From nobody Thu Nov 10 13:17:33 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBED41296D1 for ; Thu, 10 Nov 2016 13:17:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.821 X-Spam-Level: X-Spam-Status: No, score=-1.821 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_NEUTRAL=0.779] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sunet-se.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n3NldAWHHzlO for ; Thu, 10 Nov 2016 13:17:29 -0800 (PST) Received: from mail-lf0-x233.google.com (mail-lf0-x233.google.com [IPv6:2a00:1450:4010:c07::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE52C1296C3 for ; Thu, 10 Nov 2016 13:17:28 -0800 (PST) Received: by mail-lf0-x233.google.com with SMTP id t196so200586076lff.3 for ; Thu, 10 Nov 2016 13:17:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sunet-se.20150623.gappssmtp.com; s=20150623; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=0pgxaBUHeRCftIBvDAdC1CsBU51SKGGWc5Kzz/6O8fw=; b=jhg+/IMBGJYAnY1Y/r8GsrZAQJwKnvWzKrrBtWOrQpF9lzfcaoi1jDFkoKDyvjyWNC 3AqVly4X6cvalmxmds1z9m8Sla1uYDYxNKEVSVM8IwaVdEf/MXHf+Tk5+ES3To//Hnww bVvErRYwp2jOvcJsioLUtzY1fcBzugT2SOWkJiHVpavNmcTS9eVFT0FWFlzoVIzrbyBU sgmJflaE+ew7FJp+0hLGbOZv7uY6F+vk69SryNMmPvu7ZAMmCppZAUgjNOKuXv5Ifytw jnkQMdrwwXiooW0u8tQqXu8K6OWrvBkz5hy7DctTVkEBL1vM8zI1Qv6MVhj77UYQUi5d 231g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=0pgxaBUHeRCftIBvDAdC1CsBU51SKGGWc5Kzz/6O8fw=; b=bJ7iT4Ytrz+Lk+4Xa2E7/u0637iuUdw7W6QVzPjt9fsFhrudETBybA/AAdZ1CkuW3+ 4FH3AiI+Q/oXO3Q5sLhS2wRgWV8u2pYVg6lGWn4DO3xW5C8GgTJlSI6PvBpfxhdcVwVg 2AGSEXH35c2rYB0W5rWXqQSzTr7k+ItwammdS25ocpKwoH1yc9uemZeZ6KW4SvNN78CT S0JyoSLGCLHBRqt67WXqSgPp34wPuJsnpzNuOTIBiOEdkRNoaTEi7UTOFRbaHvDMdERC mXmA+V7OEOiA0B7Qx07khRN0CnKG44dhX20sKqET198raEgg5JNSaM3PfHRk9bqetjc/ e07w== X-Gm-Message-State: ABUngvfxXOHXBF9RvEU/qi8H3frrBHlfwzxJfhI1rNsoXqsVk+jyekBIdpbECCrsbLKTjg== X-Received: by 10.25.135.130 with SMTP id j124mr4703943lfd.88.1478812646156; Thu, 10 Nov 2016 13:17:26 -0800 (PST) Received: from [10.0.0.147] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by smtp.gmail.com with ESMTPSA id m129sm1495520lfe.6.2016.11.10.13.17.25 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 10 Nov 2016 13:17:25 -0800 (PST) To: unbearable@ietf.org From: Leif Johansson Message-ID: <98f1a118-690b-eb8a-d4ed-e9ab7a164894@sunet.se> Date: Thu, 10 Nov 2016 22:17:24 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: [Unbearable] see you soon i Seoul X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Nov 2016 21:17:32 -0000 The session in Seoul will be focused on closing all outstanding issues of the core drafts so they can enter WGLC. Notably we need to close the EMM reneg issue and talk about privacy review. Interpretative dance, throat singing or even slides can be used if it gets us to WGLC, but the latter should be sent to us in advance of the session starting. Your friendly chairs John & Leif From nobody Thu Nov 10 14:16:02 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3361B129771 for ; Thu, 10 Nov 2016 14:16:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lzRBoiumjXMD for ; Thu, 10 Nov 2016 14:15:58 -0800 (PST) Received: from mail-it0-x231.google.com (mail-it0-x231.google.com [IPv6:2607:f8b0:4001:c0b::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8D6012963B for ; Thu, 10 Nov 2016 14:15:58 -0800 (PST) Received: by mail-it0-x231.google.com with SMTP id e187so289192497itc.0 for ; Thu, 10 Nov 2016 14:15:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=L0XPsl/Cwd75MD0KvrmOFPrkyivmZI2+zCLLsCscBDw=; b=r4hRdU2ttRH96ofDHbbMyIF1mHxdBzVp9Xo+yUbiweaJRL7qa4gt6WCIFrU4Bn0atx wFe4KLQ6Sbxn6SRgdVCQc2KcoqgtfxAIOyh31HneqLACWpyg1hEH2joqLtcP8eOBgo1d dL7skAStjwcuXkna+d09EeE6Y7H6/tojyv2BiOXovu4QkOfkci5rvYSRoXo/yBukArUw LuiuaWfevV7aIIsyW64Qx7fPlim1+KoHOjnvqfvVY5YF2HcXc/dB/m/SofLZ/S+yNOy8 GFiZtbEWJyfeg/xx2T4OcKhC60XU4aSX/cyd7Ls+F8WoY8DGkzVHGUweQGDDwS/ukl8/ cADA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=L0XPsl/Cwd75MD0KvrmOFPrkyivmZI2+zCLLsCscBDw=; b=SQf+zCMjmWGx1sKbp2YGXcHp/Cu0eZJIqJNn/Vrl8ULoAixUiErEDB9/+sgsxIspwk IG76HQmxlwwhqFq0vA3/iBqEeUZ9B6gjF0YVHpalr0p9yoXdd9O3QFCSYfrWETyvH1/o dih+NLNzx64AC9iHo41O1wJ5qMZ9WMS44TR07JdsGLs/KP09Ckfv8m/sZbmLEewD6Ydx VKSnMlBuIFYwffrLgVugN1WbscAwSu+Uj+s2WiWny9na9xXqFIkhDQzubb7QaioqnW38 kp0AgJnb14GRJx6gja5dsqINO2TyBQSmja8vJyZshgynuhWq+fc8m9mdlOm2O7/kBl9F UHgg== X-Gm-Message-State: ABUngveYtbUkYPxvMwtAxraaIcPA/GadB44Uf2sf62koy9HZzNq+jfYLpvwoFnje8ti2z9kyKmAwTjqkFEdkLzXk X-Received: by 10.107.140.65 with SMTP id o62mr8703186iod.17.1478816150585; Thu, 10 Nov 2016 14:15:50 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.76.201 with HTTP; Thu, 10 Nov 2016 14:15:50 -0800 (PST) X-Originating-IP: [172.56.12.166] Received: by 10.79.76.201 with HTTP; Thu, 10 Nov 2016 14:15:50 -0800 (PST) In-Reply-To: <98f1a118-690b-eb8a-d4ed-e9ab7a164894@sunet.se> References: <98f1a118-690b-eb8a-d4ed-e9ab7a164894@sunet.se> From: John Bradley Date: Thu, 10 Nov 2016 19:15:50 -0300 Message-ID: To: Leif Johansson Content-Type: multipart/alternative; boundary=94eb2c062b0a5824bc0540f9b784 Archived-At: Cc: unbearable@ietf.org Subject: Re: [Unbearable] see you soon i Seoul X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Nov 2016 22:16:01 -0000 --94eb2c062b0a5824bc0540f9b784 Content-Type: text/plain; charset=UTF-8 Just heading to my flight now. See you there. John B. On Nov 10, 2016 6:17 PM, "Leif Johansson" wrote: > > The session in Seoul will be focused on closing all outstanding > issues of the core drafts so they can enter WGLC. Notably we > need to close the EMM reneg issue and talk about privacy review. > > Interpretative dance, throat singing or even slides can be used > if it gets us to WGLC, but the latter should be sent to us in > advance of the session starting. > > > Your friendly chairs > John & Leif > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > --94eb2c062b0a5824bc0540f9b784 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Just heading to my flight now. See you there.

John B.


On Nov 10, 2016 6= :17 PM, "Leif Johansson" <le= ifj@sunet.se> wrote:

The session in Seoul will be focused on closing all outstanding
issues of the core drafts so they can enter WGLC. Notably we
need to close the EMM reneg issue and talk about privacy review.

Interpretative dance, throat singing or even slides can be used
if it gets us to WGLC, but the latter should be sent to us in
advance of the session starting.


=C2=A0 =C2=A0 =C2=A0 =C2=A0 Your friendly chairs
=C2=A0 =C2=A0 =C2=A0 =C2=A0 John & Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e
--94eb2c062b0a5824bc0540f9b784-- From nobody Thu Nov 10 14:25:38 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 053F31293DF for ; Thu, 10 Nov 2016 14:25:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5QbcryyHT5nw for ; Thu, 10 Nov 2016 14:25:35 -0800 (PST) Received: from mail-it0-x22f.google.com (mail-it0-x22f.google.com [IPv6:2607:f8b0:4001:c0b::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 121ED129771 for ; Thu, 10 Nov 2016 14:25:35 -0800 (PST) Received: by mail-it0-x22f.google.com with SMTP id q124so268188290itd.1 for ; Thu, 10 Nov 2016 14:25:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LhFj35gQ+lk1xQon3WpNP/R4Ob5M7v/Qsb4M3tob0cU=; b=VurZHQe5qoZ/RydzYXMiz5IXTHEqP114bNNcjlzSOrLBFupO14xT03H4KKay/nrY4g ltwanKBV422yI8WXWkbPdHIop7KRhsrio91wdiN4B7FS4wr7x7g7bmI9XD5PiPgN+yv/ 5mq5u5kmbAUDgWKPJDyc1cGfdnIIUCGr1boogUmyuo0wKs2wTa/wsey6+tlBbVeEuqxH 0IvYndTYtq1FnFQOpesCkuPn7vRvFQ5AixkuMF65KGVpLXKVqmf5BkK0tpQ53LVwO0oR c/0IwNc9n2Hyoyf90qyRAnKi0j+OMcKv46h1nyaf5rePUM7x087QTy5U2gKw/0OaRQ19 TmjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LhFj35gQ+lk1xQon3WpNP/R4Ob5M7v/Qsb4M3tob0cU=; b=Mbgv1+mEm5hh5u6UuQKeV/iXzJUBZVKd7GeBAZCWTY0Lww9rd4vjO0EM/oQDf7HQ8P gOp658RGxQHUP4cfhsarGsLQ+fanWSWOdcsLbWIXcfM8yowuxGvQi4gpKgtVv3n3Lzef xC9zuA08H5ir4U/MJMo8PvstnAKeMH8IKMy/bBwadzs2kLAxptsua9QH4meVoB8kF/ow vZwBvHOLx1e8y4K1VrG96dsTw1KIct2HrqpcQo3wBUygthgM2GGLjRZRaRkw4NqPVMIq hlNKlqhCBldsfD1tjG4NrgwEszl6kc/ESO7uQqCdOPSgKAmQI1EtTx1NSOEjeSEdgUCH x18A== X-Gm-Message-State: ABUngveico2HtIIjS2754uZw3QxPz5j8zUN3Sq+cx6axa9tZ/7wABQI4imietjwPRoaupyJJiFNnnzvNdp5ISPNx X-Received: by 10.107.136.86 with SMTP id k83mr8263038iod.99.1478816733586; Thu, 10 Nov 2016 14:25:33 -0800 (PST) MIME-Version: 1.0 References: <98f1a118-690b-eb8a-d4ed-e9ab7a164894@sunet.se> In-Reply-To: From: Dirk Balfanz Date: Thu, 10 Nov 2016 22:25:23 +0000 Message-ID: To: John Bradley , Leif Johansson Content-Type: multipart/alternative; boundary=001a113ecb3c18cd4a0540f9dac4 Archived-At: Cc: unbearable@ietf.org Subject: Re: [Unbearable] see you soon i Seoul X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Nov 2016 22:25:37 -0000 --001a113ecb3c18cd4a0540f9dac4 Content-Type: text/plain; charset=UTF-8 See you there! Dirk. On Thu, Nov 10, 2016 at 2:16 PM John Bradley wrote: > Just heading to my flight now. See you there. > > John B. > > On Nov 10, 2016 6:17 PM, "Leif Johansson" wrote: > > > The session in Seoul will be focused on closing all outstanding > issues of the core drafts so they can enter WGLC. Notably we > need to close the EMM reneg issue and talk about privacy review. > > Interpretative dance, throat singing or even slides can be used > if it gets us to WGLC, but the latter should be sent to us in > advance of the session starting. > > > Your friendly chairs > John & Leif > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > --001a113ecb3c18cd4a0540f9dac4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable See you there!

Dirk.
= On Thu, Nov 10, 2016 at 2:16 PM John Bradley <ve7jtb@ve7jtb.com> wrote:

Just heading to my flight now. = See you there.

John B.


On Nov 10, 2016 6:17 PM, "Leif Johansson" = <leifj@sunet.se> wrote:
=

The session in Seoul will be focused on closing all outstanding
issues of the core drafts so they can enter WGLC. Notably we
need to close the EMM reneg issue and talk about privacy review.

Interpretative dance, throat singing or even slides can be used
if it gets us to WGLC, but the latter should be sent to us in
advance of the session starting.


