-https-02.txt Status: https://datatracker.ietf.org/doc/draft-ietf-tokbind-https/ Htmlized: https://tools.ietf.org/html/draft-ietf-tokbind-https-02 Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-tokbind-https-02 Abstract: This document describes a collection of mechanisms that allow HTTP servers to cryptographically bind authentication tokens (such as cookies and OAuth tokens) to a TLS [RFC5246] connection. We describe both _first-party_ as well as _federated_ scenarios. In a first-party scenario, an HTTP server issues a security token (such as a cookie) to a client, and expects the client to send the security token back to the server at a later time in order to authenticate. Binding the token to the TLS connection between client and server protects the security token from theft, and ensures that the security token can only be used by the client that it was issued to. Federated token bindings, on the other hand, allow servers to cryptographically bind security tokens to a TLS [RFC5246] connection that the client has with a _different_ server than the one issuing the token. This Internet-Draft is a companion document to The Token Binding Protocol [TBPROTO] Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --94eb2c0356d48e27f905223034f6 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Dear fellow Unbearables,

I uploaded a n= ew version of=C2=A0draft-ietf-tokbind-https.

Highl= ights of changes:

- removed the Sec- prefix from t= he header name again.
- Provided rationalization for why the head= er should not be settable by a DOM API, as well as why we have _two_ TokenB= inding proofs in federated scenarios, in the Security Considerations sectio= n.

Dirk.

=
---------- Forwarded message ---------
From: <internet-drafts@ietf.org>
= Date: Thu, Oct 15, 2015 at 8:12 PM
Subject: New Version Notification for= draft-ietf-tokbind-https-02.txt
To: Adam Langley <agl@google.com>, Dirk Balfanz <balfanz@google.com>, Andrei Popov <andreipo@microsoft.com>, "Magnu= s Nystr=C3=B6m" <mnystrom= @microsoft.com>



A new version of I-D, draft-ietf-tokbind-https-02.txt
has been successfully submitted by Dirk Balfanz and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-ietf-tokbind-https
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A002
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Token Binding over HTTP
Document date:=C2=A0 2015-10-15
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 tokbind
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 13
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-ietf-tokbind-https= -02.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0h= ttps://datatracker.ietf.org/doc/draft-ietf-tokbind-https/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://t= ools.ietf.org/html/draft-ietf-tokbind-https-02
Diff:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-tokbind-https-02

Abstract:
=C2=A0 =C2=A0This document describes a collection of mechanisms that allow = HTTP
=C2=A0 =C2=A0servers to cryptographically bind authentication tokens (such = as
=C2=A0 =C2=A0cookies and OAuth tokens) to a TLS [RFC5246] connection.

=C2=A0 =C2=A0We describe both _first-party_ as well as _federated_ scenario= s.=C2=A0 In
=C2=A0 =C2=A0a first-party scenario, an HTTP server issues a security token= (such
=C2=A0 =C2=A0as a cookie) to a client, and expects the client to send the s= ecurity
=C2=A0 =C2=A0token back to the server at a later time in order to authentic= ate.
=C2=A0 =C2=A0Binding the token to the TLS connection between client and ser= ver
=C2=A0 =C2=A0protects the security token from theft, and ensures that the s= ecurity
=C2=A0 =C2=A0token can only be used by the client that it was issued to.
=C2=A0 =C2=A0Federated token bindings, on the other hand, allow servers to<= br> =C2=A0 =C2=A0cryptographically bind security tokens to a TLS [RFC5246] conn= ection
=C2=A0 =C2=A0that the client has with a _different_ server than the one iss= uing
=C2=A0 =C2=A0the token.

=C2=A0 =C2=A0This Internet-Draft is a companion document to The Token Bindi= ng
=C2=A0 =C2=A0Protocol [TBPROTO]




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

--94eb2c0356d48e27f905223034f6-- From nobody Fri Oct 16 04:56:39 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA69C1A9138 for ; Fri, 16 Oct 2015 04:56:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8yTq4OmNpitt for ; Fri, 16 Oct 2015 04:56:35 -0700 (PDT) Received: from mail-lb0-f173.google.com (mail-lb0-f173.google.com [209.85.217.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5FFBD1A9135 for ; Fri, 16 Oct 2015 04:56:35 -0700 (PDT) Received: by lbbpp2 with SMTP id pp2so70286805lbb.0 for ; Fri, 16 Oct 2015 04:56:33 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-type :content-transfer-encoding; bh=Q02pRG5ESaUDV+fnijM2jDFP8/Ww0Uy3fqzTMsFzPoI=; b=EeaxhHFIhinthvnk7IFVup0Fi4/TVcAm/FP6uMblsk2WsKB4c554TW/zkiTA3/N8/9 HA7FwA5ye3gbOnLW1KAgIWkQdk/tuoxjBwk4FJAn00qAqu75k09Vk2k+hV1n0eAEsaDZ UnGZmZwuwU0iDdV6uhEiq0EFzycPiWSiEvGMufCIdF/6/H7W3rTVpD+bQSd4A7pb9nUc ynIftgWYfaQ9LyxaQEZMkUIGr25HrAByK9yBTZAWsp5V9W3nctCR6OaWQIRVvzcoJZrx bIzQZi/l7XQHuZPjJ7ibOSHKXUZg2z88zUQxJIHYokjqrYp0hqlWF4ZcgUImddJO8BbA IpjQ== X-Gm-Message-State: ALoCoQkGOLpRIApqWac6UdZYkvaYtOHig0h0Sutq4S6L/8tYHaNf5UQOL4hk/KtcGJAmwL5wPO0+ X-Received: by 10.112.13.34 with SMTP id e2mr6243259lbc.120.1444996593485; Fri, 16 Oct 2015 04:56:33 -0700 (PDT) Received: from [109.105.104.216] (dhcp81.se-tug.nordu.net. [109.105.104.216]) by smtp.googlemail.com with ESMTPSA id p140sm2828454lfe.44.2015.10.16.04.56.27 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Oct 2015 04:56:28 -0700 (PDT) To: unbearable@ietf.org References: <20151016031235.1533.32007.idtracker@ietfa.amsl.com> From: Leif Johansson Message-ID: <5620E5EB.9040806@mnt.se> Date: Fri, 16 Oct 2015 13:56:27 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Unbearable] Fwd: New Version Notification for draft-ietf-tokbind-https-02.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Oct 2015 11:56:38 -0000 On 2015-10-16 05:15, Dirk Balfanz wrote: > Dear fellow Unbearables, > > I uploaded a new version of draft-ietf-tokbind-https. > > Highlights of changes: > > - removed the Sec- prefix from the header name again. > - Provided rationalization for why the header should not be settable by > a DOM API, as well as why we have _two_ TokenBinding proofs in federated > scenarios, in the Security Considerations section. > Folks, Can I get some volunteer reviews of this version? I'm hoping can come into the F2F in Tokyo with a clear view of the light at the end of the tunnel! Cheers Leif