From nobody Fri Jan 8 12:54:22 2016 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 75C0A1B2BA6; Fri, 8 Jan 2016 12:54:09 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160108205409.16168.65075.idtracker@ietfa.amsl.com> Date: Fri, 08 Jan 2016 12:54:09 -0800 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-negotiation-02.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jan 2016 20:54:09 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding Working Group of the IETF. Title : Transport Layer Security (TLS) Extension for Token Binding Protocol Negotiation Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Filename : draft-ietf-tokbind-negotiation-02.txt Pages : 8 Date : 2016-01-08 Abstract: This document specifies a Transport Layer Security (TLS) [RFC5246] extension for the negotiation of Token Binding protocol [I-D.ietf-tokbind-protocol] version and key parameters. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-negotiation/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-02 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-negotiation-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Jan 8 12:57:33 2016 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DB61E1B2BA9; Fri, 8 Jan 2016 12:57:23 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160108205723.20706.73066.idtracker@ietfa.amsl.com> Date: Fri, 08 Jan 2016 12:57:23 -0800 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-protocol-04.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jan 2016 20:57:24 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding Working Group of the IETF. Title : The Token Binding Protocol Version 1.0 Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Filename : draft-ietf-tokbind-protocol-04.txt Pages : 14 Date : 2016-01-08 Abstract: This document specifies Version 1.0 of the Token Binding protocol. The Token Binding protocol allows client/server applications to create long-lived, uniquely identifiable TLS [RFC5246] bindings spanning multiple TLS sessions and connections. Applications are then enabled to cryptographically bind security tokens to the TLS layer, preventing token export and replay attacks. To protect privacy, the TLS Token Binding identifiers are only transmitted encrypted and can be reset by the user at any time. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-protocol-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-protocol-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Jan 8 13:11:27 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73E7C1B2BB8 for ; Fri, 8 Jan 2016 13:11:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0L7u5nrAYkGQ for ; Fri, 8 Jan 2016 13:11:13 -0800 (PST) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0142.outbound.protection.outlook.com [65.55.169.142]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 425471B2BC9 for ; Fri, 8 Jan 2016 13:11:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=FgCRFJGkDz/hJ9d/vjMFeI76S2MpzDR3IebaFV+yrUg=; b=eM54dLsjDlOQ0hq/DXTzOwbBu2otj75/tMcaW+FvZl/pDm0A41KcDOqCb2vlVBUC5KN4pCaMqmaK1kldbhsairtnHmU68NQMhdvNzwgCmxMGcTnUpxn3UPrb6rHL6q8rpF+aLDby247lztPpFL1QhuTjG/dCSSztSlur0srbg7w= Received: from BLUPR03MB1396.namprd03.prod.outlook.com (10.163.81.142) by BLUPR03MB1395.namprd03.prod.outlook.com (10.163.81.141) with Microsoft SMTP Server (TLS) id 15.1.361.13; Fri, 8 Jan 2016 21:10:59 +0000 Received: from BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) by BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) with mapi id 15.01.0361.006; Fri, 8 Jan 2016 21:10:59 +0000 From: Andrei Popov To: "unbearable@ietf.org" Thread-Topic: Updated Internet-Drafts: TBPROTO-04 and TBNEGO-02 Thread-Index: AdFKWRG76lpQ1/09RAKmFwoXnfqjlg== Date: Fri, 8 Jan 2016 21:10:59 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8::1d2] x-microsoft-exchange-diagnostics: 1; BLUPR03MB1395; 5:hVU89FR5TFjfQligegajeBnnIzJ+DeHdQ1gX26TxIxZCSto8F0I5iMgk6L2RKasEwGb1mTdDWcN1+D6n4dt2hVbTyMW3G6nw7ev69jRahy9rWlObZxGELV/p+vfeGK+UrYREnpDG4vPrtt1UuCALbw==; 24:aAcZz3N0xITmHRPUSYXqYlMQG7UP3Cvdk/HRcD9foy74Ni1s3plR3Wx1P9aaUhBH7P7tqK/VoDyuHgokkvbUnWokb6XHgGIGpbhN0ITzmok= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BLUPR03MB1395; x-ms-office365-filtering-correlation-id: 9067efd9-8d73-4d00-11b7-08d318703549 x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(601004)(2401047)(520078)(8121501046)(5005006)(10201501046)(3002001)(61426038)(61427038); SRVR:BLUPR03MB1395; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB1395; x-forefront-prvs: 0815F8251E x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(199003)(189002)(19580395003)(77096005)(10090500001)(5004730100002)(5003600100002)(33656002)(5001960100002)(6116002)(11100500001)(92566002)(50986999)(1730700002)(19617315012)(19300405004)(86362001)(2900100001)(8990500004)(2906002)(5008740100001)(10710500007)(16236675004)(1096002)(790700001)(7110500001)(86612001)(105586002)(74316001)(81156007)(122556002)(99286002)(450100001)(19625215002)(101416001)(15975445007)(87936001)(5002640100001)(5005710100001)(54356999)(586003)(110136002)(1220700001)(106356001)(40100003)(102836003)(189998001)(2501003)(76576001)(10290500002)(2420400006)(97736004)(229853001)(107886002)(2351001)(10400500002)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR03MB1395; H:BLUPR03MB1396.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BLUPR03MB13969BDDE0EAA8837DA5DBF08CF60BLUPR03MB1396namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Jan 2016 21:10:59.6256 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR03MB1395 Archived-At: Subject: [Unbearable] Updated Internet-Drafts: TBPROTO-04 and TBNEGO-02 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jan 2016 21:11:18 -0000 --_000_BLUPR03MB13969BDDE0EAA8837DA5DBF08CF60BLUPR03MB1396namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The updated Internet-Drafts TBPROTO-04 and TBNEGO-02 are available: https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-02 https://tools.ietf.org/html/draft-ietf-tokbind-protocol-04 Also on GitHib: https://github.com/TokenBinding/Internet-Drafts. The changes reflect our discussions in Yokohama and the feedback received s= ince then: 1. Moved token binding type out of the Token Binding ID structure per= Dirk's suggestion (because the type is contextual). 2. Added RSA and ECDSA public key format and signature format specifi= cations per Bill Cox's feedback (TBPROTO section 3). 3. Added a requirement for Renegotiation Indication extension per EKR= 's feedback (TBPROTO section 8.5 and TBNEGO section 6.2). 4. Changes in the TBPROTO introduction section per Yoav Nir's feedbac= k (TB is not only for the Web). Looking forward to review/comments/pull requests, Cheers, Andrei --_000_BLUPR03MB13969BDDE0EAA8837DA5DBF08CF60BLUPR03MB1396namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