=C2=A0 =C2=A0 =C2=A0 =C2=A0 Your friendly chairs
=C2=A0 =C2=A0 =C2=A0 =C2=A0 John & Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/lis= tinfo/unbearable
_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/lis= tinfo/unbearable
--001a113ecb3c18cd4a0540f9dac4-- From nobody Sun Nov 13 21:51:37 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBA51129674 for ; Sun, 13 Nov 2016 21:51:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mjYKAcf4wdC2 for ; Sun, 13 Nov 2016 21:51:36 -0800 (PST) Received: from gproxy9-pub.mail.unifiedlayer.com (gproxy9-pub.mail.unifiedlayer.com [69.89.20.122]) by ietfa.amsl.com (Postfix) with SMTP id DE9CC129664 for ; Sun, 13 Nov 2016 21:51:35 -0800 (PST) Received: (qmail 14588 invoked by uid 0); 14 Nov 2016 05:51:34 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy9.mail.unifiedlayer.com with SMTP; 14 Nov 2016 05:51:34 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id 7hrV1u0012UhLwi01hrYUX; Sun, 13 Nov 2016 22:51:32 -0700 X-Authority-Analysis: v=2.1 cv=YNIMl32x c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=L24OOQBejmoA:10 a=48vgC7mUAAAA:8 a=wZqxgOZBNVMNqIoSPNYA:9 a=QEXdDO2ut3YA:10 a=y5nV1e6tivMA:10 a=w1C3t2QeGrPiZgrLijVG:22 Received: from dhcp-8f06.meeting.ietf.org ([31.133.143.6]:54548) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1c6AAz-0005TF-Rn for unbearable@ietf.org; Sun, 13 Nov 2016 22:51:30 -0700 From: =JeffH To: IETF TokBind WG Message-ID: Date: Mon, 14 Nov 2016 14:51:25 +0900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 31.133.143.6 X-Exim-ID: 1c6AAz-0005TF-Rn X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: dhcp-8f06.meeting.ietf.org [31.133.143.6]:54548 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 2 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] question wrt draft-mandyam-tokbind-attest X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 05:51:37 -0000 I have a question wrt https://tools.ietf.org/html/draft-mandyam-tokbind-attest-00 : why did you design this with the attestation information conveyed in a new TLS extension, rather than convey it as a TokenBinding.extension.. ..? Is it due to the use case of "Platform Attestation for Anomaly Detection" in section 5 ? thanks, =JeffH From nobody Sun Nov 13 23:54:52 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59BE61296CE for ; Sun, 13 Nov 2016 23:54:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XCgK4vI-d5lt for ; Sun, 13 Nov 2016 23:54:46 -0800 (PST) Received: from gproxy7-pub.mail.unifiedlayer.com (gproxy7-pub.mail.unifiedlayer.com [70.40.196.235]) by ietfa.amsl.com (Postfix) with SMTP id BA9631296C9 for ; Sun, 13 Nov 2016 23:54:46 -0800 (PST) Received: (qmail 22788 invoked by uid 0); 14 Nov 2016 07:54:43 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy7.mail.unifiedlayer.com with SMTP; 14 Nov 2016 07:54:43 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id 7jue1u00F2UhLwi01juhix; Mon, 14 Nov 2016 00:54:41 -0700 X-Authority-Analysis: v=2.1 cv=YNIMl32x c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=L24OOQBejmoA:10 a=NEAV23lmAAAA:8 a=Ss_Yl-udJpl95XDEyFYA:9 a=QEXdDO2ut3YA:10 a=I8uRvxd0AooA:10 a=l_b552Yey_cA:10 a=VlZU0XKO32wA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from dhcp-8f06.meeting.ietf.org ([31.133.143.6]:56550) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1c6C6B-0006tM-RD for unbearable@ietf.org; Mon, 14 Nov 2016 00:54:40 -0700 To: IETF TokBind WG From: =JeffH Message-ID: <8a7d7d4e-2efa-9b0a-8954-69ad43971610@KingsMountain.com> Date: Mon, 14 Nov 2016 16:54:34 +0900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 31.133.143.6 X-Exim-ID: 1c6C6B-0006tM-RD X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: dhcp-8f06.meeting.ietf.org [31.133.143.6]:56550 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] fyi: Update Fetch to support Token Binding. #325 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 07:54:51 -0000 fyi, here's where the work to have Fetch() support token binding is occuring... Update Fetch to support Token Binding. #325 https://github.com/whatwg/fetch/pull/325 ..if you have comments on this, raise 'em there. HTH, =JeffH From nobody Mon Nov 14 00:57:00 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B110D1295BE for ; Mon, 14 Nov 2016 00:56:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JCc7ikAxsx5Z for ; Mon, 14 Nov 2016 00:56:56 -0800 (PST) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22440129422 for ; Mon, 14 Nov 2016 00:56:56 -0800 (PST) Received: by mail-qk0-x22f.google.com with SMTP id q130so87916876qke.1 for ; Mon, 14 Nov 2016 00:56:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=XGWswOzE6JV2/t4szvLnJkakTP43Qa4vkD9sDjgmZos=; b=PVkIhYepQzDmOsPBu8sxHjJMQzDSq0bghvfa6sqqoS/meesV1MsEWg0wOzV0jfcn9Z Sug0MNfg+bp83lagE2USG3Ytnuyx5xaTfKON8YA0ZiEjpHhq8PXium1YYBj7AbaU9oRo lzLksLdWoaNMNlioYtrALOAyhdYuJOdBVBhFmxnBxEaIMsjuCzaNZ1C4VINsYDntJtbf We2/JGXDHzIso/33TIehfrL7XDo87vzHpsZ/s4CoNhImJ977gSJ9Hj0cGhVrgFqJL5Lw EGFOX+JihrSXiZGc4SDPcRCq8uQ7yqRQvuwaW4YyJTm2KoXdX0qt/x0CrUg+oQ0JCwpG JN8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=XGWswOzE6JV2/t4szvLnJkakTP43Qa4vkD9sDjgmZos=; b=cLKY8Ks6wE1hPHqZan7LsK0CwkjsW7tpv/S9jamgaqL1asb6LTMjqNNKSLgVawyCgq Ye3sCjf3CeNcZHe67dow98WiRKFjT8iwYo2Dc0tEBdw8ViFPnCbAsPtyQn0olgIwTdsg DN/NFQqtlxsMWCRt0BPUL5uGB4lIK9Rb6pweCZnFqKNKbi+UuTt3FIBzokdI4JcHF291 /YnqJjDkpgBt7p5ZCSAUldxAgr2FK8lh9RORMBhQo6aB+0mwkoSh/K+yXRvdi0t4xz9o ds4sq0dZZI+f0Aer1zBcpYvZpjb2itNFjfPo1pSXpv8o7sj/jSgVE6otuBUZ5IdsIeKJ ZfRQ== X-Gm-Message-State: ABUngvfWC5PKdBrQInl1Shrl7cI4AAYuiy0haFZ+i4Y6+Hr4xLCMlxvY619ZxmLLeXTMI6G8wr6X+lAX8SnwFw== X-Received: by 10.55.184.68 with SMTP id i65mr16729890qkf.5.1479113815180; Mon, 14 Nov 2016 00:56:55 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.85.7 with HTTP; Mon, 14 Nov 2016 00:56:54 -0800 (PST) From: Martin Thomson Date: Mon, 14 Nov 2016 17:56:54 +0900 Message-ID: To: "unbearable@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [Unbearable] Stop terminating connections X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 08:56:59 -0000 https://github.com/TokenBinding/Internet-Drafts/pull/80 I didn't make any changes to the HTTPS document, I don't really have time for that right now, but opinions on the matter are sought. From nobody Mon Nov 14 01:02:43 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97CB31295BE for ; Mon, 14 Nov 2016 01:02:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WsQwUYoLfM0w for ; Mon, 14 Nov 2016 01:02:39 -0800 (PST) Received: from mail-qk0-x22a.google.com (mail-qk0-x22a.google.com [IPv6:2607:f8b0:400d:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 447FA129491 for ; Mon, 14 Nov 2016 01:02:39 -0800 (PST) Received: by mail-qk0-x22a.google.com with SMTP id n204so88000015qke.2 for ; Mon, 14 Nov 2016 01:02:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=vkFV/Btg9tSenvo15i8Y24SZpX5/r6KO6HfQMOYCYBk=; b=REeeRuttbBbXNZBOYcrPmQ2JLjgwD3k4dBMLibrmfHw3XSoRv/nDNNKxHZYIGZKPz8 8+vyY8+0lHg2PJCBvud5i4C6vXcxMi6mkn8v6X5P6GgZb74Ml+jdyaEACgm/Jp0LVNFL hf0Bolvj2+UEc4XRED/xjM444VPwolwKw3Wy+pfiZqA5VwysChtwFStnD5gBE7HSEpiX AI0ts3GVwPjwogCOr89jGv0ls5KREiPz4i7mmCqIUx/pYq3wB8JisGKOCHm4KIx++7W5 29TmkcdC7ZKayUl4Z/Xob1NOF7ajJZyMI3u5CreGwExi7rMDV343D6TcXgKySrZ37rJO qkuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=vkFV/Btg9tSenvo15i8Y24SZpX5/r6KO6HfQMOYCYBk=; b=JohHS6kyWfmCPsTzKb5Frq17GVEJN9H0jh1Q8aJJdmw+HJy8YLm28sIB0TMorCHgs5 75cXu3/TwdJyeheZK3wDqIDYbL65PRagkh5r1g0O1thsF5GSuOrZDCm7rWsc8eQlR6Lr Vs/IBRW5x5ZG+Gn0miprM/89iP+dVHhKq4YQ8Q52QmKDcY7GqvEh2/hcmoYHo7oIYLnb zMJiUeWlzzSlGzgiIwzSPWbIsnPnbYpoNNpXBvG+RikYcgmOJ07aKtJt41Ikpm0Xu/cO NzumUCpIv8GhaNjZmyAVhXjJY3TGJVs7WbGN+/uIhv5LOhRArck4d5SPC6XjnFtR/piQ dhnw== X-Gm-Message-State: ABUngvcu8COFYxGbEQu8mLwarNwVYiXerX6tADFTHz7Y7n8CoFrmrK5qXroqkgNbqmAYNhxNB88IAOjDAgtohg== X-Received: by 10.55.12.2 with SMTP id 2mr15430336qkm.68.1479114158090; Mon, 14 Nov 2016 01:02:38 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.85.7 with HTTP; Mon, 14 Nov 2016 01:02:37 -0800 (PST) From: Martin Thomson Date: Mon, 14 Nov 2016 18:02:37 +0900 Message-ID: To: "unbearable@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [Unbearable] Draft minutes - errors are my own X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 09:02:41 -0000 IETF97 tokbind Andrei - core drafts Martin Thomson - RI is needed - Karthik Bhargavan pointed out an attack: https://mailarchive.ietf.org/arch/msg/tls/TfiUa3M390augtvUoxH2D7L5LGM Nick Harper - RI is easy to implement Martin - base64url is defined in RFC7515 Renegotiation Martin - if you do this, then unless you have some constraints, there are always error cases. It's unlikely, but we need to deal with those cases somehow. Nick - suggest using a profile - you can only use renego under certain conditions if you also use tokbind. For instance, h1 is the only place we can use this and you have to freeze the connection there. Martin - we should not use the original EKM Nick - tbproto should prohibit renegotiation unless the profile describes how it works. h1 mapping describes how we interleave renegotiation with the rest of the protocol. JeffH/DirkB - sounds good JeffH - propose that we WGLC now and treat these last few issues as LC comments Chairs - WGLC starts after this session Brian Campbell - on 0-RTT review there was a comment - are we OK with a fixed length EKM Andrei - wants a TLS unique Brian - what if we need a new algorithm that uses a longer key, is that OK to use with 32 bytes? Martin - not a cryptographer, but my understanding is that 32 is enough (similar enough to other cases), 32 bytes needs to be an absolute minimum. Might want to allow a bit of flexibility. Subodh Iyengar - do we have a strategy to manage key type rollover? Andrei - once in a few years, asking for users to re-type their password (or otherwise reauthenticate), is hard Martin - concerned about complexity Andrei - proponents could write an internet draft and we could evaluate it Dirk - sort of agree about complexity, we might want to think about migration Brian - forcing a login happens naturally anyway Nick - if the preference for key type doesn't change consistently across a fleet of servers, that reauthentication might be forced multiple times JeffH - what about github issues Chairs - if it isn't on the list, it doesn't exist, please bring github issues to the list Brian - even on the list, issues get ignored Brian - OAuth clients don't have explicit signaling about being able to reveal the referred token binding. If the client is pre-configured to use referred information, then it shouldn't need explicit signaling; there is already an understanding that the client wants to do this. Andrei - discussed in OAuth, we (inc. Dirk) agreed that this is a change we wanted Brian - will generate a PR Nick - explicit signal OR pre-arrangement is OK John Bradley - Fetch JS doesn't really have an explicit signal either, so we have to avoid making the language too restrictive Vinod Anupam - The current plan is that the javascript will make the decision Martin - You have three parties involved John - the origin that owns the referred token, the target of the request, and the origin of the javascript Dirk - the JS cannot talk about token bindings for other origins, if it requests a referred binding, it is its own origin John - that kills a bunch of use cases; which might be OK for security reasons Dirk - the boolean in fetch doesn't allow you to identify another origin for referral Andrei - to do anything else would allow sites to scrape the browser for tokens; we need this restriction from a security perspective Ben Kaduk - we have to have a signal from the owner of the token to allow this JeffH - the PR is still open, participate Martin - Another CORS header is probably unwise, particularly since that would allow any resource on any of the eTLD+1 origins to "release" the token identity 0-RTT Martin - 0-RTT exporters has different properties to other exporters Martin - What about replays of stuff that got rejected? Nick - Header fields will have to be overridden on retry. That doesn't happen in current implementations (not that there are many). Martin - We don't need the anti-replay indicator extension, or if we do, then we would benefit from having this generically. Andrei - Basing exporter keys on 0-RTT makes the token binding keys replayable. There are mitigations, and it might be useful for the client to know. Martin - If we have that capability, we should build it generically. Nick - we might only have replay protection for token binding stuff, but maybe the granularity isn't needed Kyle Nektritz - Replay only exists for the specific 0-RTT data that included the token binding. Ben - a combination of ticket age with other 0-RTT mitigations makes those other mitigations much easier to deploy Martin - Can we agree not to use 0-RTT exporters for long? Nick - Has an alternative that latches Martin - Does that require trial-verification? What about defining new types for early exporter stuff? Subodh - how do you decide to latch? What about an HTTP/2 message for it? Dirk - Meta: we should take on this work, and there are concerns we can resolve if we do adopt. Chairs - hum to adopt DECISION - adopt as a WG draft JeffH - can we proceed with existing docs before finishing this? Do we say anything about zero-RTT? Nick - Maybe we don't need to worry if we don't reference TLS 1.3. We can pretend that TLS 1.3 doesn't exist. Leif - Maybe we won't have 1.3 mentioned. JeffH - the spec doesn't explicitly say 1.2 right now. Martin - early exporters are very different to exporters, maybe we can say that in the document, maybe more so if we end up referring to TLS 1.3, but we don't have to because exporter != early exporter Chairs - please create a PR for us (no stuckee identified) TLS Termination Andrei - if the terminator is parsing and verifying, then it should pass the identifiers Brian - what about referred? Andrei - an array Martin - Prefer passing the EKM Brian - hard to deal with killing the connection Martin - that's a bad requirement ;) Action: create PR for dropping the connection you can use these architectures Subodh - what about pure TLS terminators that proxy at the TCP layer? Brian - I don't know... Subodh - hard to account for pure TLS terminators Subodh - if we have a PR to drop the connection drop requirement, we should talk about status codes Chairs - adopt? DECISION - consensus to work on the problem Tony Nadalin - if we adopt this, nothing will be slowed Chairs - yes, as long as we change the connection-closing language Martin - wanted to propose RFC 7239 as a candidate Brian - looking for guidance on TCP layer termination Subodh - maybe you can talk about that as being a problem; most of these are moved into an out-of-band channel From nobody Mon Nov 14 04:40:09 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 133D3129636 for ; Mon, 14 Nov 2016 04:40:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.821 X-Spam-Level: X-Spam-Status: No, score=-1.821 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_NEUTRAL=0.779] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sunet-se.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9DY7gqnQ6sQe for ; Mon, 14 Nov 2016 04:40:01 -0800 (PST) Received: from mail-pf0-x22c.google.com (mail-pf0-x22c.google.com [IPv6:2607:f8b0:400e:c00::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F9D212965B for ; Mon, 14 Nov 2016 04:40:00 -0800 (PST) Received: by mail-pf0-x22c.google.com with SMTP id d2so29749879pfd.0 for ; Mon, 14 Nov 2016 04:40:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sunet-se.20150623.gappssmtp.com; s=20150623; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=4HqKp6WNtAiY6og17C6s9pkSZ2F2UJq3LScTKgVgfNI=; b=FLOcGZxAmJ7sqy6NMLEybRhfqyVMdBjWMs+TbAZnv56coUUnNsT+VGyS/5bmXLBuX7 0iFVU3Lt7emUy6PUWU5sXDQfupBroAaKbfvFH5hKZdw0jzMxkCmJX5pi3cvrpQC8Ud0U sFT9VcyEfj/noMa1HDx+o5/iyVe0n895cvQfQXBfgBqASHIY2ZZK7mT7HtpeDwFi8e5V dyE+WttZ+i3RHf4hizLeHspIdQ3dC7c7lWq8j19AFpm4BB9czj53ZwCK3LY0+WhyQ2Vu bsHb8OCU/cP4S9nAnrmNiyJFwfD4E7aRhXdE+hGY5cTE1SNly4RVtQ1tJVjWChyq8crI fVXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=4HqKp6WNtAiY6og17C6s9pkSZ2F2UJq3LScTKgVgfNI=; b=KfBgEJpMWK2rL5AieryBDSlJI0rirtDV6bmByqkwTRe62fVwtoJ5RVIaT9XdWPhPzU Kh0zr0UhrimgIoMQd4KvohoI+YMclAZ1SlsXAs53RpOQjmrehfy9zogJGU53qxLvHHeA q4nFC8DfCrFi+JCLgbIDRyf+tLEhIhYCNowcuGOV80+NvLjrYCxXYB883eTFAKGoalF+ CNFZNczk1oLXVNYMA5LloeLN2HWviEmOI+7C5QOoIkGSAPktv2AqJYzEZdDe1Ro+lW5q eG7DTyunF31GBzMKbDiRpkw1MZJJZnwoKWK+bjvw6LgrSIop/O5xHqrTREb/3z7bfJUD F/8g== X-Gm-Message-State: ABUngvcSUGog8wf6lwy3S6TeCxz2h34LgALK3116L54q/CfLurFliKYsj2Tup7mO2ULlXw== X-Received: by 10.98.205.205 with SMTP id o196mr35522545pfg.145.1479127200093; Mon, 14 Nov 2016 04:40:00 -0800 (PST) Received: from [10.0.10.230] ([211.44.215.72]) by smtp.gmail.com with ESMTPSA id af14sm35295712pac.13.2016.11.14.04.39.58 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 14 Nov 2016 04:39:59 -0800 (PST) To: unbearable@ietf.org From: Leif Johansson Message-ID: <6a34409a-29e8-58d6-154a-a5cc6156eb03@sunet.se> Date: Mon, 14 Nov 2016 13:39:49 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: [Unbearable] WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 12:40:08 -0000 This starts a working group last call for the following documents: draft-ietf-tokbind-https-06 draft-ietf-tokbind-negotiation-05 draft-ietf-tokbind-protocol-10 Any comments should be send to the list before EOB November 30th and if at all possible should be accompanied by a PR against one or more of the documents on github. Note that issues on github are not automatically considered by the WG - comments in the form of open issues on github must be (re)sent to the list for the WG to consider them. Best R Leif & John From nobody Mon Nov 14 04:45:15 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81F8112967E for ; Mon, 14 Nov 2016 04:45:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HurDqgPJ29EK for ; Mon, 14 Nov 2016 04:45:12 -0800 (PST) Received: from mail-qt0-x234.google.com (mail-qt0-x234.google.com [IPv6:2607:f8b0:400d:c0d::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6CA0129636 for ; Mon, 14 Nov 2016 04:45:11 -0800 (PST) Received: by mail-qt0-x234.google.com with SMTP id n6so46276428qtd.1 for ; Mon, 14 Nov 2016 04:45:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=IznpIIHvB4SnVdW+U5009CrbQTjIbimyZz/SMqj0sSc=; b=n3eWRjlbrGdfaSSkzVEMzmF7YmK4jB8SDEW94RWB2PNrX/kMmC4C/zkqmCWU0remjM RAKUsh7+8U8qMFwddk1iI9grN5IapMMLM3JpzmvQbmyXxmaqSkAv1o1EUTyOUOhATkyb DHEHriWXGseDaFelDrlDSxgmYNxBTF7vZKS/000gd6M4GH/3xp20yAI62pOo27lrrdUG adXtndjsk3AUVtgTR0B+9nijX7lHTrCBfnZSXpbXq7mNfgc4V3VD8COAy/1Y+c6JsxTN Vi4ppAW6E0qFCOOBiFj1L7F9uW+OOddr5tyI6fIxK73f856pjXperd7uIGvteNposM0G 8pQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=IznpIIHvB4SnVdW+U5009CrbQTjIbimyZz/SMqj0sSc=; b=hmhbxyC2s9PnYOB7l7U0fPZPeTR4CiaSoo6zkyT0sQOvfqzdqpGGGuIN8xfZJEEPM3 6h4MG8AHhSUbrKWvVWKkAry+XkKLZXHeplD5MG9uDXu4lLS3EMjNVkxixSTlM5LmEN2k sMt3MIQAQu4yj+eGUPjmh/vzWV+CkzOg+VIv2WRgpZ2d/fFxs+xNlY7W0ibn6LMHrm0j 1bWfEFMk2q3I+ZyRGlJ0nTARCazH/sfDlL1AcXBQKw/kiBY4k5Y52eajJKrGHaoPwPoA zW2roqYd8wQ9Q4aDCds7gSpsoH6JsgzDUaiVrcQrhlk26/UH9g9SPK7RNgYFgeszqU4Y ggCg== X-Gm-Message-State: ABUngvdddZYCcfI9l9naWAeIWsVzTbAcSJcmOZ1BaZW0ShDpPKxPyakWDVBrmbEalgVz9TtuyN8JNpV5mKcorQ== X-Received: by 10.200.35.14 with SMTP id a14mr6719690qta.159.1479127510947; Mon, 14 Nov 2016 04:45:10 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.85.7 with HTTP; Mon, 14 Nov 2016 04:45:10 -0800 (PST) In-Reply-To: <6a34409a-29e8-58d6-154a-a5cc6156eb03@sunet.se> References: <6a34409a-29e8-58d6-154a-a5cc6156eb03@sunet.se> From: Martin Thomson Date: Mon, 14 Nov 2016 21:45:10 +0900 Message-ID: To: Leif Johansson Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 12:45:13 -0000 I have opened a PR that removes the requirement to close connections. It's very rough, and I already have a comment about the choice of 401 (the comment prefers 400), but I wanted to get that in as a placeholder. I think that this will make Brian's work easier (at least if he chooses the direction that I prefer). On 14 November 2016 at 21:39, Leif Johansson wrote: > > This starts a working group last call for the following documents: > > draft-ietf-tokbind-https-06 > draft-ietf-tokbind-negotiation-05 > draft-ietf-tokbind-protocol-10 > > Any comments should be send to the list before EOB November 30th > and if at all possible should be accompanied by a PR against one > or more of the documents on github. > > Note that issues on github are not automatically considered by > the WG - comments in the form of open issues on github must be > (re)sent to the list for the WG to consider them. > > Best R > Leif & John > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable From nobody Mon Nov 14 07:12:42 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD2E11295E7 for ; Mon, 14 Nov 2016 07:12:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.518 X-Spam-Level: X-Spam-Status: No, score=-8.518 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=qti.qualcomm.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a9ogHD2eq9Fc for ; Mon, 14 Nov 2016 07:12:40 -0800 (PST) Received: from wolverine01.qualcomm.com (wolverine01.qualcomm.com [199.106.114.254]) (using TLSv1.2 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8131B1295B0 for ; Mon, 14 Nov 2016 07:12:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qti.qualcomm.com; i=@qti.qualcomm.com; q=dns/txt; s=qcdkim; t=1479136360; x=1510672360; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=Fn56/Yr7ysBHvWxuns/mLJTN8rrB+8FEIAHkDzlsdH8=; b=VxLB0K6NegTLrMOOtaKZ/DKr1KOnI3N4gx5I6cmlqLOXNl65hpTU5cZb WiPZf3mi9SP4kMCSdFlmAiTO0/yWKKDM+C+GPg3Ca2jGvW9Xb729wNlOK IwLLTkCs8fLFbZgvajDYSuQchVF/o9ak4tthl0yIaWXeLbmAPN3yqrfmF k=; X-IronPort-AV: E=Sophos;i="5.31,491,1473145200"; d="scan'208";a="240135251" Received: from unknown (HELO Ironmsg04-L.qualcomm.com) ([10.53.140.111]) by wolverine01.qualcomm.com with ESMTP; 14 Nov 2016 07:12:38 -0800 X-IronPort-AV: E=McAfee;i="5700,7163,8348"; a="1237820910" Received: from nasanexm01h.na.qualcomm.com ([10.85.0.34]) by Ironmsg04-L.qualcomm.com with ESMTP/TLS/RC4-SHA; 14 Nov 2016 07:12:37 -0800 Received: from NASANEXM01C.na.qualcomm.com (10.85.0.83) by NASANEXM01H.na.qualcomm.com (10.85.0.34) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Mon, 14 Nov 2016 07:12:37 -0800 Received: from NASANEXM01C.na.qualcomm.com ([10.85.0.83]) by NASANEXM01C.na.qualcomm.com ([10.85.0.83]) with mapi id 15.00.1178.000; Mon, 14 Nov 2016 07:12:37 -0800 From: "Mandyam, Giridhar" To: IETF TokBind WG Thread-Topic: [Unbearable] question wrt draft-mandyam-tokbind-attest Thread-Index: AQHSPjsyVOuO0nF/y02j9tJnaq43SaDYkxYQ Date: Mon, 14 Nov 2016 15:12:37 +0000 Message-ID: <1c780b752ea6478facdc4c24205e54be@NASANEXM01C.na.qualcomm.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [199.106.107.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Unbearable] question wrt draft-mandyam-tokbind-attest X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 15:12:42 -0000 Hello Jeff, Thanks for taking the time to review the document. > why did you design this with the attestation information conveyed in a ne= w TLS extension, rather than convey it as a TokenBinding.extension. We constructed this proposal in such a way as to not interfere with ongoing= tokbind interop testing, which is why we defined a completely new TLS exte= nsion. Moreover, when we came up with this proposal a few months back were= using a version of the tokbind protocol spec that is out-of-date now (the = references point to version -08 of the document, but the version that intro= duced the current description of tokbind.extensions is -09. =20 But we are certainly open to your suggestion, and can modify the proposal a= s such. That could certainly be a cleaner way to do things, in my opinion. >..? Is it due to the use case of "Platform Attestation for Anomaly Detect= ion" in section 5 ? Section 5 is just an example of when an attestation in the TLS handshake co= uld be useful. It did not drive our decisions on defining a new extension. -Giri Mandyam -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of =3DJeffH Sent: Sunday, November 13, 2016 9:51 PM To: IETF TokBind WG Subject: [Unbearable] question wrt draft-mandyam-tokbind-attest I have a question wrt https://tools.ietf.org/html/draft-mandyam-tokbind-attest-00 : why did you design this with the attestation information conveyed in a new = TLS extension, rather than convey it as a TokenBinding.extension.. ..? Is it due to the use case of "Platform Attestation for Anomaly Detecti= on" in section 5 ? thanks, =3DJeffH _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Mon Nov 14 15:30:17 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE6A51294A6 for ; Mon, 14 Nov 2016 15:30:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.497 X-Spam-Level: X-Spam-Status: No, score=-3.497 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FPzR2Of_cY2H for ; Mon, 14 Nov 2016 15:30:14 -0800 (PST) Received: from mail-it0-x22b.google.com (mail-it0-x22b.google.com [IPv6:2607:f8b0:4001:c0b::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D6BD1294F3 for ; Mon, 14 Nov 2016 15:30:14 -0800 (PST) Received: by mail-it0-x22b.google.com with SMTP id c20so112124357itb.0 for ; Mon, 14 Nov 2016 15:30:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=CV8GHAf2uGsABzgSl1S438Bhev5eTKeXIeP1CJo06CI=; b=IXLeiDuJDaSdTUlMzb0w5zaPBp0dI4M/83rkBTmRgXYWttf0PrqqR0OLPmOPqy3t5D d4jjf+SGofLkAL+XwNr9IduCL58A0S5+b+EVphudwPGvEBDWdgfyRFuvsYV+VCjX04XU /xEPjTchGiuGCkqkQhIjnD0idlOuN5mZtunoUsewb0DHywuN2Bk829JwpJbbyktomRBz oeEh0GvHGQW3/rj4okmgDCjDeMmkRFldqlKWjFsE3YWqxd6D++UwV+eqHgHViuclYGMw vOflx5Fw8ZgU1J6GIjzxfM2lEDm0+RH3mFBPBBwshWAYug5aWeqKhWMEhepZsEPNhr7y iSYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=CV8GHAf2uGsABzgSl1S438Bhev5eTKeXIeP1CJo06CI=; b=CRDuASiZZUwQXSFp5sehOYrAxsBcKI6z6T9yXPvuT87fzU+I367Rc0jBWdQDNJ4zu7 I0AM4WZzxtdzVVRfi0oqVMKVzDk7kgrVz5ypCyvM74ZvPdx5NgqjhgLiF4fjUmKy8P3k VQHa5jDJ6P/NJNQZck+qiZBvthDJImCMgifAYgwhJjro1XSnd18WXC1YmrIRQLc7PHig s3sDdKxPSG7+6BLOGClXEqUkiF06FDgRjmlYpf2bcHLjJubtU+zPg5VaxDzie+09kGsl AV2Wg6u//h7leuPDjTQ8GAuuOMWuDbiJ98ZZLKA/3OzCDrDKR+ppvGF8Pc2DuESyZW3b qf4Q== X-Gm-Message-State: ABUngvdFe9xzuwKj/fnlB/FS9hVCqdXrmjzXj5yRUxojZ69iCf272isNRWOj0pFelWv9WS2VlCVNl/zSpBlvwFI8 X-Received: by 10.36.108.144 with SMTP id w138mr734723itb.68.1479166213845; Mon, 14 Nov 2016 15:30:13 -0800 (PST) MIME-Version: 1.0 Received: by 10.64.249.195 with HTTP; Mon, 14 Nov 2016 15:30:13 -0800 (PST) From: Bill Cox Date: Mon, 14 Nov 2016 15:30:13 -0800 Message-ID: To: Tokbind WG , Piotr Sikora Content-Type: multipart/alternative; boundary=001a113f88c8bdca4c05414b386c Archived-At: Subject: [Unbearable] Open source token binding libraries available X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 23:30:16 -0000 --001a113f88c8bdca4c05414b386c Content-Type: text/plain; charset=UTF-8 My long awaited library is at github.com/google/token_bind. As a super-awesome bonus, Piotr also open-sourced an NGINX module that uses it to provide token binding securityfor NGINX proxies, but I'll leave it up to Piotr to describe his work. Thanks again, Piotr! Bill --001a113f88c8bdca4c05414b386c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
My long awaited library is at github.com/google/token_bind.=C2=A0 As a super-awes= ome bonus, Piotr also open-sourced an NGINX module that uses it to provide = token binding securityfor NGINX proxies, but I'll leave it up to Piotr = to describe his work.=C2=A0 Thanks again, Piotr!

Bill
--001a113f88c8bdca4c05414b386c-- From nobody Mon Nov 14 15:59:54 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E30A12957C for ; Mon, 14 Nov 2016 15:59:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id shz1pvL3Kjlb for ; Mon, 14 Nov 2016 15:59:52 -0800 (PST) Received: from mail-it0-x22a.google.com (mail-it0-x22a.google.com [IPv6:2607:f8b0:4001:c0b::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7300129544 for ; Mon, 14 Nov 2016 15:59:51 -0800 (PST) Received: by mail-it0-x22a.google.com with SMTP id q124so135126886itd.1 for ; Mon, 14 Nov 2016 15:59:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=anm+2jjpvcrGopGsZMZ1n5AN5Gei1uzV0VFqUD/nLCk=; b=MF62jCAYD7hPYerpY4MDTF0442Z0TS33a2xFWyIReXpH1kkOEYoQEpDijMkIVxFsVe Il/67R1I/9o7Y1rUSxV3wf+VRlbtDwlXApkKdWyMaWGYMMAnJeamZwLhc01fa6SLbWeV ZZmtu9olyN6Y05v5tbF7kWQwilX90eiNNS2CY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=anm+2jjpvcrGopGsZMZ1n5AN5Gei1uzV0VFqUD/nLCk=; b=MrbWKJNrVsHkengBe7qhSC4twCzNTLV3h0U2AhwknE6tobbfxQOr1zhi9FbU0R8svJ OCs3L9cL98/rw26Bqsq/19Nb1S3bMaKf8480Lh7vJvYDJ1KKMgAippQ5d8Q2nQuwGfpb 80BPHQ/t/Dh8bIV0mxQsIwzeR5a8zpBvM181J7R0XC6TjWppLuD2TRorprSYXFyU02jN 7LNyO/AWZZcrHxiM8c7npIvAt270q5Ur1REzx7qUtyuCBwtEUUO8jX62D6op2tIcENL0 r+gBhZvegKkMcjj8rNAlF+wYJ0Lrs59IhCxHta5NrU9sjMHsstDyYNdsKgnRi0YZxlHD vbag== X-Gm-Message-State: ABUngveKa07p50meGHH7UgAGsQCJeYRbg+3R7qTbEeo6EV9N4F4rxEGr7QrkZ5lg4UKLJKzcTvA0Wl3XJDqPunJ5 X-Received: by 10.107.141.211 with SMTP id p202mr26994748iod.47.1479167991118; Mon, 14 Nov 2016 15:59:51 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.156.74 with HTTP; Mon, 14 Nov 2016 15:59:20 -0800 (PST) In-Reply-To: References: <6a34409a-29e8-58d6-154a-a5cc6156eb03@sunet.se> From: Brian Campbell Date: Mon, 14 Nov 2016 16:59:20 -0700 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=94eb2c062c9eac9f5305414ba270 Archived-At: Cc: IETF Tokbind WG , Leif Johansson Subject: Re: [Unbearable] WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 23:59:54 -0000 --94eb2c062c9eac9f5305414ba270 Content-Type: text/plain; charset=UTF-8 The requirement to terminate the connection was a main reason I was leaning away from the direction that Martin prefers (where the reverse proxy passes the EKM to the application and the app does the signature verification). This change would indeed make that work easier and would swing my preference back in the direction that Martin prefers, which also seemed like the direction that generally more folks in the room yesterday preferred. On Nov 14, 2016 9:45 PM, "Martin Thomson" wrote: > I have opened a PR that removes the requirement to close connections. > It's very rough, and I already have a comment about the choice of 401 > (the comment prefers 400), but I wanted to get that in as a > placeholder. > > I think that this will make Brian's work easier (at least if he > chooses the direction that I prefer). > > On 14 November 2016 at 21:39, Leif Johansson wrote: > > > > This starts a working group last call for the following documents: > > > > draft-ietf-tokbind-https-06 > > draft-ietf-tokbind-negotiation-05 > > draft-ietf-tokbind-protocol-10 > > > > Any comments should be send to the list before EOB November 30th > > and if at all possible should be accompanied by a PR against one > > or more of the documents on github. > > > > Note that issues on github are not automatically considered by > > the WG - comments in the form of open issues on github must be > > (re)sent to the list for the WG to consider them. > > > > Best R > > Leif & John > > > > _______________________________________________ > > Unbearable mailing list > > Unbearable@ietf.org > > https://www.ietf.org/mailman/listinfo/unbearable > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > --94eb2c062c9eac9f5305414ba270 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

The requirement to terminate the connection= was a main reason I was leaning away from the direction that Martin prefer= s (where the reverse proxy passes the EKM to the application and the app do= es the signature verification). This change would indeed make that work eas= ier and would swing my preference back in the direction that Martin prefers= , which also seemed like the direction that generally more folks in the roo= m yesterday preferred.



On Nov 14, 20= 16 9:45 PM, "Martin Thomson" <martin.thomson@gmail.com> wrote:
I have= opened a PR that removes the requirement to close connections.
It's very rough, and I already have a comment about the choice of 401 (the comment prefers 400), but I wanted to get that in as a
placeholder.

I think that this will make Brian's work easier (at least if he
chooses the direction that I prefer).

On 14 November 2016 at 21:39, Leif Johansson <leifj@sunet.se> wrote:
>
> This starts a working group last call for the following documents:
>
> draft-ietf-tokbind-https-06
> draft-ietf-tokbind-negotiation-05
> draft-ietf-tokbind-protocol-10
>
> Any comments should be send to the list before EOB November 30th
> and if at all possible should be accompanied by a PR against one
> or more of the documents on github.
>
> Note that issues on github are not automatically considered by
> the WG - comments in the form of open issues on github must be
> (re)sent to the list for the WG to consider them.
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Best R
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Leif & John
>
> _______________________________________________
> Unbearable mailing list
> Unbearable@ie= tf.org
> https://www.ietf.org/mailman/listinfo/unbe= arable

_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearabl= e
--94eb2c062c9eac9f5305414ba270-- From nobody Wed Nov 16 01:42:45 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34C5C1296BF for ; Wed, 16 Nov 2016 01:42:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=momentumft.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kYvXV-NIps5G for ; Wed, 16 Nov 2016 01:42:42 -0800 (PST) Received: from mail-qt0-x230.google.com (mail-qt0-x230.google.com [IPv6:2607:f8b0:400d:c0d::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C45512969A for ; Wed, 16 Nov 2016 01:42:41 -0800 (PST) Received: by mail-qt0-x230.google.com with SMTP id c47so94134206qtc.2 for ; Wed, 16 Nov 2016 01:42:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=momentumft.co.uk; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=7SKPkAZQImdj50o95Qva5Dc1u9RrL5uie/suKDlVoTQ=; b=Gi+USHVh+wt14L8rSWAAhf28INcudN+9otf8ogA0zy2WezRAGAVHSo1RMzUAj7zaAK I3eDY96uumB3LDz+/mpNgjb3bJIeHejD0gIfwkIwp66bwCsu4SxkcEhJnO1cj5C8qUhk jFZEm5T5i57PoLAQjG+4aA7iu6f7GgCfGgPTU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=7SKPkAZQImdj50o95Qva5Dc1u9RrL5uie/suKDlVoTQ=; b=GWjlFTcnrry4pNtp4pusI540FFazC+e8LCw9J7ytwhlpHVp3fnumT6Vgeb6hq2+6+0 /7EWjZvWEUnpIhZmJHW9e1oknwFK4pq0Bgg/1oqJgVzB5tz6Gk5qs7e8CoHfv9VL5G1Z 5DHXbKLdWE2xZJ+tMKgNiUet+ZKh86OS+wIhRezxYIzmsvWge/yMPrHkq0Wc21l7tsuv y6cVm1C2JEa4MvCAZxCr02mDkrmC/McntmBIH9lVypQssDvUGwVLMmTXP1/LNu3N+SB6 lfZtfvue+7NhiDYfi5OiZmeiHwcQWQDLL2YzCJjhbYtmEFjc4fMkRk5hh9UyFaaVt2VY 4+Pw== X-Gm-Message-State: ABUngve3cstKb/AA2nIwXmTBkhloHJwX9+bRRrRX+QjGXOavV9BrVK40Iv0ldpwz0wY1TMTE94UqM6/zQZK/QK7w X-Received: by 10.25.212.211 with SMTP id l202mr839026lfg.89.1479289360753; Wed, 16 Nov 2016 01:42:40 -0800 (PST) MIME-Version: 1.0 Received: by 10.114.97.97 with HTTP; Wed, 16 Nov 2016 01:42:20 -0800 (PST) In-Reply-To: References: From: Dave Tonge Date: Wed, 16 Nov 2016 09:42:20 +0000 Message-ID: To: Bill Cox Content-Type: multipart/alternative; boundary=001a11400d62de43cc054167e483 Archived-At: Cc: Tokbind WG , Piotr Sikora Subject: Re: [Unbearable] Open source token binding libraries available X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Nov 2016 09:42:44 -0000 --001a11400d62de43cc054167e483 Content-Type: text/plain; charset=UTF-8 Thanks Bill. Really good news. On 14 November 2016 at 23:30, Bill Cox wrote: > My long awaited library is at github.com/google/token_bind. As a > super-awesome bonus, Piotr also open-sourced an NGINX module that uses it > to provide token binding securityfor NGINX proxies, but I'll leave it up to > Piotr to describe his work. Thanks again, Piotr! > > Bill > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > -- Dave Tonge CTO 10 Temple Back | Bristol | BS1 6FL t: +44 (0)117 280 5120 m: +44 (0)7577 815570 Momentum Financial Technology Ltd is authorised and regulated by the Financial Conduct Authority (Register number 561538). Registered in England & Wales, company registration number 06909772. DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Ltd or of any other group company. --001a11400d62de43cc054167e483 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Thanks Bill.
Really good news.

On 14 November 2016 at 23:3= 0, Bill Cox <waywardgeek@google.com> wrote:
My long awaited library is at github.com/goo= gle/token_bind.=C2=A0 As a super-awesome bonus, Piotr also open-sourced= an NGINX module that uses it to provide token binding securityfor NGINX pr= oxies, but I'll leave it up to Piotr to describe his work.=C2=A0 Thanks= again, Piotr!