The updated Internet-Drafts TBPROTO-04 and TBNEGO-02= are available:

https://tools.ietf.org/html/draft-ietf-tokbind-negoti= ation-02

https://tools.ietf.org/html/draft-ietf-tokbind-protocol-= 04

 

Also on GitHib: https://github.com/TokenBinding/Internet-D= rafts.

 

The changes reflect our discussions in Yokohama and = the feedback received since then:

1.     &= nbsp; Moved token binding type out of the Token Binding I= D structure per Dirk’s suggestion (because the type is contextual).

2.     &= nbsp; Added RSA and ECDSA public key format and signature= format specifications per Bill Cox’s feedback (TBPROTO section 3).

3.     &= nbsp; Added a requirement for Renegotiation Indication ex= tension per EKR’s feedback (TBPROTO section 8.5 and TBNEGO section 6.= 2).

4.     &= nbsp; Changes in the TBPROTO introduction section per Yoa= v Nir’s feedback (TB is not only for the Web).

 

Looking forward to review/comments/pull requests,

 

Cheers,

 

Andrei

 

--_000_BLUPR03MB13969BDDE0EAA8837DA5DBF08CF60BLUPR03MB1396namp_-- From nobody Wed Jan 27 19:34:27 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 929E31B31CD for ; Wed, 27 Jan 2016 19:34:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.667 X-Spam-Level: X-Spam-Status: No, score=-101.667 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H0oLDNDPzgj8 for ; Wed, 27 Jan 2016 19:34:24 -0800 (PST) Received: from gproxy4-pub.mail.unifiedlayer.com (gproxy4-pub.mail.unifiedlayer.com [69.89.23.142]) by ietfa.amsl.com (Postfix) with SMTP id 0E99A1B31CA for ; Wed, 27 Jan 2016 19:34:23 -0800 (PST) Received: (qmail 22591 invoked by uid 0); 28 Jan 2016 03:34:22 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by gproxy4.mail.unifiedlayer.com with SMTP; 28 Jan 2016 03:34:22 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw4 with id BFaK1s0072UhLwi01FaNiJ; Wed, 27 Jan 2016 20:34:22 -0700 X-Authority-Analysis: v=2.1 cv=IekUBwaa c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=XYUc-DgfXtMA:10 a=qAIPnPOG0EQA:10 a=7aQ_Q-yQQ-AA:10 a=yMhMjlubAAAA:8 a=SbB4GSP8QbDBJoenPMoA:9 a=QEXdDO2ut3YA:10 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=kingsmountain.com; s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Date:Message-ID:Subject:From:To; bh=IN2/+Yda1SZmlym70qF2mqw26zK4lFrfU9G7dTxQjIk=; b=p0O3fUdQSdrt+xG7CjjPAZnJx5vrGR7Uoc90v/+vghy9vvEZNhcu48ryX7IywWPio/lf4bMX4Hon5FAvWO7x7Bgg83yQLFPlkowofxSpSE449OriRLkd9l4ZZ84qKcYd; Received: from [70.211.0.94] (port=6238 helo=[10.0.0.1]) by box514.bluehost.com with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.84) (envelope-from ) id 1aOdLe-0004PZ-V0 for unbearable@ietf.org; Wed, 27 Jan 2016 20:34:19 -0700 To: IETF Tokbind WG From: =JeffH Message-ID: <56A98C2A.2020902@KingsMountain.com> Date: Wed, 27 Jan 2016 19:34:02 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Identified-User: {11025:box514.bluehost.com:kingsmou:kingsmountain.com} {sentby:smtp auth 70.211.0.94 authed with jeff.hodges+kingsmountain.com} Archived-At: Subject: Re: [Unbearable] Should Token Binding support non-TLS applications? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jan 2016 03:34:25 -0000 Howdy, I've been reviewing the three tokbind I-Ds (fyi/fwiw)....and in response to this older thread... on Fri, 18 Sep 2015 19:05:30 +0000 Andrei Popov wrote: > QUIC's use of TB will require a separate specification with their own > TB parameters negotiation mechanism, and their own binding method > (analogous to EKM for TLS). ISTM at this time that draft-ietf-tokbind-protocol-04 needs a bit of work in order to make it truly agnostic wrt the underlying transport protocol (i.e., TLS or QUIC or whatever). I'll attempt to point out such issues in my review, which I'll try to get sent to the list either this week or next. =JeffH