Bill

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e




--
=
Dave Tonge
CTO
10 Temple Back | Bristol | BS1 6FL
t:=C2=A0+44 (0)117 280 5120
m:=C2=A0+44 (0)7577 815570
=C2=A0
Momen= tum Financial Technology Ltd is authorised and regulated by the Financial C= onduct Authority (Register number=C2=A0561538). Registered in England & Wales, compan= y registration number=C2=A006909772.=C2=A0DISCLAIM= ER: This email (including any attachments) is subject to copyright, and the= information in it is confidential. Use of this email or of any information= in it other than by the addressee is unauthorised and unlawful. Whilst rea= sonable efforts are made to ensure that any attachments are virus-free, it = is the recipient's sole responsibility to scan all attachments for viru= ses. All calls and emails to and from this company may be monitored and rec= orded for legitimate purposes relating to this company's business. Any = opinions expressed in this email (or in any attachments) are those of the a= uthor and do not necessarily represent the opinions of Momentum Financial T= echnology Ltd or of any other group company.
=
--001a11400d62de43cc054167e483-- From nobody Wed Nov 16 20:28:11 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 287FE129484 for ; Wed, 16 Nov 2016 20:28:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4AQv4Q8Sxnlk for ; Wed, 16 Nov 2016 20:28:07 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A773D127A90 for ; Wed, 16 Nov 2016 20:28:07 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1479356886; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=Y35fmfb5/NRYd5FcuRxoeI6KFDN1GU03MmvCOCPIjFU=; b=Z5gp8Q3xCW9oxuBx0nZxiDVpE4rxo+N4z8NFjh+7jqYcKt3gQhCvVwHDWEAQ5xhs8eUU6Ssy /ne3S8USKvTpbudqAAS1WteNOUivqLWgL+ITFYaxxb5+ZfmQcnLrmt3QSICTnQwVux0HVgm9 mJ0+2Q9arJsG4tGlaoKSzlZjXQg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=rYd6g/bpPeuObtwimQYAJfBUHf1GFgxZ0GxbWZ3nc6v3w20kvb1Y7Bihx5ZIxPPOFhEH8G c0LVWlEhp1Yn+/dHU2OwIHZIhTC3uwwhj1LkL4baG66rETWff+3k9Alu4xBaaZQdAi94kFSn FVn9U0EQjkyYDD+PVSXxFM+XW5iFI= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.34]) by mxa.mailgun.org with ESMTP id 582d31d6.7f3fb3fb8090-smtp-out-n01; Thu, 17 Nov 2016 04:28:06 -0000 (UTC) Date: Wed, 16 Nov 2016 20:28:06 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <582d31d6965bf_2da43fe13642913411999c@hookshot-fe2-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_582d31d6961a7_2da43fe136429134119822"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] b27243: Starting a new revision of the I-Ds for WGLC comme... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 04:28:09 -0000 ----==_mimepart_582d31d6961a7_2da43fe136429134119822 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: b27243c67b01f647c3a046ae1664003776681f04 https://github.com/TokenBinding/Internet-Drafts/commit/b27243c67b01f647c3a046ae1664003776681f04 Author: Andrei Popov Date: 2016-11-17 (Thu, 17 Nov 2016) Changed paths: M README.md R draft-ietf-tokbind-https-06.xml A draft-ietf-tokbind-https-07.xml R draft-ietf-tokbind-negotiation-05.xml A draft-ietf-tokbind-negotiation-06.xml R draft-ietf-tokbind-protocol-10.xml A draft-ietf-tokbind-protocol-11.xml Log Message: ----------- Starting a new revision of the I-Ds for WGLC comments ----==_mimepart_582d31d6961a7_2da43fe136429134119822-- From nobody Wed Nov 16 21:54:15 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 760361296E1 for ; Wed, 16 Nov 2016 21:54:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vAkEVsH4n3wv for ; Wed, 16 Nov 2016 21:54:11 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F051129646 for ; Wed, 16 Nov 2016 21:54:11 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1479362050; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=HEs5tJUBl2McLlQ+BAasiNlAjUmsit5Z673sivjvAwg=; b=DqML8B8WnF2h3F1yuZJA9qbC8UGPqcE+0y/EM3H08zvrOUAPtqUj6MOWn4u0PWPW6miG7Tk6 2dWDSI5uQjczbhV9A+EJSdrFMlkFuwPdDOtw83k0MCu2MJU5I1clk2kKZSGQl/bCQ0puZ+T2 CIsqXoVdeQeYcrtQRZgt3zc61M0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=K/KaFNYqJwyGpx7/7x34tWEzR/O8ucj0ak7TSpLddvUQbz48r2s9YSP3j/7/h8yHlZHG4e 5cP2btKkmhuqL6DQcRSehyO6yZywa5DU1TdnPKsbPT3fvcf1u3h76ue1HdXhoAKW/BgxPkDX /7n9YCbZZGegKjJ3/BZVvw3LOiPvo= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.41]) by mxa.mailgun.org with ESMTP id 582d4602.7f1f0f3a2630-smtp-out-n01; Thu, 17 Nov 2016 05:54:10 -0000 (UTC) Date: Wed, 16 Nov 2016 21:54:10 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <582d4602c1221_5d9a3f8dcf1ad140117059@hookshot-fe5-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_582d4602c0e07_5d9a3f8dcf1ad140116914"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 662224: TB verification failure leads to the rejection of ... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 05:54:13 -0000 ----==_mimepart_582d4602c0e07_5d9a3f8dcf1ad140116914 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 662224ff4cbe2bb764a0000be878353c27599a72 https://github.com/TokenBinding/Internet-Drafts/commit/662224ff4cbe2bb764a0000be878353c27599a72 Author: Andrei Popov Date: 2016-11-17 (Thu, 17 Nov 2016) Changed paths: M draft-ietf-tokbind-protocol-11.xml Log Message: ----------- TB verification failure leads to the rejection of the binding, not necessarily a connection termination. ----==_mimepart_582d4602c0e07_5d9a3f8dcf1ad140116914-- From nobody Wed Nov 16 22:12:36 2016 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E5A31129650; Wed, 16 Nov 2016 22:12:34 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.38.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147936315493.23919.7069055809975427717.idtracker@ietfa.amsl.com> Date: Wed, 16 Nov 2016 22:12:34 -0800 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-tls13-0rtt-00.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 06:12:35 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding of the IETF. Title : Token Binding for 0-RTT TLS 1.3 Connections Author : Nick Harper Filename : draft-ietf-tokbind-tls13-0rtt-00.txt Pages : 10 Date : 2016-11-16 Abstract: This document describes how Token Binding can be used in the 0-RTT data of a TLS 1.3 connection. This involves updating how Token Binding negotiation works and adding a mechanism for indicating whether a server prevents replay. A TokenBindingMessage sent in 0-RTT data has different security properties than one sent after the TLS handshake has finished, which this document also describes. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-tls13-0rtt/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-tls13-0rtt-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Nov 16 23:44:46 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE5391295D1 for ; Wed, 16 Nov 2016 23:44:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LlSgol2NfvVh for ; Wed, 16 Nov 2016 23:44:43 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5CE611294C7 for ; Wed, 16 Nov 2016 23:44:43 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1479368682; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=pOGzKmvOP7kYomYd3LJz6d66ynCzNaMb1bmZ5dLXC9k=; b=D+qHWxZeyurR7/gJVrh67NpqGV3Csxvx7IcjFt3k/GyUPdgo8cWFXm/Zc4MeJYkSVbtVwx+T psutNHqazbG5XwAjG6FQJNKZ/ui6GAR+P1otjv4FFs7KVFaI3b7/aMy6xvQmIO3JFU5hfRbK 9W8PjgPkYFBibcOBbG22JRgOOCk= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=SySqPIPUgqf3oxdo/f3ZC4xYq9l7vcUtOLWrwK5ARVNBCv+TghaBRr5JjRE0sf8vnu47Q7 Hk6FcIOhiP2GaOtgVmHt3KNmcW82j1OCNdyI1Lw1PjKcLC4k/pB60bow2lZMKInW+lBtg2bz VH6hD0KB90rOIh0BIKySBJP+s96WY= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.41]) by mxa.mailgun.org with ESMTP id 582d5fea.7f9c6c350b40-smtp-out-n01; Thu, 17 Nov 2016 07:44:42 -0000 (UTC) Date: Wed, 16 Nov 2016 23:44:42 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <582d5fea599a1_5d9a3f8dcf1ad1401174fa@hookshot-fe5-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_582d5fea59572_5d9a3f8dcf1ad1401173e7"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 7bbf21: TB verification failure leads to the rejection of ... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 07:44:45 -0000 ----==_mimepart_582d5fea59572_5d9a3f8dcf1ad1401173e7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 7bbf212612b237f4869df1f3965164ba2a84e916 https://github.com/TokenBinding/Internet-Drafts/commit/7bbf212612b237f4869df1f3965164ba2a84e916 Author: Andrei Popov Date: 2016-11-17 (Thu, 17 Nov 2016) Changed paths: M draft-ietf-tokbind-https-07.xml Log Message: ----------- TB verification failure leads to the rejection of the binding, not necessarily a connection termination. ----==_mimepart_582d5fea59572_5d9a3f8dcf1ad1401173e7-- From nobody Thu Nov 17 01:45:27 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C6D2129501 for ; Thu, 17 Nov 2016 01:45:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PBPS643M5HGh for ; Thu, 17 Nov 2016 01:45:24 -0800 (PST) Received: from m71-131.mailgun.net (m71-131.mailgun.net [166.78.71.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A354D129644 for ; Thu, 17 Nov 2016 01:45:24 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1479375923; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=aFtk7s3GB8MtIxteqyjNQ8WVkperT3qO5phg0Nev6DY=; b=UNpDRmLmI5pw1z7xZ7A/OSCJNM1GpY+7CPN9vbjDcR5NKrAPV7DViTyF4DWEkBfZ22ndGeVX mps4K69stxNHS8Fy6aV+LhaMNzBjS15bDMjj/TgcmpyE1EuhdFbc9nWf03HyGztyD5jUhUMT YpBa44ulV143XzKWQiciyOwyJDQ= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=Jum3gJGaMZ01HCa8T0kcE4QZFQ3D5syJpyYMn1IAvp8l5E+kuqumFrVhuFDQHnnYkuxOLa TmWwaps79T6sdCcAQ+9DacvbBDF1fR0EZW+1EA1/ra4mApKS+BzxGu8jJQXK/cecgyyC1Iwd 5tRbX9dawgdr8fHLh+QPV1em+kvLQ= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.71.131 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.42]) by mxa.mailgun.org with ESMTP id 582d7968.7f02545d48a0-in01; Thu, 17 Nov 2016 09:33:28 -0000 (UTC) Date: Thu, 17 Nov 2016 01:33:27 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <582d7967efc27_1f3ae3fbbeb05913c149085@hookshot-fe-6dbb0c4.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_582d7967ef920_1f3ae3fbbeb05913c148985"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] e141bb: Clarified the use of Token Binding in combination ... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 09:45:26 -0000 ----==_mimepart_582d7967ef920_1f3ae3fbbeb05913c148985 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: e141bbf9dd4fb4d6900b9aaca55375a7b4a664f9 https://github.com/TokenBinding/Internet-Drafts/commit/e141bbf9dd4fb4d6900b9aaca55375a7b4a664f9 Author: Andrei Popov Date: 2016-11-17 (Thu, 17 Nov 2016) Changed paths: M draft-ietf-tokbind-negotiation-06.xml M draft-ietf-tokbind-protocol-11.xml Log Message: ----------- Clarified the use of Token Binding in combination with TLS renegotiation. ----==_mimepart_582d7967ef920_1f3ae3fbbeb05913c148985-- From nobody Thu Nov 17 01:49:36 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62512129644 for ; Thu, 17 Nov 2016 01:49:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zDG_3UTUU8ob for ; Thu, 17 Nov 2016 01:49:34 -0800 (PST) Received: from m69-170.mailgun.net (m69-170.mailgun.net [166.78.69.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8CDD127077 for ; Thu, 17 Nov 2016 01:49:33 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1479376173; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=1Cv8tKCZD15lHxMTkBjRl4vJwSsWpEh8RbwV4puup8g=; b=qFDjcMsPMb0cGwGoqt+csAkt2bKYwJ1MLaqnc7lrNezKafYzrWjQ3BAYiPxjf5Sd+4IrKGFz P3AmkpuQQQwCE9MUaQ6NeS1nF3omswjx3ffWKPNUs6KE5NYj12DpNSb8xbM8K6K83r0iWw81 UaYCqD6vR/WUdaswlG5wWRGB+9U= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=L2lqjwGVGyyVUAxRlSCU/a+p1MjSTyXgKOBKx00gYIQ0gYqjQ2/y/TdNYQuP2vo7K1SeMK VG5QNz7EYfMe9yKqXXEOwKhLt/JY5cdkDvc5LHZcguCnDy/Mb70nKLnOaJgA9qreYVwyG62V lD7+DZ0pu/cUBPkrqEzOcAHz/VJ2U= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.69.170 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.45]) by mxa.mailgun.org with ESMTP id 582d7d2c.7f44b6bfda20-smtp-out-n03; Thu, 17 Nov 2016 09:49:32 -0000 (UTC) Date: Thu, 17 Nov 2016 01:49:32 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <582d7d2cd4967_43fd3fe43a38f14096162@hookshot-fe3-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_582d7d2cd45a4_43fd3fe43a38f1409606d"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] cac99f: Clarified that other signature schemes may require... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 09:49:35 -0000 ----==_mimepart_582d7d2cd45a4_43fd3fe43a38f1409606d Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: cac99f7c9337f32c8573c878878d4da7f9eeb186 https://github.com/TokenBinding/Internet-Drafts/commit/cac99f7c9337f32c8573c878878d4da7f9eeb186 Author: Andrei Popov Date: 2016-11-17 (Thu, 17 Nov 2016) Changed paths: M draft-ietf-tokbind-protocol-11.xml Log Message: ----------- Clarified that other signature schemes may require longer exporter output. ----==_mimepart_582d7d2cd45a4_43fd3fe43a38f1409606d-- From nobody Thu Nov 17 16:01:58 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A724129587 for ; Thu, 17 Nov 2016 16:01:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnt-se.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1Qe9FejjfPln for ; Thu, 17 Nov 2016 16:01:55 -0800 (PST) Received: from mail-pg0-x235.google.com (mail-pg0-x235.google.com [IPv6:2607:f8b0:400e:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82433129581 for ; Thu, 17 Nov 2016 16:01:55 -0800 (PST) Received: by mail-pg0-x235.google.com with SMTP id p66so96362399pga.2 for ; Thu, 17 Nov 2016 16:01:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnt-se.20150623.gappssmtp.com; s=20150623; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=H4QILPvUJghDxUjLAh1/zfPJfi1euMj78UM3ldNkvTc=; b=QmUzE0rgolDkhk4+EtKgoCjLn9MJMShi+Kc8u9b6ABe6KEdkwbKB1q7dUAJJPtrFId zJEz4Ma5aRbHCmRU6j9keoh60WrXteD3jf8SpMYzgPr8AK8LFsaw0yOW60+Py3ZcD5n5 KhlQb+S0mfNUi6MeL2u52L9SPzYfQpSe45MbPUKSbR7mgxky5lMNzvZ/zkRiz/9cY+BS vnwgnHYUtIAVeg9HW9+tHjz7KuuSNF/te0KN2v4esgR88GHsBOTyNz+4t3D88EGkimyS wJsl0bJWQ6J5ctmp3tqE0+w6MZ8cE73GwsY4P/J0byhdB7j4fPU3uyIY1d2YrlABrYkG EwRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=H4QILPvUJghDxUjLAh1/zfPJfi1euMj78UM3ldNkvTc=; b=KhGyitmhc2IeOICSyTLGKaqw2EFSbL1cxM372wCvleUI26FwhJ9VIMEbkd6lbqygK5 pEId8tCw2ePCmhvqkRJ4prNYs2SrAG/qWKk2Tn0QzQpj+nljggTQD5SnjlAoqTxGDFNk IkUGENs4qxT6VpPV/Oj/a/NgHt7Q/MpIZhxtqNA5ghUJBOTAKK3SKEIe2RClJwnpMegj VBIsNSFOuFnXl+wmJzsEdGO5OneIVMN/dHVhet0srCe0nZRbwRBcMh+dMheYwJOP+Y1R WYTMIJLZxsUjyx4abPXnASAejD3HTwzioIwcCXzoFfQDk2Gt72tPi9VJY62c8KPA0aXs V/0Q== X-Gm-Message-State: ABUngveZG2jwrSQsJPteVJ4w1a2cLtAvLT/hbsGcum07Cb5OUAw4Q74t+tx2N5z0NhGmzw== X-Received: by 10.98.79.25 with SMTP id d25mr7763803pfb.42.1479427314795; Thu, 17 Nov 2016 16:01:54 -0800 (PST) Received: from [10.0.10.185] ([211.44.215.72]) by smtp.gmail.com with ESMTPSA id i76sm10983934pfk.89.2016.11.17.16.01.53 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 Nov 2016 16:01:54 -0800 (PST) To: unbearable@ietf.org From: Leif Johansson Message-ID: <8e529eba-0867-1edb-530f-3197e5eda4b6@mnt.se> Date: Fri, 18 Nov 2016 01:01:46 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] notes online X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 00:01:57 -0000 Thx to Martin T for excellent note-taking. Review the notes. If you object to anything in there, now is the time to say so. Cheers Leif From nobody Fri Nov 18 02:56:54 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A71712969D for ; Fri, 18 Nov 2016 02:56:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=balfanz=google.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iq4pAxEWwWFb for ; Fri, 18 Nov 2016 02:56:51 -0800 (PST) Received: from m71-131.mailgun.net (m71-131.mailgun.net [166.78.71.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7147129697 for ; Fri, 18 Nov 2016 02:56:50 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1479466610; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=iws+PSphQ63/j6+VobY4qfB7bBNHLdS4v3S2VrDBpQQ=; b=K5iVF464orP0VW2qMU43yNKu9BDKDgoPM6i5G8HuHzTa/VAbGaCKqroYxGU2BOq0hgUkE3zm ccmvrgKLNin0yDq0tzFUnucLBGJChutvyPtjiGK7+P10uxuHr8mDqQOShrAIuSbKe6c+tRgD OJfb57LCrKL9KuRZawQuQeL0YLc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=HQPllyAfvUHIL7gIGltAtlzUmGwqLur4UPlp3XRlRsZC4bsdY1d3ff17Mee3lpL+8wzUEH K/ifFxKyF+enGoHcrFfnCpTbFviw3Hz1U6v0BsVQssGIeXsgglf6xbmRc2zSUGJVe9X3fECK 74iokO3FQTl/G4qKeD/11lHE/k7U8= Sender: balfanz=google.com@github.com X-Mailgun-Sending-Ip: 166.78.71.131 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.34]) by mxa.mailgun.org with ESMTP id 582ede71.7f7f84223ed0-smtp-out-n03; Fri, 18 Nov 2016 10:56:49 -0000 (UTC) Date: Fri, 18 Nov 2016 02:56:49 -0800 From: Dirk Balfanz To: unbearable@ietf.org Message-ID: <582ede71b6083_141f3fdeade1313012066@hookshot-fe2-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_582ede71b5c4b_141f3fdeade1313011958"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] dd05f0: Clarifying when the eTLD+1 scoping rules MUST be u... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Dirk Balfanz List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 10:56:52 -0000 ----==_mimepart_582ede71b5c4b_141f3fdeade1313011958 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: dd05f0f678b3836618938284d0c2032c8731d96e https://github.com/TokenBinding/Internet-Drafts/commit/dd05f0f678b3836618938284d0c2032c8731d96e Author: Dirk Balfanz Date: 2016-11-18 (Fri, 18 Nov 2016) Changed paths: M draft-ietf-tokbind-https-07.xml Log Message: ----------- Clarifying when the eTLD+1 scoping rules MUST be used, and when they can be relaxed. ----==_mimepart_582ede71b5c4b_141f3fdeade1313011958-- From nobody Fri Nov 18 04:36:44 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1779C129440 for ; Fri, 18 Nov 2016 04:36:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=balfanz=google.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZQT-NXgGlfcX for ; Fri, 18 Nov 2016 04:36:40 -0800 (PST) Received: from m69-170.mailgun.net (m69-170.mailgun.net [166.78.69.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0A5A1294EA for ; Fri, 18 Nov 2016 04:36:40 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1479472600; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=o0zGGMGp6sraXKaHDScO9kaL7/ZgH9YBrDA6cg/lTuM=; b=As7TnyhpVsI8kPXuUxogW3mHECMLpE2SV6zJa+ygPwl3ICJc1GyHND6ULaVmj0FOJTp+E89M a/6qN8+TCrO29gKkTaubQdX3o2WB6eFMzryb1CygrYPTFHsaw8SZ+0swXmZKFqUswXzrKSg5 Vy50gVb4jCym6unU8j1WLqJ2MdE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=IvWKHS5r2QOMeC9vgEjNZx286N8K5GUcxJLecFAhqrQGesE84EIN0CnvkmM4RM2iCDEPvf 0TWcV+JeIAs3Dm8PAwkp8pHysLnxxcZnmacGb1XCRieqWYXBb1QlQZPxodgBftp5JmgYhjPA FLF2Lj1Tao3jS0KXUf+bIX8VtrrjE= Sender: balfanz=google.com@github.com X-Mailgun-Sending-Ip: 166.78.69.170 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.40]) by mxa.mailgun.org with ESMTP id 582ef5d1.7f2c9fb9d120-in01; Fri, 18 Nov 2016 12:36:33 -0000 (UTC) Date: Fri, 18 Nov 2016 04:36:33 -0800 From: Dirk Balfanz To: unbearable@ietf.org Message-ID: <582ef5d1a862f_713a3fc4f597b13073841@hookshot-fe6-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_582ef5d1a820f_713a3fc4f597b13073795"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 96526b: Clarifying when referred Token Bindings can be use... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Dirk Balfanz List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 12:36:42 -0000 ----==_mimepart_582ef5d1a820f_713a3fc4f597b13073795 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 96526be5fc14dc9dddf846b6709426ca23fe195b https://github.com/TokenBinding/Internet-Drafts/commit/96526be5fc14dc9dddf846b6709426ca23fe195b Author: Dirk Balfanz Date: 2016-11-18 (Fri, 18 Nov 2016) Changed paths: M draft-ietf-tokbind-https-07.xml Log Message: ----------- Clarifying when referred Token Bindings can be used, and that the Include-Referred-Token-Binding-ID is but one of the possible mechanisms to trigger this. Closes #79. ----==_mimepart_582ef5d1a820f_713a3fc4f597b13073795-- From nobody Fri Nov 18 04:40:30 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFC83129487 for ; Fri, 18 Nov 2016 04:40:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fdn_1yyvke3u for ; Fri, 18 Nov 2016 04:40:27 -0800 (PST) Received: from mail-it0-x232.google.com (mail-it0-x232.google.com [IPv6:2607:f8b0:4001:c0b::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E885129440 for ; Fri, 18 Nov 2016 04:40:27 -0800 (PST) Received: by mail-it0-x232.google.com with SMTP id l8so24551523iti.1 for ; Fri, 18 Nov 2016 04:40:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=tadjdglmfhwpbUrJtooC7D6FrPEthOeWRhUUJ9TbEn0=; b=Tl7Ej90/D0LbEjI69SrrbM9HO5/WXz8vR08h2sCw1MRx6zPN+ZcJ96+2Es3XKWbWem gUERpU4s3sinqa47z1EIIopfckKkqUGZSnXF/B6BAp0jabYcfGyt3Vl7j8fJf3lnyZ9f rV9YiZhagEQWebSESJrvrjaW86gbWqFBmSYrkC7WkFzs8ST7cVXAOtiUzko8W1oIakpn /nu/dSrp6s8WpHZ3mHgFFzaVxwHqeJmC7c8Yc5LtVInNicXC4wNnDyiD7/LINKFTjay1 9+RXyzog09U4vlrHxb0P1Ft+z1oqa4GtLwUMcWz6SPu5VfdnXRtZWhQzzzq+CKECTviA C2Xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=tadjdglmfhwpbUrJtooC7D6FrPEthOeWRhUUJ9TbEn0=; b=UOL6j8+ZbbTMz6TekGw9fZadW+VBkxZkj+ZyjHZkdf6iaZKY7wf15D7gFtfXtCO+F7 sERAQd8LzTH+5LqaBdT9B9TOs4d8UgUntklXDm3RoUCV8zN9QKiF0axS10NDW1x/r9wM fvYCskEwne6UUeMliOYoghmzHEu94RTzxeadWTfDU9lSmwnyssFAA0W8meqEJu2bbCH2 MI2WIQHa3YFnpScP+iTFsTgtgRmHPNebun2/BINclc/C/uuAf/5Ea9lFpHmAGmdC7KUb 3dljbyNyo0lV3bCs+PmVy02E6Kr3feD0pOKMiQWCAqqQAk8JXRaYm8LKQ/jsHJGbPGpG QOeQ== X-Gm-Message-State: ABUngvf1gKLDGm5Y6KsBcoX4A8qLCgwkKGzdaYstQ09avcvRqgFw0G/9WMpaREoyPt50KOd9CEhLAFbWWnvHaxu6 X-Received: by 10.36.41.81 with SMTP id p78mr18973377itp.60.1479472826330; Fri, 18 Nov 2016 04:40:26 -0800 (PST) MIME-Version: 1.0 From: Dirk Balfanz Date: Fri, 18 Nov 2016 12:40:15 +0000 Message-ID: To: Brian Campbell , Tokbind WG Content-Type: multipart/alternative; boundary=001a11440cca451a1a0541929cd7 Archived-At: Subject: [Unbearable] Token Binding spec edits to be more OAuth-friendly X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 12:40:29 -0000 --001a11440cca451a1a0541929cd7 Content-Type: text/plain; charset=UTF-8 Hi Brian, can you check that the two changes I just committed address your needs re/ OAuth and Token Binding: https://github.com/TokenBinding/Internet-Drafts/commit/96526be5fc14dc9dddf846b6709426ca23fe195b https://github.com/TokenBinding/Internet-Drafts/commit/dd05f0f678b3836618938284d0c2032c8731d96e Thanks, Dirk. --001a11440cca451a1a0541929cd7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Thanks,=C2=A0
<= br>
Dirk.

--001a11440cca451a1a0541929cd7-- From nobody Fri Nov 18 05:57:28 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D86981295A3 for ; Fri, 18 Nov 2016 05:57:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.618 X-Spam-Level: X-Spam-Status: No, score=-2.618 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DibOYJCs_hPS for ; Fri, 18 Nov 2016 05:57:26 -0800 (PST) Received: from smtp6-g21.free.fr (smtp6-g21.free.fr [212.27.42.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF4BD129421 for ; Fri, 18 Nov 2016 05:57:25 -0800 (PST) Received: from [192.168.0.13] (unknown [88.182.125.39]) by smtp6-g21.free.fr (Postfix) with ESMTP id B342E7803D5 for ; Fri, 18 Nov 2016 14:57:23 +0100 (CET) To: unbearable@ietf.org References: From: Denis Message-ID: Date: Fri, 18 Nov 2016 14:57:27 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------8461C144767C946B301ECB6E" Archived-At: Subject: [Unbearable] draft-ietf-tokbind-https-06: Security Token Replay X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 13:57:28 -0000 This is a multi-part message in MIME format. --------------8461C144767C946B301ECB6E Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Hello, I subscribed to this list this week. I read draft-ietf-tokbind-https-06. The text states in section 6.1: 6. Security Considerations 6.1. Security Token Replay The goal of the Federated Token Binding mechanisms is to prevent attackers from exporting and replaying tokens used in protocols between the client and Token Consumer, thereby impersonating legitimate users and gaining access to protected resources. Bound tokens can still be replayed by malware present in the client. In order to export the token to another machine and successfully replay it, the attacker also needs to export the corresponding private key. This approach looks fine as long as the client is used by an honest user or an honest entity. Alas, this is not always the case. The approach is not resistant to the ABC attack, i.e. the Alice and Bob Collusion attack. In this scenario Bob is willing to collaborate with Alice so that he can export a token that can be re-used by Alice. Alice will not necessarily impersonate Bob but will only be re-using a token that has been legitimately originally obtained by Bob. If this token contains an attribute saying "older than 18", Alice can present it to a protected resource that can remember this attribute. If she is older than 18 today, tomorrow she will obviously be older than 18 and such an attribute does not need to be renewed. So she can keep advantage of it until she will really be 18. This means that this approach is not able to fill-in the original charter of this WG, which is : It is a goal of this working group to enable defense against attacks that involve unauthorized replay of security tokens. since the Alice and Bob Collusion attack defeats this approach. Also note that in the ABC attack, in order to export the token to another machine and successfully replay it, Bob *does not need to export the corresponding private key*. Denis --------------8461C144767C946B301ECB6E Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit Hello,

I subscribed to this list this week. I read draft-ietf-tokbind-https-06. The text states in section 6.1:
6.  Security Considerations

6.1.  Security Token Replay

   The goal of the Federated Token Binding mechanisms is to prevent
   attackers from exporting and replaying tokens used in protocols
   between the client and Token Consumer, thereby impersonating
   legitimate users and gaining access to protected resources.  Bound
   tokens can still be replayed by malware present in the client.  In
   order to export the token to another machine and successfully replay
   it, the attacker also needs to export the corresponding private key.
This approach looks fine as long as the client is used by an honest user or an honest entity.
Alas, this is not always the case.

The approach is not resistant to the ABC attack, i.e. the Alice and Bob Collusion attack.

In this scenario Bob is willing to collaborate with Alice so that he can export a token
that can be re-used by Alice. Alice will not necessarily impersonate Bob but will only be re-using a token
that has been legitimately originally obtained by Bob. If this token contains an attribute saying "older than 18",
Alice can present it to a protected resource that can remember this attribute. If she is older than 18
today, tomorrow she will obviously be older than 18 and such an attribute does not need to be renewed.
So she can keep advantage of it until she will really be 18.

This means that this approach is not able to fill-in the original charter of this WG, which is :
It is a goal of this working group to enable defense against attacks that involve unauthorized replay of security tokens.
since the Alice and Bob Collusion attack defeats this approach.

Also note that in the ABC attack, in order to export the token to another machine and successfully replay it,
Bob does not need to export the corresponding private key.

Denis


--------------8461C144767C946B301ECB6E-- From nobody Fri Nov 18 13:00:45 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D31111295FB for ; Sat, 12 Nov 2016 20:02:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.882 X-Spam-Level: X-Spam-Status: No, score=-4.882 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YzJpa1GJCihx for ; Sat, 12 Nov 2016 20:02:25 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext7.iad.github.net [192.30.252.198]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7753D129554 for ; Sat, 12 Nov 2016 20:02:25 -0800 (PST) Date: Sat, 12 Nov 2016 20:02:24 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479009744; bh=EFcOSGn+auhQI5revpInwebzSv3SZQKXt7noSmWN+mI=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=duhHx/CpXCRbCJ53bt3i+CVqlM+XK2emuwM8KOjH/4ZHI+4CnJijVfLCwxW6Tf10U Y4ZJZy/I/m0JfitetauP6Inia4u3awFFGtErAXRQWvPOjri3cqy3uATiuPbmvrxjf9 ieLaOmOxd458pknmVi+ZwxZ0o8uALQTW4Lz3ISZU= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5827e5d0ba30f_67513fe9201571301620b4"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Clarify behavior for renegotiation (#72) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Nov 2016 04:02:27 -0000 ----==_mimepart_5827e5d0ba30f_67513fe9201571301620b4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit since this is PR is after -protocol-10 and -negotiation-05 publication, it ought to also rename the two relevant .xml files to be -protocol-11 and -negotiation-06 -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/72#issuecomment-260165658 ----==_mimepart_5827e5d0ba30f_67513fe9201571301620b4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

since this is PR is after -protocol-10 and -negotiation-05 publication, it ought to also rename the two relevant .xml files to be -protocol-11 and -negotiation-06

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5827e5d0ba30f_67513fe9201571301620b4-- From nobody Fri Nov 18 13:00:48 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDF8D129498 for ; Sun, 13 Nov 2016 01:00:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.383 X-Spam-Level: X-Spam-Status: No, score=-5.383 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y3D5b4PG7j6P for ; Sun, 13 Nov 2016 01:00:37 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext2.iad.github.net [192.30.252.193]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3415C129485 for ; Sun, 13 Nov 2016 01:00:37 -0800 (PST) Date: Sun, 13 Nov 2016 01:00:36 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479027636; bh=6gIlGXVprK8cD0HuJhWLPWDpMT+RHnVFyZ5f0/WIZ4M=; h=From:Reply-To:To:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=2Yn0pg4rmW11eVakhza4gR7eQxik1HC5ZcKJ13S2/Eda4zNpjmJcGo0t9GDZUeRNy IqclyYBrcVOxupxUJw6lR9wVLoO3SIUBgi/jqOuSjU3I67otpUXAfXpI4LBVVpV5Kg 884uZUSEvot/OZ/qp5/NlWqGaCAgRiJLUk6Vn7Vk= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58282bb44bbbb_94a3f9f5a06d13034125"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: Clarify hazards of renegotiation wrt Token Binding (#76) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Nov 2016 09:00:39 -0000 ----==_mimepart_58282bb44bbbb_94a3f9f5a06d13034125 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit see: https://www.ietf.org/mail-archive/web/unbearable/current/msg00929.html @martin-thomson : "I am very happy to see text that explains the hazards of renegotiation in this context and that initiators of renegotiation should ensure that they line their ducks up correctly (with all the ins-and-outs, etc...)." @Andrei-Popov : "I'll add some text to this effect in the next revision." -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/76 ----==_mimepart_58282bb44bbbb_94a3f9f5a06d13034125 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

see: https://www.ietf.org/mail-archive/web/unbearable/current/msg00929.html

@martin-thomson : "I am very happy to see text that explains the hazards of renegotiation in this context and that initiators of renegotiation should ensure that they line their ducks up correctly (with all the ins-and-outs, etc...)."

@Andrei-Popov : "I'll add some text to this effect in the next revision."

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58282bb44bbbb_94a3f9f5a06d13034125-- From nobody Fri Nov 18 13:00:51 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9892F1294B4 for ; Sun, 13 Nov 2016 23:03:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.382 X-Spam-Level: X-Spam-Status: No, score=-5.382 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AsFWewxnu8nD for ; Sun, 13 Nov 2016 23:03:50 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BFBC1294E3 for ; Sun, 13 Nov 2016 23:03:50 -0800 (PST) Date: Sun, 13 Nov 2016 23:03:49 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479107029; bh=VKDz4gSrmiaz6aCkBIPChWb+qkNg3fQYuBUkGxtwg+A=; h=From:Reply-To:To:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=cOfK9+UPx8FAZMjU0Ds75QIyll0Wp3cau9uwFQu85APVUJBtYFmWIFQwW2Cl+gHue S/Q1v884cER9QeJHz0faX/SXsl8YHoh6IcXy5RxQ8ZCwUNQJ+NrzhRc0/8l7NJFOPt LNidzKIcWul3QZOy8LcQYe2oQ9PpcZauPy81MUr8= From: balfanz To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582961d54d6dc_209fa3faba1e6d1384384bb"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: balfanz X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: Clarify that applications don't have to scope keys by eTLD+1 (#77) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 07:03:51 -0000 ----==_mimepart_582961d54d6dc_209fa3faba1e6d1384384bb Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit While **web browsers** must scope Token Binding keys to eTLD+1s, such a rule does not necessarily apply to other apps, which are free to scope their keys differently as long as they preserve user privacy. We should clarify that any mention of eTLD+1-based scoping applies only to web browsers. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/77 ----==_mimepart_582961d54d6dc_209fa3faba1e6d1384384bb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

While web browsers must scope Token Binding keys to eTLD+1s, such a rule does not necessarily apply to other apps, which are free to scope their keys differently as long as they preserve user privacy.

We should clarify that any mention of eTLD+1-based scoping applies only to web browsers.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582961d54d6dc_209fa3faba1e6d1384384bb-- From nobody Fri Nov 18 13:00:54 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99DBB129689 for ; Sun, 13 Nov 2016 23:41:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.596 X-Spam-Level: X-Spam-Status: No, score=-5.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qIFKTMs1k7Df for ; Sun, 13 Nov 2016 23:41:49 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext6.iad.github.net [192.30.252.197]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A061129634 for ; Sun, 13 Nov 2016 23:41:49 -0800 (PST) Date: Sun, 13 Nov 2016 23:41:48 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479109308; bh=ZHA9eQ9eq0ONnmRMZHl7QJrpFw/NoQR3YleSMPuWOLo=; h=From:Reply-To:To:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=2QFLJcfKS7CVeHvMFLuIjSvHh3cgtAc9dXOS/okPV4Do+l580opSllrWW++Qfde0I X6bPQFB5jeL3N4cdXg8Wlxny0kad7ZGjHa0paZoCy3aB5exi73bzf8BmWN9FEZtiEd c0/05gc9ghE/b0lmxkJFDkpcShi9Qv91soh+BDLA= From: Martin Thomson To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58296abc7b9f3_32a83fad0a03b140365993f"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: martinthomson X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: [Unbearable] [TokenBinding/Internet-Drafts] Make exporter output less fixed (#78) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 07:41:50 -0000 ----==_mimepart_58296abc7b9f3_32a83fad0a03b140365993f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit This also sets a minimum size of 32 octets. You can view, comment on, or merge this pull request online at: https://github.com/TokenBinding/Internet-Drafts/pull/78 -- Commit Summary -- * Make exporter output less fixed -- File Changes -- M draft-ietf-tokbind-protocol-10.xml (11) -- Patch Links -- https://github.com/TokenBinding/Internet-Drafts/pull/78.patch https://github.com/TokenBinding/Internet-Drafts/pull/78.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/78 ----==_mimepart_58296abc7b9f3_32a83fad0a03b140365993f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

This also sets a minimum size of 32 octets.

You can view, comment on, or merge this pull request online at:

  https://github.com/TokenBinding/Internet-Drafts/pull/78

Commit Summary

  • Make exporter output less fixed

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58296abc7b9f3_32a83fad0a03b140365993f-- From nobody Fri Nov 18 13:00:57 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 244FE1296E9 for ; Sun, 13 Nov 2016 23:46:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.382 X-Spam-Level: X-Spam-Status: No, score=-5.382 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 74g9-F3tkke3 for ; Sun, 13 Nov 2016 23:46:20 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext8.iad.github.net [192.30.252.199]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A3653128874 for ; Sun, 13 Nov 2016 23:46:20 -0800 (PST) Date: Sun, 13 Nov 2016 23:46:19 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479109579; bh=nlN5EcRs3VEeMer1eC2Q0oPdCoJe3SPN1AypbKZNDcA=; h=From:Reply-To:To:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=tsQMcu1l4PYsadJuBQtcohczV7eE07P0o7DBCNVLrOfojna3OdaMaoI0gZsgknzuZ RgxHKeybgyyHwwbyixWW49915dpqDTcfTLMWL4Zucl/n9CGJ3FDIU3i35UpekpFW3c ug+s2mREDhNk/JuFD8dBxdltDQ9F1+rCexpjJt7c= From: balfanz To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58296bcbea7db_3e943fd2328d3134195919"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: balfanz X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: Clarify that clients are free to provide referred token bindings if necessary (#79) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 07:46:22 -0000 ----==_mimepart_58296bcbea7db_3e943fd2328d3134195919 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Web browsers must not include a referred token binding unless a Relying Party signals to the client that it's ok to do so. Other clients, however, may know from context that it's ok to do so. The spec should not forbid such behavior. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/79 ----==_mimepart_58296bcbea7db_3e943fd2328d3134195919 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Web browsers must not include a referred token binding unless a Relying Party signals to the client that it's ok to do so. Other clients, however, may know from context that it's ok to do so. The spec should not forbid such behavior.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58296bcbea7db_3e943fd2328d3134195919-- From nobody Fri Nov 18 13:01:02 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42DB81294D8 for ; Mon, 14 Nov 2016 02:21:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7 X-Spam-Level: X-Spam-Status: No, score=-7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I1ykBfdC6kOr for ; Mon, 14 Nov 2016 02:21:02 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext4.iad.github.net [192.30.252.195]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F4201293DA for ; Mon, 14 Nov 2016 02:21:02 -0800 (PST) Date: Mon, 14 Nov 2016 02:21:01 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479118861; bh=+6iQRoAARk/nIM9glRPStRTB1ebI+5EY+avVe0tnthM=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=eQ+acaL39hkxLejnYvUuI39bAan8pVvPQHjFqrFDP3bGfQCp5dyYYaRw+V18FWmKL woU2DKhsU7kaFcXOzVwWGAlVg0tQtQ9ECZBhM96Wq7kEspIeaTjvMw8ufS/OMqhJWy 6OEj3OLQIyVPzT+eRr/xlk3W9LZA84OEYBOqPYQ8= From: Piotr Sikora To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5829900d1d263_685f3fd59b30f13c76789f"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: PiotrSikora X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Remove requirement to terminate connections (#80) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 10:21:04 -0000 ----==_mimepart_5829900d1d263_685f3fd59b30f13c76789f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit +1 However, I disagree with your choice regarding the status code. Per [RFC7235, sec. 3.1. 401 Unauthorized](https://tools.ietf.org/html/rfc7235#section-3.1): The 401 (Unauthorized) status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. The server generating a 401 response MUST send a WWW-Authenticate header field (Section 4.1) containing at least one challenge applicable to the target resource. There is no way response to broken Token Binding should have WWW-Authenticate header. I suggest use of the generic 400 Bad Request instead, since this is indeed an invalid request. Per [RFC7231, sec. 6.5.1. 400 Bad Request](https://tools.ietf.org/html/rfc7231#section-6.5.1): The 400 (Bad Request) status code indicates that the server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing). Coincidentally, this is also the status code I'm using in the [NGINX module for Token Binding](https://github.com/google/ngx_token_binding). Also, `MUST` or `SHOULD` would be better than `might be`, but that might be wrong document to include this requirement. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/80#issuecomment-260298589 ----==_mimepart_5829900d1d263_685f3fd59b30f13c76789f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

+1

However, I disagree with your choice regarding the status code.

Per RFC723= 5, sec. 3.1. 401 Unauthorized:

The 401 (Unauthorized) status code indicates that the request =
has not
been applied because it lacks valid authentication credentials for
the target resource.  The server generating a 401 response MUST send
a WWW-Authenticate header field (Section 4.1) containing at least one
challenge applicable to the target resource.

There is no way response to broken Token Binding should have WWW-Authe= nticate header.

I suggest use of the generic 400 Bad Request instead, since this is in= deed an invalid request.

Per RFC7= 231, sec. 6.5.1. 400 Bad Request:

The 400 (Bad Request) status code indicates that the server ca=
nnot or
will not process the request due to something that is perceived to be
a client error (e.g., malformed request syntax, invalid request
message framing, or deceptive request routing).

Coincidentally, this is also the status code I'm using in the NGINX module for Token Bind= ing.

Also, MUST or SHOULD would be better than might be, but that might be wrong document to include this req= uirement.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHu= b, or mute the thread.<= img alt=3D"" height=3D"1" src=3D"https://github.com/notifications/beacon/= ARwnT8qnVFAMBobbXnzTQhm4XxHzwB9Uks5q-DYNgaJpZM4KxFQc.gif" width=3D"1" /><= /p>

= ----==_mimepart_5829900d1d263_685f3fd59b30f13c76789f-- From nobody Fri Nov 18 13:01:06 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2ACA6129449 for ; Mon, 14 Nov 2016 12:44:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.455 X-Spam-Level: X-Spam-Status: No, score=-5.455 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KO38Pgdwfubi for ; Mon, 14 Nov 2016 12:44:36 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext1.iad.github.net [192.30.252.192]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1980F129446 for ; Mon, 14 Nov 2016 12:44:36 -0800 (PST) Date: Mon, 14 Nov 2016 12:44:35 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479156275; bh=CAzJI3cZi1XEe6qOpp8pJeJ66UKoNE/J9GMINFMdXjc=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=ufzqGCOoKrn1OebsGh7sEJAicEKEMKW+70yISQm7iHV5V53i9g2R+CdpPkR8NQJSa yFrmA1PuOUCuDB2Ob3+1x4N5qNU6OpPC9QnsEKhrrQ/51SGshdF2iqXkgnsz7vl5+s hGdjK5/gPUTmX5B8vj7876FbUE7vIMoELWfWGYe4= From: Subodh Iyengar To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582a223340fb1_7c583ff86ec951341437e5"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: siyengar X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Remove requirement to terminate connections (#80) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 20:44:38 -0000 ----==_mimepart_582a223340fb1_7c583ff86ec951341437e5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit +1 -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/80#issuecomment-260456938 ----==_mimepart_582a223340fb1_7c583ff86ec951341437e5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

+1

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582a223340fb1_7c583ff86ec951341437e5-- From nobody Fri Nov 18 13:01:10 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F75D1295D6 for ; Mon, 14 Nov 2016 13:47:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.382 X-Spam-Level: X-Spam-Status: No, score=-5.382 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ey8EbfrrQU0u for ; Mon, 14 Nov 2016 13:47:50 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E2C61293FF for ; Mon, 14 Nov 2016 13:38:53 -0800 (PST) Date: Mon, 14 Nov 2016 13:38:52 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479159532; bh=/GcYc70aP37N/2Eu6z1GHnuAoCkvwvFvRuvH8RhmzFw=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=UnRJZ2i8p+sA1QqUdjMauXBzbU87Ysa0Ep6YNRAC48zZXIiVGdPH5RKwVZoHUFESg oQNmA8+N8IAZDCZBCLH25mVR7CDX2/R4gtZIGOMQB8T7YAZlubdJd+1pBF8xJL7XVG XqJmD17Zu4kYm9AU9vyffk/fCeYZ96u+57l6+4tA= From: Brian Campbell To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582a2eecb0124_77df3ff93ae771382806df"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: b---c X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Remove requirement to terminate connections (#80) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2016 21:47:51 -0000 ----==_mimepart_582a2eecb0124_77df3ff93ae771382806df Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Agree that 401 isn't right. 400 works but what about 403? I'm honestly not sure so asking. And yes, the status code definitely needs to be in the HTTPSTB draft as well. And that's where the normative `MUST` or `SHOULD` would go. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/80#issuecomment-260471019 ----==_mimepart_582a2eecb0124_77df3ff93ae771382806df Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Agree that 401 isn't right. 400 works but what about 403? I'm honestly= not sure so asking.

And yes, the status code definitely needs to be in the HTTPSTB draft a= s well. And that's where the normative MUST or SHOULD<= /code> would go.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHu= b, or mute the thread.<= img alt=3D"" height=3D"1" src=3D"https://github.com/notifications/beacon/= ARwnT0Lo1onCcWS56neybIcfaMuwLwo2ks5q-NTsgaJpZM4KxFQc.gif" width=3D"1" /><= /p>

= ----==_mimepart_582a2eecb0124_77df3ff93ae771382806df-- From nobody Fri Nov 18 13:01:13 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F34B51295DE for ; Wed, 16 Nov 2016 20:44:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.882 X-Spam-Level: X-Spam-Status: No, score=-4.882 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QsZQQ_FriBnU for ; Wed, 16 Nov 2016 20:44:28 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext6.iad.github.net [192.30.252.197]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B41F129876 for ; Wed, 16 Nov 2016 20:44:25 -0800 (PST) Date: Wed, 16 Nov 2016 20:44:21 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479357861; bh=TOSnZjJeRF0XfthLiAVML4zYAFOFdzMpNbIFFCoIIBw=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=o03HCigR5D8ZQtURL3FxOjk3Q8xD1snK3VuMyK3ZQFBVBAJ5h7o6gn8LIVw2mBLXT xFasaD4J9cUBkWnalAyeR951S95AeRFoWDzUpmP50Y5aqKZc8myH4IJwvq2rfRX1M6 zxTbg5aNUlxfbuojQabuB1HQKSbgDGeC/d5XQHeM= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582d35a5e966_16b23fac6e84513475311b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: Clarify hazards of renegotiation wrt Token Binding (#76) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 04:44:30 -0000 ----==_mimepart_582d35a5e966_16b23fac6e84513475311b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closing as a dupe of issue #75. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/76#issuecomment-261154216 ----==_mimepart_582d35a5e966_16b23fac6e84513475311b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closing as a dupe of issue #75.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582d35a5e966_16b23fac6e84513475311b-- From nobody Fri Nov 18 13:01:23 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 796591295DE for ; Wed, 16 Nov 2016 20:44:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.383 X-Spam-Level: X-Spam-Status: No, score=-5.383 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DZg8Sg8QkX7k for ; Wed, 16 Nov 2016 20:44:30 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 39E23129677 for ; Wed, 16 Nov 2016 20:44:25 -0800 (PST) Date: Wed, 16 Nov 2016 20:44:20 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479357860; bh=uCEd+SWoPQ5IqkELIflNHgLQZ6yjpi/PTBstoaOB904=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=menvyKQh2cL03FKdwXr06UALw94gVQtRrXa2OURkCAhHN7NUXsbNAJdMUCyOTZ7hB xJTUsKXkeY5uXW0wbcBJyvluMLD5mvsUfL4EfRV/BuigtsoUUD/vCUVg+fzB++rT5r n4g3cpGHgB3LW5yK9Y+cymNv9ERIj73lS9bXmRQM= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582d35a4f0ffe_3e7c3fecb5f5d1386350d7"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: Clarify hazards of renegotiation wrt Token Binding (#76) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 04:44:32 -0000 ----==_mimepart_582d35a4f0ffe_3e7c3fecb5f5d1386350d7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #76. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/76#event-862233826 ----==_mimepart_582d35a4f0ffe_3e7c3fecb5f5d1386350d7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #76.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582d35a4f0ffe_3e7c3fecb5f5d1386350d7-- From nobody Fri Nov 18 13:01:28 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AB7212964F for ; Wed, 16 Nov 2016 22:03:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.382 X-Spam-Level: X-Spam-Status: No, score=-5.382 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zWar7QvmA5p1 for ; Wed, 16 Nov 2016 22:03:00 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext4.iad.github.net [192.30.252.195]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CC61129646 for ; Wed, 16 Nov 2016 22:02:57 -0800 (PST) Date: Wed, 16 Nov 2016 22:02:56 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479362576; bh=Cnuos1eC1a/q7+8ly0GVnm6FCEBYhPegjYJY8FCJ/Rc=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=ZBp64nMKsW62m2/P7duFEtPktzbiqLNg7cgjuZslvSypqy6RoKLiAM9mP1D9Xcva7 ay+wXLEpS7FiVLj6Ny3CJvsr57G6+co8cb3aWVRIT2w5cJ8FnTKWarX9RnqGECRbxL jWCuy3hfR0UqdwBG47iz8aL5a1X2QZ8Isz+JX1Zs= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582d481062cf1_74773feece77713811417f2"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: Terminating connections (#64) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 06:03:01 -0000 ----==_mimepart_582d481062cf1_74773feece77713811417f2 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit TBPROTO-11 replaces "connection termination" with a rejection of the binding and its associated bound tokens. The effect of this is application-specific, e.g. failing requests, the need for the client to re-authenticate and present new token(s), or connection termination. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/64#issuecomment-261163209 ----==_mimepart_582d481062cf1_74773feece77713811417f2 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

TBPROTO-11 replaces "connection termination" with a rejection of the b= inding and its associated bound tokens. The effect of this is application= -specific, e.g. failing requests, the need for the client to re-authentic= ate and present new token(s), or connection termination.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on Git= Hub, or mute the thread= .3D""

----==_mimepart_582d49bbab2d6_1ec43fc70e36113019889ef-- From nobody Fri Nov 18 13:01:34 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F8DA129457 for ; Wed, 16 Nov 2016 22:10:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.882 X-Spam-Level: X-Spam-Status: No, score=-4.882 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QktyOlwz_El8 for ; Wed, 16 Nov 2016 22:10:04 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext7.iad.github.net [192.30.252.198]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6EB78129538 for ; Wed, 16 Nov 2016 22:10:04 -0800 (PST) Date: Wed, 16 Nov 2016 22:10:03 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479363003; bh=+D9SzY0H5I07p/Y7RVeKmvM/y8rNj4J4gaAflvPw3kM=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=MRAIuHOv+bagdEjwT/vTPOTykIFOjNzLvImalqZVlqm8pewMPlNeK8B2hsM40GSM3 4d1Xy7MMy5uvKdcjsV1327ywJjc2g1PfXi3WQkK7pKM6rt17Jjz2slp576sIo2BGw8 IjFYpKYwT4xXgcxl7FvggtJeZSfB6TB1hjYs52Ic= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582d49bbbadc6_223c3fa64cd3d13c310488e"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: add threat model discussion wrt Token Binding for 0-RTT connections ? (#74) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 06:10:06 -0000 ----==_mimepart_582d49bbbadc6_223c3fa64cd3d13c310488e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit This is already discussed in the Security Considerations (7.1) and other sections of TBPROTO. We're protecting from token export and replay from remote machines. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/74#issuecomment-261164138 ----==_mimepart_582d49bbbadc6_223c3fa64cd3d13c310488e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

This is already discussed in the Security Considerations (7.1) and other sections of TBPROTO. We're protecting from token export and replay from remote machines.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582d49bbbadc6_223c3fa64cd3d13c310488e-- From nobody Fri Nov 18 13:01:37 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EEB912959F for ; Wed, 16 Nov 2016 23:54:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.454 X-Spam-Level: X-Spam-Status: No, score=-5.454 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A1ftnVm5oTa8 for ; Wed, 16 Nov 2016 23:54:11 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext5.iad.github.net [192.30.252.196]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C447E12948C for ; Wed, 16 Nov 2016 23:54:10 -0800 (PST) Date: Wed, 16 Nov 2016 23:54:10 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479369250; bh=NDSsS8xJZgQzz4GWQiSC2vLBShZfcNPhWdDm3lLSZ68=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=UnD+ruqDWarA/oii4Yt3S/nAUBlYNbvrhBexmxw0q3HaKcmd5kII3FtmkaRZWrULm SC1ADAmJpTs8j89Sv41tmEio9CUaF9ft9cSw22H9Pa1v7LsPtDXOiSvtWpTVYMdpzN U50nMOj/9kOPgPMn3dyHS3k6j+NsTL7v6C6ECnlA= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582d62225467_30213fa4c56fb13044038"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Remove requirement to terminate connections (#80) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 07:54:12 -0000 ----==_mimepart_582d62225467_30213fa4c56fb13044038 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Addressed in TBPROTO-11 and HTTPSTB-7 -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/80#issuecomment-261178946 ----==_mimepart_582d62225467_30213fa4c56fb13044038 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Addressed in TBPROTO-11 and HTTPSTB-7

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582d62225467_30213fa4c56fb13044038-- From nobody Fri Nov 18 13:01:40 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEF9B129683 for ; Thu, 17 Nov 2016 01:36:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.882 X-Spam-Level: X-Spam-Status: No, score=-4.882 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dwHB3h_MzaQK for ; Thu, 17 Nov 2016 01:36:37 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext6.iad.github.net [192.30.252.197]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 806151295EB for ; Thu, 17 Nov 2016 01:36:37 -0800 (PST) Date: Thu, 17 Nov 2016 01:36:36 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479375396; bh=i1EQ4Dq8xccav6c2i/NjtlPg/kROEWbCKBlKtVvxoT4=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=FOcY+qCPbAg3QY/Xf87eXuyN0Wv/VFxtdW+X9LZ8luHsyVOl6envhyAMpM66UiK1U FyVr6nRLW3AAv+RzK9Yv+V1n3wZL89J2di/5JfgRAWv3LcJ5TpFIGyqcUFqukDhX5D 8MoFkDpCMsIjtFtQ54p1kqkLkYDXZxW+mDFV2Ph4= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582d7a24a441f_b0e3f8eedb871382700165"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: TBNEGO: Clarifying Token Binding behavior with renegotiation (#73) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 09:36:39 -0000 ----==_mimepart_582d7a24a441f_b0e3f8eedb871382700165 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #73. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/73#event-862490226 ----==_mimepart_582d7a24a441f_b0e3f8eedb871382700165 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #73.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582d7a24a441f_b0e3f8eedb871382700165-- From nobody Fri Nov 18 13:01:43 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2A1C1295EB for ; Thu, 17 Nov 2016 01:36:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.954 X-Spam-Level: X-Spam-Status: No, score=-4.954 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bjo-N7UD5DHC for ; Thu, 17 Nov 2016 01:36:37 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext6.iad.github.net [192.30.252.197]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C7E712964E for ; Thu, 17 Nov 2016 01:36:37 -0800 (PST) Date: Thu, 17 Nov 2016 01:36:36 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479375396; bh=vRaTX3NhFFds/XyUMQ0IhnroerdjW+LozlR9MVkOn44=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=tGF0+024Lh3f2rE5+1ZmlqmNDORjIwM6hW9ugRNaJMXfKT2GhInphmIpK4KgsXqyN lc0O4BCMefpyNqsGNiefK2oavUqxV20zXvBofGVEObQeVY5iObyUigAyWGF4nRvsKZ R/vB1RlzgLFJUDKl3hs4iiAipCRUzuRjCCHNyUaE= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582d7a24a798a_74793fa64cd3d13c190007b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: TBNEGO: Clarifying Token Binding behavior with renegotiation (#73) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 09:36:40 -0000 ----==_mimepart_582d7a24a798a_74793fa64cd3d13c190007b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Clarified in TBPROTO-11 and TBNEGO-6 -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/73#issuecomment-261199107 ----==_mimepart_582d7a24a798a_74793fa64cd3d13c190007b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Clarified in TBPROTO-11 and TBNEGO-6

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582d7a24a798a_74793fa64cd3d13c190007b-- From nobody Fri Nov 18 13:01:47 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E872812964E for ; Thu, 17 Nov 2016 01:37:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.883 X-Spam-Level: X-Spam-Status: No, score=-4.883 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JzrVWzkC_35v for ; Thu, 17 Nov 2016 01:37:38 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B5CD1297C5 for ; Thu, 17 Nov 2016 01:37:35 -0800 (PST) Date: Thu, 17 Nov 2016 01:37:35 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479375455; bh=0JbXiWciQ/im8eCOq6anh0g7Fqc/Xl7tw7cpvyVtvdA=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=IiTFHLLZ06raz1hvB/zeM+6NdG3JWOPIEPMpONpTJi796rgslTY4nbdTxCHdlMYYG zilEAwCAPYIOUrxBvDGFrRSOBg2vDt+oxuhVnLfj4mpkYLZI04t9dZtf83q+Qp7PPG 1N5pHHp3l0FXDbSPZr+LL+SqehLLloyQx22FFh9I= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582d7a5f6ad_5cf43fa64cd3d13c14517a9"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:38 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Clarify behavior for renegotiation (#72) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 09:37:40 -0000 ----==_mimepart_582d7a5f6ad_5cf43fa64cd3d13c14517a9 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #72. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/72#event-862491418 ----==_mimepart_582d7a5f6ad_5cf43fa64cd3d13c14517a9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #72.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582d7a5f6ad_5cf43fa64cd3d13c14517a9-- From nobody Fri Nov 18 13:01:50 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BFED1297C5 for ; Thu, 17 Nov 2016 01:52:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.883 X-Spam-Level: X-Spam-Status: No, score=-4.883 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n5DujochtX5B for ; Thu, 17 Nov 2016 01:52:20 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext2.iad.github.net [192.30.252.193]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAF0F12965A for ; Thu, 17 Nov 2016 01:52:20 -0800 (PST) Date: Thu, 17 Nov 2016 01:52:19 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479376339; bh=kAcoc2qFYXhFxYkEeiisfC8p2uH8W0aNLScdtMvTlL4=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=W3h87tZ36iB4hwdppfHNcGzXWruUplf9ULHdtqzUwQxqZsHS/hmVrRlsMX7c9O6co VvMWOQFD2LpGVdRkdfI4sjaAT3IQTkbmcOUjkGI3o4m3y72reteSdV2Hn8KwwdmaqF TeFeQbaM6R2IKPldRzmpuXiwuVZQJqSp+Wp/q+4c= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582d7dd3e87e7_45b53fb08a08f1401519176"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:39 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Make exporter output less fixed (#78) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Nov 2016 09:52:22 -0000 ----==_mimepart_582d7dd3e87e7_45b53fb08a08f1401519176 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #78. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/78#event-862512829 ----==_mimepart_582d7dd3e87e7_45b53fb08a08f1401519176 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #78.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582d7dd3e87e7_45b53fb08a08f1401519176-- From nobody Fri Nov 18 13:01:53 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0437A1294EA for ; Fri, 18 Nov 2016 04:36:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.382 X-Spam-Level: X-Spam-Status: No, score=-5.382 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S9ZtZUlVUWLx for ; Fri, 18 Nov 2016 04:36:35 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext4.iad.github.net [192.30.252.195]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58CD2129440 for ; Fri, 18 Nov 2016 04:36:35 -0800 (PST) Date: Fri, 18 Nov 2016 04:36:33 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1479472594; bh=/n3m3I+srIQjI6zyEUxa0cBHz1uPpyN+eA6ZLQeGy+Q=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=OqIZxSVUoy2zdAyHWd8aqxmgYYHd5WkCm0W395ZKAzX8gbil0om3z7BMPA5yST29k SSmThGPOLNWbbjBG3EUlOVPcW8O9AmNNAw+pAlwi4mgI+9HMcrkN+9dGJzHy2mIsys REVo1pMDxXOXw3amCRRa+OYjTaov26NxhYv4LUX4= From: balfanz To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_582ef5d1ba8fc_5b73fcfe415513c7039cf"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: balfanz X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 18 Nov 2016 13:00:39 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: Clarify that clients are free to provide referred token bindings if necessary (#79) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 12:36:37 -0000 ----==_mimepart_582ef5d1ba8fc_5b73fcfe415513c7039cf Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #79 via 96526be5fc14dc9dddf846b6709426ca23fe195b. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/79#event-864299386 ----==_mimepart_582ef5d1ba8fc_5b73fcfe415513c7039cf Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #79 via 96526be.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_582ef5d1ba8fc_5b73fcfe415513c7039cf-- From nobody Fri Nov 18 13:13:23 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34A0A120727 for ; Fri, 18 Nov 2016 13:13:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vTNItXO9Qe6G for ; Fri, 18 Nov 2016 13:13:21 -0800 (PST) Received: from mail-it0-x232.google.com (mail-it0-x232.google.com [IPv6:2607:f8b0:4001:c0b::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6DA0126CD8 for ; Fri, 18 Nov 2016 13:13:20 -0800 (PST) Received: by mail-it0-x232.google.com with SMTP id c20so44773964itb.0 for ; Fri, 18 Nov 2016 13:13:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=S4wDyxzw3oFIw6JXZfRCxowTMBN2StdzeoVcxuGcyX0=; b=awa26nOIHro3bEv3BPN7UuLlGdOmfQL/cjeT7cdL9H4FdlD53h2fp8M6efThXGiIej Q/XGQ2QxSNNw0srYSOgmbc76odpusOlG6FzEG73EKQz9YrLn0UrjwPjYygaPSmnf7+MD CeP4KrQglHdlc2TlYwHKS7IYLVqqqD7NtMLwA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=S4wDyxzw3oFIw6JXZfRCxowTMBN2StdzeoVcxuGcyX0=; b=fE687hgGgM2qgBsmn/mZ4EDbYaxu4+iZRV9jJ5/y8z6ya2zD3Q6zB17oObqkkCJjpC QFrjb8s2aaHCIdHJWi5NXtCAmnVRBw39pA/vSmbJI0NMCYKUUukT/DlavlWzSMozdgtn lwrXVDt+VA4rk2pk9/t3pIQpKH9XueK7Co69BhfYa9CyTZ8fCgjNCR/h6OpCS2noV3Xj x6F4hgD4Yte0EfX5LC5CpA+F/kP+RKJkCvadyxNoShPtRAf+6Eau2oxbR71AtAOWlS84 M1nrUnCrSkB3FK0HnPZZob6rv6TZI6Rouewqg8Gh4xqOg22FfcZQcJBLGtW07t99MzGX iGzg== X-Gm-Message-State: AKaTC007j+lDXfdfYak0d6eG3euyJ5ZjJhwYuZsZyZX9TJRIY9+rv8kr3vaGQjW3Snvkii1ASTCkhbTCS8y7MmWO X-Received: by 10.107.201.86 with SMTP id z83mr1654749iof.156.1479503600131; Fri, 18 Nov 2016 13:13:20 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.165.24 with HTTP; Fri, 18 Nov 2016 13:12:49 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Fri, 18 Nov 2016 14:12:49 -0700 Message-ID: To: Dirk Balfanz Content-Type: multipart/alternative; boundary=94eb2c0b92ac87d45c054199c691 Archived-At: Cc: Tokbind WG Subject: Re: [Unbearable] Token Binding spec edits to be more OAuth-friendly X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Nov 2016 21:13:22 -0000 --94eb2c0b92ac87d45c054199c691 Content-Type: text/plain; charset=UTF-8 Yes, those look good. Thanks for doing that. On Fri, Nov 18, 2016 at 5:40 AM, Dirk Balfanz wrote: > Hi Brian, > > can you check that the two changes I just committed address your needs re/ > OAuth and Token Binding: > > https://github.com/TokenBinding/Internet-Drafts/commit/ > 96526be5fc14dc9dddf846b6709426ca23fe195b > > https://github.com/TokenBinding/Internet-Drafts/commit/ > dd05f0f678b3836618938284d0c2032c8731d96e > > Thanks, > > Dirk. > > --94eb2c0b92ac87d45c054199c691 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Yes, those look good. Thanks for doing that.

On Fri, Nov 18, 2016= at 5:40 AM, Dirk Balfanz <balfanz@google.com> wrote:
Hi Brian,=C2=A0

--94eb2c0b92ac87d45c054199c691-- From nobody Mon Nov 21 17:19:13 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D5961294DD for ; Mon, 21 Nov 2016 17:19:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Lk4u8lDNJjp for ; Mon, 21 Nov 2016 17:19:11 -0800 (PST) Received: from mail-qt0-x22c.google.com (mail-qt0-x22c.google.com [IPv6:2607:f8b0:400d:c0d::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB4911294C4 for ; Mon, 21 Nov 2016 17:19:10 -0800 (PST) Received: by mail-qt0-x22c.google.com with SMTP id p16so2000088qta.0 for ; Mon, 21 Nov 2016 17:19:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=frnM1nf0/tqK64/lrqAInyoOg/XQwKZc8RlV6EjkDFM=; b=Y1r+vvJeWEn69T1sIi0hR6EJiRGTzNhkvc/TQuTxLYTF3uF0Zm6dGyC7c9y3s3wqp9 pHKSvooprvdxLbsQQZ+6HNT21hXfkutyvn0p5PVZbNhSCMisi/gvSHXCPxB8JfHacSUs mWH6KEyBZjgSMfaeLKAyYyQ1dhXG71ygHfAF27KLGSR849uWWGthLygd99z4BWw8tOrI W1gOUx6JE2CN5KWlCQEk19aAasOj3CELDHq6dGTJDiy79LXlUUGixsViuh9fo15Y9v3U QI/naIvrGBuHpdoxSGmB0acBd/gE7R3pECErachYVWKQTqH6/f6aRLBX5Y4KKT2pTbLI fLPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=frnM1nf0/tqK64/lrqAInyoOg/XQwKZc8RlV6EjkDFM=; b=MhOBbbl+dOaVupeO6l1Yt15BrpC+5ahYo1Ighy39CA1/0Inu0eOVIhuShPmJoWhsK6 az3oMWhJwzBcwQx/sdxzd6gP5sjzpmFzeOZniQpfZskhqgEJyv6FR0T9BjOohwV1/PKv 2QuKbeGUIqIY0zIsfk9oaPkhwUb1E2xhJnkuT6GBd5JCsTmrapJdJha6CxIu4ytdGIT+ WWv79KW00IhJHXE9yaozYCyg6Ao0HynLWZdDN2E02jW/DLRz4HRZQykEMzWH5EgbOzPU BgoUJxJqb7kQ4CuPJ/GD9JPeoQ2MUwb0QFx5XZr/ro16Avbun419/qCDHUpZ82WGiOHe x6wQ== X-Gm-Message-State: AKaTC01YFGftis8O579t14iDjP/mAXwTKNoi4jGmrBQdnGG2dPoCaEibbL4OKPYQYAM/3/Gh7qu0WNUHOwMpLINF X-Received: by 10.237.37.72 with SMTP id w8mr11168453qtc.80.1479777549579; Mon, 21 Nov 2016 17:19:09 -0800 (PST) MIME-Version: 1.0 Received: by 10.12.169.130 with HTTP; Mon, 21 Nov 2016 17:18:49 -0800 (PST) From: Nick Harper Date: Mon, 21 Nov 2016 17:18:49 -0800 Message-ID: To: IETF Tokbind WG Content-Type: multipart/alternative; boundary=001a1140803630b7360541d98f5a Archived-At: Subject: [Unbearable] Triple handshake security considerations X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Nov 2016 01:19:12 -0000 --001a1140803630b7360541d98f5a Content-Type: text/plain; charset=UTF-8 I noticed that we have a section in Security Considerations for Triple Handshake in both TBPROTO and HTTPSTB. Is it necessary to have both, or is the one in TBPROTO sufficient? I can put https://github.com/nharper/Internet-Drafts/tree/triple-hs in a PR if it makes sense to remove that section from HTTPSTB. -Nick --001a1140803630b7360541d98f5a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I noticed that we have a section in Security Consideration= s for Triple Handshake in both TBPROTO and HTTPSTB. Is it necessary to have= both, or is the one in TBPROTO sufficient? I can put https://github.com/nharper= /Internet-Drafts/tree/triple-hs in a PR if it makes sense to remove tha= t section from HTTPSTB.
-Nick
--001a1140803630b7360541d98f5a-- From nobody Mon Nov 21 17:46:08 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4691612954C for ; Mon, 21 Nov 2016 17:46:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WuROCsh_iTh0 for ; Mon, 21 Nov 2016 17:46:05 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0137.outbound.protection.outlook.com [104.47.33.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF5AB129416 for ; Mon, 21 Nov 2016 17:46:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=CfNzPvtkfHzSYgxpLdHzMz0RCa0Nsx838V/CrAaeeTU=; b=S6NhpC+ixJlUfVkke/tKqcsTugB7Q6vO7UUhQkFigjh17hcnAqYYCkFfzoJB1qf1Y6qKJNBRTAhf5sYWba6+UrxkMOSyguUGS8ZWHMV+AgTLfS4SCs97VSbX6YkfaM51mbNP0uTpPe7j82acgkkXm2YnVacO9U1DkO1lbjB24Tc= Received: from BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) by BN3PR0301MB0834.namprd03.prod.outlook.com (10.160.154.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Tue, 22 Nov 2016 01:45:59 +0000 Received: from BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) by BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) with mapi id 15.01.0693.009; Tue, 22 Nov 2016 01:45:59 +0000 From: Andrei Popov To: Nick Harper , IETF Tokbind WG Thread-Topic: [Unbearable] Triple handshake security considerations Thread-Index: AQHSRF5zYRqqO6ZRjUi5bPMef7VpdaDkOdbA Date: Tue, 22 Nov 2016 01:45:59 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0834; 7:nJm6iW8PtKzxbz91Bsjw+Gy4A/dM/qIMXYSLdkphHtlqElWFEZsj6Nk04Qt6uB1BNI+VZDQbZ/a0XYe4p163b66JhigAjR/orKIthjAuA8bGaD+DkyNE0S5aWSWX1cfISa+Sa39aikPwF+AM0MNKdlGSKGyHpQp+stAXkLRystuZBH4FexO+YO74Oop5/te5rxXlhOcP8jos14WEfD7mjcqgo3IOT7GJxkAKNlQW04oH+uj4++8lw/r/H+hkBvarEEoRG6kKCPCl45stN2oZF/J0jIsU4dwUPbZdrrrr1lIvInFHZ1WpTayXcn6ranfMRJtNBe2UdMAyfS+GJrL2JfCTzFTmCreHnTxz7wh1gB3oVUwjG+RpqYiJs0DGfUWf x-ms-office365-filtering-correlation-id: bf936d4f-7386-48c8-eb71-08d412794f4c x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:BN3PR0301MB0834; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820)(192374486261705)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040307)(6060326)(6045199)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6046074)(6061324)(6041248)(6042181); SRVR:BN3PR0301MB0834; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0834; x-forefront-prvs: 0134AD334F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(199003)(189002)(377454003)(2900100001)(15650500001)(76176999)(102836003)(68736007)(2420400007)(33656002)(10290500002)(7110500001)(101416001)(92566002)(9686002)(50986999)(8990500004)(790700001)(7906003)(122556002)(5660300001)(2950100002)(189998001)(5005710100001)(7846002)(99286002)(10710500007)(106356001)(105586002)(54356999)(2906002)(77096005)(106116001)(19609705001)(107886002)(8936002)(7696004)(76576001)(229853002)(74316002)(81156014)(3280700002)(7736002)(97736004)(81166006)(10090500001)(86362001)(8676002)(606004)(3660700001)(6506003)(86612001)(5001770100001)(6116002)(38730400001)(87936001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0834; H:BN3PR0301MB0836.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN3PR0301MB0836A01C818C8D454EEBFCF18CB40BN3PR0301MB0836_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Nov 2016 01:45:59.4274 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0834 Archived-At: Subject: Re: [Unbearable] Triple handshake security considerations X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Nov 2016 01:46:07 -0000 --_000_BN3PR0301MB0836A01C818C8D454EEBFCF18CB40BN3PR0301MB0836_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U28gaXMgdGhlIOKAnFNlY3VyaXR5IFRva2VuIFJlcGxheeKAnSBzZWN0aW9uLiBJTUhPIHRoZXJl 4oCZcyBubyBoYXJtIGluIGhhdmluZyBib3RoIG9mIHRoZXNlIGR1cGxpY2F0ZWQgaW4gSFRUUFNU QiwgYnV0IEkgZG9u4oCZdCBmZWVsIHN0cm9uZ2x5IGVpdGhlciB3YXkuDQoNCkNoZWVycywNCg0K QW5kcmVpDQoNCkZyb206IFVuYmVhcmFibGUgW21haWx0bzp1bmJlYXJhYmxlLWJvdW5jZXNAaWV0 Zi5vcmddIE9uIEJlaGFsZiBPZiBOaWNrIEhhcnBlcg0KU2VudDogTW9uZGF5LCBOb3ZlbWJlciAy MSwgMjAxNiA1OjE5IFBNDQpUbzogSUVURiBUb2tiaW5kIFdHIDx1bmJlYXJhYmxlQGlldGYub3Jn Pg0KU3ViamVjdDogW1VuYmVhcmFibGVdIFRyaXBsZSBoYW5kc2hha2Ugc2VjdXJpdHkgY29uc2lk ZXJhdGlvbnMNCg0KSSBub3RpY2VkIHRoYXQgd2UgaGF2ZSBhIHNlY3Rpb24gaW4gU2VjdXJpdHkg Q29uc2lkZXJhdGlvbnMgZm9yIFRyaXBsZSBIYW5kc2hha2UgaW4gYm90aCBUQlBST1RPIGFuZCBI VFRQU1RCLiBJcyBpdCBuZWNlc3NhcnkgdG8gaGF2ZSBib3RoLCBvciBpcyB0aGUgb25lIGluIFRC UFJPVE8gc3VmZmljaWVudD8gSSBjYW4gcHV0IGh0dHBzOi8vZ2l0aHViLmNvbS9uaGFycGVyL0lu dGVybmV0LURyYWZ0cy90cmVlL3RyaXBsZS1ocyBpbiBhIFBSIGlmIGl0IG1ha2VzIHNlbnNlIHRv IHJlbW92ZSB0aGF0IHNlY3Rpb24gZnJvbSBIVFRQU1RCLg0KLU5pY2sNCg== --_000_BN3PR0301MB0836A01C818C8D454EEBFCF18CB40BN3PR0301MB0836_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNv LXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjox LjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNl Y3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRl ZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8 bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48 IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGlu az0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlNvIGlzIHRoZSDigJxTZWN1cml0eSBUb2tlbiBSZXBsYXni gJ0gc2VjdGlvbi4gSU1ITyB0aGVyZeKAmXMgbm8gaGFybSBpbiBoYXZpbmcgYm90aCBvZiB0aGVz ZSBkdXBsaWNhdGVkIGluIEhUVFBTVEIsIGJ1dCBJIGRvbuKAmXQgZmVlbCBzdHJvbmdseSBlaXRo ZXIgd2F5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5DaGVlcnMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFuZHJlaTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gVW5iZWFyYWJs ZSBbbWFpbHRvOnVuYmVhcmFibGUtYm91bmNlc0BpZXRmLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8 L2I+TmljayBIYXJwZXI8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBOb3ZlbWJlciAyMSwgMjAx NiA1OjE5IFBNPGJyPg0KPGI+VG86PC9iPiBJRVRGIFRva2JpbmQgV0cgJmx0O3VuYmVhcmFibGVA aWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFtVbmJlYXJhYmxlXSBUcmlwbGUgaGFu ZHNoYWtlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+SSBub3RpY2VkIHRoYXQgd2UgaGF2ZSBhIHNlY3Rpb24gaW4gU2VjdXJpdHkg Q29uc2lkZXJhdGlvbnMgZm9yIFRyaXBsZSBIYW5kc2hha2UgaW4gYm90aCBUQlBST1RPIGFuZCBI VFRQU1RCLiBJcyBpdCBuZWNlc3NhcnkgdG8gaGF2ZSBib3RoLCBvciBpcyB0aGUgb25lIGluIFRC UFJPVE8gc3VmZmljaWVudD8gSSBjYW4gcHV0DQo8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20v bmhhcnBlci9JbnRlcm5ldC1EcmFmdHMvdHJlZS90cmlwbGUtaHMiPmh0dHBzOi8vZ2l0aHViLmNv bS9uaGFycGVyL0ludGVybmV0LURyYWZ0cy90cmVlL3RyaXBsZS1oczwvYT4gaW4gYSBQUiBpZiBp dCBtYWtlcyBzZW5zZSB0byByZW1vdmUgdGhhdCBzZWN0aW9uIGZyb20gSFRUUFNUQi48bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tTmljazxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_BN3PR0301MB0836A01C818C8D454EEBFCF18CB40BN3PR0301MB0836_-- From nobody Tue Nov 22 07:57:59 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A9ED1296A7 for ; Tue, 22 Nov 2016 07:57:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ydsiVtA9rYPA for ; Tue, 22 Nov 2016 07:57:56 -0800 (PST) Received: from mail-qt0-x22b.google.com (mail-qt0-x22b.google.com [IPv6:2607:f8b0:400d:c0d::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 635D21296A3 for ; Tue, 22 Nov 2016 07:57:56 -0800 (PST) Received: by mail-qt0-x22b.google.com with SMTP id w33so14331303qtc.3 for ; Tue, 22 Nov 2016 07:57:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=avQRk5U+ViI3wcKMj1Y7UlL29ko5RcpZPCE76wfzVME=; b=mOQ3ECr3wwvoIV1hHE8eqyMVDGRo8ReZaC7bOkM5zibxMO30Yp+18skG5rh03w8nwP mWYisU+QLxGxWyrzABUKU7gdEi9CBGK/gFBpjzS8W+xFe+cwthDkTAiBetT1DdzauaZO Ae8B3kwVCg2wJq0MJwMN5bfc9RtIFgHy8VWFHjr8S0scRoV3wePXWPGEbX6W+Vkry1hS vVaxf/5P9iYUSd1WXVGBS0qigwOR8PUlAO3E8DGCFY05aXYhdc7xBKoCTXVoBcNQg/7X SnRa8p2E8wF+7+uwQ+RiibScRPkfkzVrgF/XPElslxRnlP7qjb1TejIJfE2BPm1v1MDx Q9rg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=avQRk5U+ViI3wcKMj1Y7UlL29ko5RcpZPCE76wfzVME=; b=gf0kKiOpfM5iWWZVuHqFWavVvVNGtWJNNX8Aibh/3K83X8Qz7UGTrDFEuAqoHpQGja wvSOuTvFnwN7IR/zEwUS35XgJ4009fdP0ymdIu3p4o3xHJAd7UNY9CBF+zEQWrdDNIZv mC/wEFlywy2lWYuUZeI1lx+fDmeTmiL7MrfMVZQL3Mdz+zlHFQQTw+HWO3ndrp/UaGaa f3WNFl4OlkVenO9P4j68VZm53vKqi3yDidWWy+L7f8qK8wnvjo3Ge+Yve0YNmfAqwZUM eBWlaqZp6NxbbTdfPjKyLQiVH+pRScAJuWJYRR5G/C1iJOHWAGjjQKOZIxZT97LWKs4q mP6g== X-Gm-Message-State: AKaTC01cw2UhEJYK3H9WKlv57yfCL0K8M8BqVksLuRN7DHBc+BOnTC15Lv+m+FqS9S+ZZn5jZ5BNQRjlMZ2mP+8J X-Received: by 10.237.53.56 with SMTP id a53mr11920201qte.85.1479830275381; Tue, 22 Nov 2016 07:57:55 -0800 (PST) MIME-Version: 1.0 Received: by 10.12.169.130 with HTTP; Tue, 22 Nov 2016 07:57:35 -0800 (PST) In-Reply-To: References: From: Nick Harper Date: Tue, 22 Nov 2016 07:57:35 -0800 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=001a11c0302ae4b7da0541e5d5d6 Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] Triple handshake security considerations X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Nov 2016 15:57:58 -0000 --001a11c0302ae4b7da0541e5d5d6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I have a slight preference towards not duplicating them, but I don't think it's a big deal. If other people have stronger feelings about keeping it I'm fine with that. On Mon, Nov 21, 2016 at 5:45 PM, Andrei Popov wrote: > So is the =E2=80=9CSecurity Token Replay=E2=80=9D section. IMHO there=E2= =80=99s no harm in having > both of these duplicated in HTTPSTB, but I don=E2=80=99t feel strongly ei= ther way. > > > > Cheers, > > > > Andrei > > > > *From:* Unbearable [mailto:unbearable-bounces@ietf.org] *On Behalf Of *Ni= ck > Harper > *Sent:* Monday, November 21, 2016 5:19 PM > *To:* IETF Tokbind WG > *Subject:* [Unbearable] Triple handshake security considerations > > > > I noticed that we have a section in Security Considerations for Triple > Handshake in both TBPROTO and HTTPSTB. Is it necessary to have both, or i= s > the one in TBPROTO sufficient? I can put https://github.com/nharper/ > Internet-Drafts/tree/triple-hs in a PR if it makes sense to remove that > section from HTTPSTB. > > -Nick > --001a11c0302ae4b7da0541e5d5d6 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I have a slight preference towards not duplicating them, b= ut I don't think it's a big deal. If other people have stronger fee= lings about keeping it I'm fine with that.

On Mon, Nov 21, 2016 at 5:45 PM, Andrei = Popov <Andrei.Popov@microsoft.com> wrote:

So is the =E2=80=9CSecurity Token Replay=E2=80=9D s= ection. IMHO there=E2=80=99s no harm in having both of these duplicated in = HTTPSTB, but I don=E2=80=99t feel strongly either way.=

=C2=A0

Cheers,

=C2=A0

Andrei

=C2=A0

From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Nick Harper
Sent: Monday, November 21, 2016 5:19 PM
To: IETF Tokbind WG <unbearable@ietf.org>
Subject: [Unbearable] Triple handshake security considerations

=C2=A0

I noticed that we have a section in Security Conside= rations for Triple Handshake in both TBPROTO and HTTPSTB. Is it necessary t= o have both, or is the one in TBPROTO sufficient? I can put https://github.com/nharper/Internet-Drafts/tree/triple-hs= in a PR if it makes sense to remove that section from HTTPSTB.<= u>

-Nick


--001a11c0302ae4b7da0541e5d5d6-- From nobody Tue Nov 22 08:04:35 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD25E129609 for ; Tue, 22 Nov 2016 08:04:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KMg8XIz1opvv for ; Tue, 22 Nov 2016 08:04:27 -0800 (PST) Received: from mail-qk0-x22a.google.com (mail-qk0-x22a.google.com [IPv6:2607:f8b0:400d:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AE6612967E for ; Tue, 22 Nov 2016 08:04:27 -0800 (PST) Received: by mail-qk0-x22a.google.com with SMTP id x190so30967024qkb.0 for ; Tue, 22 Nov 2016 08:04:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=hrytJ3TFjePkt2v9rTdmliYs99LqV3KBVBOU7v9xUQM=; b=IVjp2n5B4tawTLnKVoUXdHYM20R/g2XLc/EJKbo1MQzyYsiD7QT4P/EUa12iGuiApP TGa6BhPx0cGYMMpm42CKM8UnqRP+8v9n2UIm4CyUNrxyScbZfhossNb161tLs82hGlkd xZ+UPtTvXCeUCZ7ZvCFlRUQbuK+CCfMZH6s6yVHwA7X+i9Vv8dIy+e1+n79JvJRMv0d1 q+bcXT9OH7b9C+6BFGRJYC/Bcf002f1mO0o5t1lxf15jCpEax4Vxx6SnXHa4PBdxVYQn Gh3MsoXG2CJ2+4uzZUZWtfNwOsZuXsxM7GKVk2mleBIGuqlvtdZkol8i3hQbQ1Ezto0o Ashw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=hrytJ3TFjePkt2v9rTdmliYs99LqV3KBVBOU7v9xUQM=; b=RoELbARNuY0noOQG5NpGoro0p7yhKijauSchRC5ZMeKrynPKsZK1Oeayq5Ptn7L3pT LYWkvsb4ZhjoOPA7SixZm38kJwdZaOqHXR835NXK4N0GSxJ6UJXKhGuVo9qVEJAO1ctd uY2+Dkim2hrYGlgMpfkT8ZcT02gkIPA3xcJC8dkKVUB3/TLVQtyuDL0fbNzyNUI3SRo+ vwxxEgJa4yXuJuiLphWbqYiWh9lGkh8BrMosI7FlllOSG3AL0EfM6lSIxFOQB8/TeILZ upuQQvaOexpqjQqr8DHy/6i31qVqSO7H+Bw8ruV6NgGpB8sDXSNf0PAshbE74zJAZzwQ 0RjQ== X-Gm-Message-State: AKaTC01TJK166AQwW9PMEXrPPB8apjFDgeIRTfD8ib4yIb7jY6TOdnj9gLzT8zpBJqLpc+ekVs0jP6UcM0bGdTD9 X-Received: by 10.55.100.204 with SMTP id y195mr26046953qkb.23.1479830666193; Tue, 22 Nov 2016 08:04:26 -0800 (PST) MIME-Version: 1.0 Received: by 10.12.169.130 with HTTP; Tue, 22 Nov 2016 08:04:05 -0800 (PST) In-Reply-To: <582d7967efc27_1f3ae3fbbeb05913c149085@hookshot-fe-6dbb0c4.cp1-iad.github.net.mail> References: <582d7967efc27_1f3ae3fbbeb05913c149085@hookshot-fe-6dbb0c4.cp1-iad.github.net.mail> From: Nick Harper Date: Tue, 22 Nov 2016 08:04:05 -0800 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=94eb2c05c8743006800541e5edef Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] e141bb: Clarified the use of Token Binding in combination ... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Nov 2016 16:04:34 -0000 --94eb2c05c8743006800541e5edef Content-Type: text/plain; charset=UTF-8 I created https://github.com/TokenBinding/Internet-Drafts/pull/81 to add some language about the requirements for using renegotiation with http. I mentioned in the meeting last week that the spec for token binding with a specific application protocol needs to describe how the application protocol ensures that a TokenBindingMessage doesn't get split across renegotiation and how it knows which side of renegotiation the TokenBindingMessage belongs to. This PR adds that language to HTTPSTB, and some language to TBPROTO to describe what a future application profile would need to specify to support renegotiation with Token Binding. On Thu, Nov 17, 2016 at 1:33 AM, Andrei Popov wrote: > Branch: refs/heads/master > Home: https://github.com/TokenBinding/Internet-Drafts > Commit: e141bbf9dd4fb4d6900b9aaca55375a7b4a664f9 > https://github.com/TokenBinding/Internet-Drafts/commit/ > e141bbf9dd4fb4d6900b9aaca55375a7b4a664f9 > Author: Andrei Popov > Date: 2016-11-17 (Thu, 17 Nov 2016) > > Changed paths: > M draft-ietf-tokbind-negotiation-06.xml > M draft-ietf-tokbind-protocol-11.xml > > Log Message: > ----------- > Clarified the use of Token Binding in combination with TLS renegotiation. > > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --94eb2c05c8743006800541e5edef Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I created https://github.com/TokenBinding/Internet-Drafts/pull/81= to add some language about the requirements for using renegotiation wi= th http. I mentioned in the meeting last week that the spec for token bindi= ng with a specific application protocol needs to describe how the applicati= on protocol ensures that a TokenBindingMessage doesn't get split across= renegotiation and how it knows which side of renegotiation the TokenBindin= gMessage belongs to. This PR adds that language to HTTPSTB, and some langua= ge to TBPROTO to describe what a future application profile would need to s= pecify to support renegotiation with Token Binding.

On Thu, Nov 17, 2016 at 1:33 AM, An= drei Popov <andreipo@microsoft.com> wrote:
=C2=A0 Branch: refs/heads/master
=C2=A0 Home:=C2=A0 =C2=A0https://github.com/Toke= nBinding/Internet-Drafts
=C2=A0 Commit: e141bbf9dd4fb4d6900b9aaca55375a7b4a664f9
=C2=A0 =C2=A0 =C2=A0 https://github.com/TokenBinding/Internet-Drafts/c= ommit/e141bbf9dd4fb4d6900b9aaca55375a7b4a664f9
=C2=A0 Author: Andrei Popov <a= ndreipo@microsoft.com>
=C2=A0 Date:=C2=A0 =C2=A02016-11-17 (Thu, 17 Nov 2016)

=C2=A0 Changed paths:
=C2=A0 =C2=A0 M draft-ietf-tokbind-negotiation-06.xml
=C2=A0 =C2=A0 M draft-ietf-tokbind-protocol-11.xml

=C2=A0 Log Message:
=C2=A0 -----------
=C2=A0 Clarified the use of Token Binding in combination with TLS renegotia= tion.



_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e


--94eb2c05c8743006800541e5edef-- From nobody Tue Nov 22 12:01:28 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54A8B129B7A for ; Tue, 22 Nov 2016 12:01:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wR4zSgPMSEVC for ; Tue, 22 Nov 2016 12:01:25 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 652FF129B67 for ; Tue, 22 Nov 2016 12:01:05 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1479844864; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=92Vf2odQMZ3RcIPyuNDtUjPBSopTjkMB4a73gGyXtZU=; b=LN/Jc2X8At2Sv206HgbEkb+eC5rqOsVS5TPYLCNIGd9OJJZ6K3DSjszCXfptdNgCqdCTT8ka K+ghto1X1JWVfBuz7HyhLetsvbSSUVUQ9kpaGLhBaXTauqXjFJ0RcklVpt6Q4HZR4n4KuRMF WWOffjsCKM6rneeWghFmJwhJnPs= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=GSnzorw/4IQvX7LRcFxab1jqAquwOIngaoa+/cRJvIYZ9BBc6rfE14eQbArk/ymzDYboC3 ziasQ5+Qc6NaNyTqDPuolYAOJIZ6sgyrgaki+uuwBpg10WbR0FJKkUrxlap/xEOpi6GDx/pS Z4tv6XdgPhox3Z6akMdpyH+krf5lo= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.42]) by mxa.mailgun.org with ESMTP id 5834a3f4.7f8e140d6ba0-in02; Tue, 22 Nov 2016 20:00:52 -0000 (UTC) Date: Tue, 22 Nov 2016 12:00:52 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <5834a3f42f1d9_a9aa3f80b57d513469137@hookshot-fe-6dbb0c4.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5834a3f42eee4_a9aa3f80b57d5134690b7"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 99e6b4: Update language around renegotiation X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Nov 2016 20:01:26 -0000 ----==_mimepart_5834a3f42eee4_a9aa3f80b57d5134690b7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 99e6b49392b417cd23c5341fd57f720e5e2575ee https://github.com/TokenBinding/Internet-Drafts/commit/99e6b49392b417cd23c5341fd57f720e5e2575ee Author: Nick Harper Date: 2016-11-21 (Mon, 21 Nov 2016) Changed paths: M draft-ietf-tokbind-https-07.xml M draft-ietf-tokbind-protocol-11.xml Log Message: ----------- Update language around renegotiation - In TBPROTO, make it more clear what the app protocol needs to define - In HTTPSTB, provide that definition to use renegotiation Commit: a195e068051069f3815022fa3bf25027b22c37ea https://github.com/TokenBinding/Internet-Drafts/commit/a195e068051069f3815022fa3bf25027b22c37ea Author: Andrei Popov Date: 2016-11-22 (Tue, 22 Nov 2016) Changed paths: M draft-ietf-tokbind-https-07.xml M draft-ietf-tokbind-protocol-11.xml Log Message: ----------- Merge branch 'nharper-new-renego' Compare: https://github.com/TokenBinding/Internet-Drafts/compare/96526be5fc14...a195e0680510 ----==_mimepart_5834a3f42eee4_a9aa3f80b57d5134690b7-- From nobody Tue Nov 22 12:02:29 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EC5D129437 for ; Tue, 22 Nov 2016 12:02:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gq0-XK75MQ2B for ; Tue, 22 Nov 2016 12:02:25 -0800 (PST) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0110.outbound.protection.outlook.com [104.47.40.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6488D1296EC for ; Tue, 22 Nov 2016 12:02:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=PhfPZ2UgTW4zkzIMDIWU9EdoDXX2ESXYOD0zrFuCtdE=; b=I0RF13wdVJVHPw+lpK3FBWu3kWyONx9z5rceUBZeNZENUAnbjaDkwnxiKAg5RiloDwxeQ10594MIbbkrcokFwJrw9C3Ls8hQWlLP21bH5NTdL3LjV9EATKhHwazHrnKQpGGYhgIMbtB0E28CZIrq4BU3ZGBgVQH30W3XcZcNkok= Received: from BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) by BN3PR0301MB0834.namprd03.prod.outlook.com (10.160.154.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Tue, 22 Nov 2016 20:02:16 +0000 Received: from BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) by BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) with mapi id 15.01.0693.009; Tue, 22 Nov 2016 20:02:16 +0000 From: Andrei Popov To: Nick Harper Thread-Topic: [Unbearable] [TokenBinding/Internet-Drafts] e141bb: Clarified the use of Token Binding in combination ... Thread-Index: AQHSQOjgXfm/85NooU2OSXhFPNLzNKDlMkeAgABCVYA= Date: Tue, 22 Nov 2016 20:02:16 +0000 Message-ID: References: <582d7967efc27_1f3ae3fbbeb05913c149085@hookshot-fe-6dbb0c4.cp1-iad.github.net.mail> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0834; 7:ZNdX3F5tnxt2TeyQj03EUpvwhNScsl2avCp3Pg57dFUAk7o1YDGmppLo+xEE9wMd0O7lE9KyEz/r8aVI3r1RuKBhVX0d2ZUyJECogrXUE4NJo552P7RNVv//HWgfpkt7ixKcTJhY+LZ/Wy8Z1Mt2nBT8GDi29iBdE2pIBPz3nvR+Ccz1CvYoiIh/lOqRJtYEm0L1pICfxf3U3f+XyvjTQvCMVGdCyzqktjqmLcTahvD4Ekov1dZtbkem9/2GzYs6l/vXZUpw3jyhE3yhwklzT+L0hJNiDufFQBfnPmFFMZjNv2+yKwx69m9bOs5pOWhr8uVc1jVhwHMk3ey+/CEIYNh5APXE5xIt2JPl+0TWOBmIlGfq5PALxtD3E30SlLUe x-ms-office365-filtering-correlation-id: 89db580a-89d9-41ef-d6b5-08d413127564 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:BN3PR0301MB0834; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820)(211936372134217)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040307)(6060326)(6045199)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6046074)(6061324)(6041248)(6042181); SRVR:BN3PR0301MB0834; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0834; x-forefront-prvs: 0134AD334F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(199003)(377424004)(24454002)(377454003)(189002)(8936002)(229853002)(7696004)(76576001)(3660700001)(6506003)(606004)(86362001)(38730400001)(10090500001)(6116002)(8676002)(74316002)(3280700002)(81156014)(81166006)(4001150100001)(97736004)(86612001)(7736002)(9686002)(10290500002)(92566002)(76176999)(122556002)(790700001)(7906003)(8990500004)(2900100001)(33656002)(102836003)(101416001)(50986999)(68736007)(106356001)(6916009)(4326007)(110136003)(2906002)(2950100002)(77096005)(54356999)(106116001)(105586002)(5660300001)(99286002)(5005710100001)(19609705001)(189998001)(7846002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0834; H:BN3PR0301MB0836.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN3PR0301MB08363FA6A435A48EC386200E8CB40BN3PR0301MB0836_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Nov 2016 20:02:16.3542 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0834 Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] e141bb: Clarified the use of Token Binding in combination ... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Nov 2016 20:02:27 -0000 --_000_BN3PR0301MB08363FA6A435A48EC386200E8CB40BN3PR0301MB0836_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIE5pY2s7IEnigJl2ZSBtZXJnZWQgUFIgIzgxIHdpdGggbWlub3IgZWRpdHMuDQoNCkNo ZWVycywNCg0KQW5kcmVpDQoNCkZyb206IE5pY2sgSGFycGVyIFttYWlsdG86bmhhcnBlckBnb29n bGUuY29tXQ0KU2VudDogVHVlc2RheSwgTm92ZW1iZXIgMjIsIDIwMTYgODowNCBBTQ0KVG86IEFu ZHJlaSBQb3BvdiA8QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb20+DQpDYzogSUVURiBUb2tiaW5k IFdHIDx1bmJlYXJhYmxlQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtVbmJlYXJhYmxlXSBbVG9r ZW5CaW5kaW5nL0ludGVybmV0LURyYWZ0c10gZTE0MWJiOiBDbGFyaWZpZWQgdGhlIHVzZSBvZiBU b2tlbiBCaW5kaW5nIGluIGNvbWJpbmF0aW9uIC4uLg0KDQpJIGNyZWF0ZWQgaHR0cHM6Ly9naXRo dWIuY29tL1Rva2VuQmluZGluZy9JbnRlcm5ldC1EcmFmdHMvcHVsbC84MSB0byBhZGQgc29tZSBs YW5ndWFnZSBhYm91dCB0aGUgcmVxdWlyZW1lbnRzIGZvciB1c2luZyByZW5lZ290aWF0aW9uIHdp dGggaHR0cC4gSSBtZW50aW9uZWQgaW4gdGhlIG1lZXRpbmcgbGFzdCB3ZWVrIHRoYXQgdGhlIHNw ZWMgZm9yIHRva2VuIGJpbmRpbmcgd2l0aCBhIHNwZWNpZmljIGFwcGxpY2F0aW9uIHByb3RvY29s IG5lZWRzIHRvIGRlc2NyaWJlIGhvdyB0aGUgYXBwbGljYXRpb24gcHJvdG9jb2wgZW5zdXJlcyB0 aGF0IGEgVG9rZW5CaW5kaW5nTWVzc2FnZSBkb2Vzbid0IGdldCBzcGxpdCBhY3Jvc3MgcmVuZWdv dGlhdGlvbiBhbmQgaG93IGl0IGtub3dzIHdoaWNoIHNpZGUgb2YgcmVuZWdvdGlhdGlvbiB0aGUg VG9rZW5CaW5kaW5nTWVzc2FnZSBiZWxvbmdzIHRvLiBUaGlzIFBSIGFkZHMgdGhhdCBsYW5ndWFn ZSB0byBIVFRQU1RCLCBhbmQgc29tZSBsYW5ndWFnZSB0byBUQlBST1RPIHRvIGRlc2NyaWJlIHdo YXQgYSBmdXR1cmUgYXBwbGljYXRpb24gcHJvZmlsZSB3b3VsZCBuZWVkIHRvIHNwZWNpZnkgdG8g c3VwcG9ydCByZW5lZ290aWF0aW9uIHdpdGggVG9rZW4gQmluZGluZy4NCg0KT24gVGh1LCBOb3Yg MTcsIDIwMTYgYXQgMTozMyBBTSwgQW5kcmVpIFBvcG92IDxhbmRyZWlwb0BtaWNyb3NvZnQuY29t PG1haWx0bzphbmRyZWlwb0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQogIEJyYW5jaDogcmVmcy9o ZWFkcy9tYXN0ZXINCiAgSG9tZTogICBodHRwczovL2dpdGh1Yi5jb20vVG9rZW5CaW5kaW5nL0lu dGVybmV0LURyYWZ0cw0KICBDb21taXQ6IGUxNDFiYmY5ZGQ0ZmI0ZDY5MDBiOWFhY2E1NTM3NWE3 YjRhNjY0ZjkNCiAgICAgIGh0dHBzOi8vZ2l0aHViLmNvbS9Ub2tlbkJpbmRpbmcvSW50ZXJuZXQt RHJhZnRzL2NvbW1pdC9lMTQxYmJmOWRkNGZiNGQ2OTAwYjlhYWNhNTUzNzVhN2I0YTY2NGY5DQog IEF1dGhvcjogQW5kcmVpIFBvcG92IDxhbmRyZWlwb0BtaWNyb3NvZnQuY29tPG1haWx0bzphbmRy ZWlwb0BtaWNyb3NvZnQuY29tPj4NCiAgRGF0ZTogICAyMDE2LTExLTE3IChUaHUsIDE3IE5vdiAy MDE2KQ0KDQogIENoYW5nZWQgcGF0aHM6DQogICAgTSBkcmFmdC1pZXRmLXRva2JpbmQtbmVnb3Rp YXRpb24tMDYueG1sDQogICAgTSBkcmFmdC1pZXRmLXRva2JpbmQtcHJvdG9jb2wtMTEueG1sDQoN CiAgTG9nIE1lc3NhZ2U6DQogIC0tLS0tLS0tLS0tDQogIENsYXJpZmllZCB0aGUgdXNlIG9mIFRv a2VuIEJpbmRpbmcgaW4gY29tYmluYXRpb24gd2l0aCBUTFMgcmVuZWdvdGlhdGlvbi4NCg0KDQoN Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpVbmJlYXJh YmxlIG1haWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86VW5iZWFyYWJsZUBp ZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJs ZQ0KDQo= --_000_BN3PR0301MB08363FA6A435A48EC386200E8CB40BN3PR0301MB0836_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNv LXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjox LjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNl Y3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRl ZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8 bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48 IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGlu az0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRoYW5rcyBOaWNrOyBJ4oCZdmUgbWVyZ2VkIFBSICM4MSB3 aXRoIG1pbm9yIGVkaXRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5DaGVlcnMsPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFu ZHJlaTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4g TmljayBIYXJwZXIgW21haWx0bzpuaGFycGVyQGdvb2dsZS5jb21dDQo8YnI+DQo8Yj5TZW50Ojwv Yj4gVHVlc2RheSwgTm92ZW1iZXIgMjIsIDIwMTYgODowNCBBTTxicj4NCjxiPlRvOjwvYj4gQW5k cmVpIFBvcG92ICZsdDtBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbSZndDs8YnI+DQo8Yj5DYzo8 L2I+IElFVEYgVG9rYmluZCBXRyAmbHQ7dW5iZWFyYWJsZUBpZXRmLm9yZyZndDs8YnI+DQo8Yj5T dWJqZWN0OjwvYj4gUmU6IFtVbmJlYXJhYmxlXSBbVG9rZW5CaW5kaW5nL0ludGVybmV0LURyYWZ0 c10gZTE0MWJiOiBDbGFyaWZpZWQgdGhlIHVzZSBvZiBUb2tlbiBCaW5kaW5nIGluIGNvbWJpbmF0 aW9uIC4uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgY3JlYXRlZCA8 YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vVG9rZW5CaW5kaW5nL0ludGVybmV0LURyYWZ0cy9w dWxsLzgxIj4NCmh0dHBzOi8vZ2l0aHViLmNvbS9Ub2tlbkJpbmRpbmcvSW50ZXJuZXQtRHJhZnRz L3B1bGwvODE8L2E+IHRvIGFkZCBzb21lIGxhbmd1YWdlIGFib3V0IHRoZSByZXF1aXJlbWVudHMg Zm9yIHVzaW5nIHJlbmVnb3RpYXRpb24gd2l0aCBodHRwLiBJIG1lbnRpb25lZCBpbiB0aGUgbWVl dGluZyBsYXN0IHdlZWsgdGhhdCB0aGUgc3BlYyBmb3IgdG9rZW4gYmluZGluZyB3aXRoIGEgc3Bl Y2lmaWMgYXBwbGljYXRpb24gcHJvdG9jb2wgbmVlZHMgdG8gZGVzY3JpYmUNCiBob3cgdGhlIGFw cGxpY2F0aW9uIHByb3RvY29sIGVuc3VyZXMgdGhhdCBhIFRva2VuQmluZGluZ01lc3NhZ2UgZG9l c24ndCBnZXQgc3BsaXQgYWNyb3NzIHJlbmVnb3RpYXRpb24gYW5kIGhvdyBpdCBrbm93cyB3aGlj aCBzaWRlIG9mIHJlbmVnb3RpYXRpb24gdGhlIFRva2VuQmluZGluZ01lc3NhZ2UgYmVsb25ncyB0 by4gVGhpcyBQUiBhZGRzIHRoYXQgbGFuZ3VhZ2UgdG8gSFRUUFNUQiwgYW5kIHNvbWUgbGFuZ3Vh Z2UgdG8gVEJQUk9UTyB0byBkZXNjcmliZQ0KIHdoYXQgYSBmdXR1cmUgYXBwbGljYXRpb24gcHJv ZmlsZSB3b3VsZCBuZWVkIHRvIHNwZWNpZnkgdG8gc3VwcG9ydCByZW5lZ290aWF0aW9uIHdpdGgg VG9rZW4gQmluZGluZy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIFRodSwgTm92IDE3LCAyMDE2IGF0IDE6MzMgQU0sIEFuZHJlaSBQb3BvdiAmbHQ7PGEg aHJlZj0ibWFpbHRvOmFuZHJlaXBvQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj5hbmRy ZWlwb0BtaWNyb3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDow aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij4m bmJzcDsgQnJhbmNoOiByZWZzL2hlYWRzL21hc3Rlcjxicj4NCiZuYnNwOyBIb21lOiZuYnNwOyAm bmJzcDs8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vVG9rZW5CaW5kaW5nL0ludGVybmV0LURy YWZ0cyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZ2l0aHViLmNvbS9Ub2tlbkJpbmRpbmcvSW50 ZXJuZXQtRHJhZnRzPC9hPjxicj4NCiZuYnNwOyBDb21taXQ6IGUxNDFiYmY5ZGQ0ZmI0ZDY5MDBi OWFhY2E1NTM3NWE3YjRhNjY0Zjk8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyA8YSBocmVmPSJo dHRwczovL2dpdGh1Yi5jb20vVG9rZW5CaW5kaW5nL0ludGVybmV0LURyYWZ0cy9jb21taXQvZTE0 MWJiZjlkZDRmYjRkNjkwMGI5YWFjYTU1Mzc1YTdiNGE2NjRmOSIgdGFyZ2V0PSJfYmxhbmsiPg0K aHR0cHM6Ly9naXRodWIuY29tL1Rva2VuQmluZGluZy9JbnRlcm5ldC1EcmFmdHMvY29tbWl0L2Ux NDFiYmY5ZGQ0ZmI0ZDY5MDBiOWFhY2E1NTM3NWE3YjRhNjY0Zjk8L2E+PGJyPg0KJm5ic3A7IEF1 dGhvcjogQW5kcmVpIFBvcG92ICZsdDs8YSBocmVmPSJtYWlsdG86YW5kcmVpcG9AbWljcm9zb2Z0 LmNvbSI+YW5kcmVpcG9AbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7PGJyPg0KJm5ic3A7IERhdGU6Jm5i c3A7ICZuYnNwOzIwMTYtMTEtMTcgKFRodSwgMTcgTm92IDIwMTYpPGJyPg0KPGJyPg0KJm5ic3A7 IENoYW5nZWQgcGF0aHM6PGJyPg0KJm5ic3A7ICZuYnNwOyBNIGRyYWZ0LWlldGYtdG9rYmluZC1u ZWdvdGlhdGlvbi0wNi54bWw8YnI+DQombmJzcDsgJm5ic3A7IE0gZHJhZnQtaWV0Zi10b2tiaW5k LXByb3RvY29sLTExLnhtbDxicj4NCjxicj4NCiZuYnNwOyBMb2cgTWVzc2FnZTo8YnI+DQombmJz cDsgLS0tLS0tLS0tLS08YnI+DQombmJzcDsgQ2xhcmlmaWVkIHRoZSB1c2Ugb2YgVG9rZW4gQmlu ZGluZyBpbiBjb21iaW5hdGlvbiB3aXRoIFRMUyByZW5lZ290aWF0aW9uLjxicj4NCjxicj4NCjxi cj4NCjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f PGJyPg0KVW5iZWFyYWJsZSBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86VW5iZWFy YWJsZUBpZXRmLm9yZyI+VW5iZWFyYWJsZUBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGU8L2E+ PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRt bD4NCg== --_000_BN3PR0301MB08363FA6A435A48EC386200E8CB40BN3PR0301MB0836_-- From nobody Tue Nov 22 13:42:08 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E880129450 for ; Tue, 22 Nov 2016 13:42:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VqxqpnJqsr_U for ; Tue, 22 Nov 2016 13:42:05 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CED4A129432 for ; Tue, 22 Nov 2016 13:42:05 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1479850925; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=gu98j0r3DveKkkRpwp/z0GjaBkNWyuF4AXMAVNKVwVM=; b=uOe83kcTlD+hiFHplibZpv3zbqme6e0IeTm5d2Ha96rzhaOYhPLFeNisVlAF0tZJ63mM4/10 Yy+zYqfayfgdC5Eg7AdubvTahsLu/z4qmSDaysMSGnt3f6WwANR85/Q6360aySOyuYf6eQAt JzY4T9trTQweMRDm5EgW6ABUq/Q= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=Mc02uhU+J7JctAvgjyX5rZwwqm1DrZyt4Ec8ogUgM+dnn/SadoD1xRCjykUf9Tk4pDuOIX Jm52FAw7eQnO7Fvx2zL2dw+4KvsbAe5i4baAaAT2BCvaSd5u/QoWDaDlrmbbrpeGqVpQTmmK C+ri/cC1+vOzxyBHxphOyZIQdbLOo= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.42]) by mxa.mailgun.org with ESMTP id 5834bbab.7f2f842cf150-in02; Tue, 22 Nov 2016 21:42:03 -0000 (UTC) Date: Tue, 22 Nov 2016 13:42:03 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <5834bbab64ca7_ac973fa3112c713c33796@hookshot-fe-6dbb0c4.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5834bbab649bf_ac973fa3112c713c3362d"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 3648bf: Merging PR #81: renegotiation requirements. X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Nov 2016 21:42:07 -0000 ----==_mimepart_5834bbab649bf_ac973fa3112c713c3362d Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 3648bf1cfc5003a96cde42e0161abc5710a7b69b https://github.com/TokenBinding/Internet-Drafts/commit/3648bf1cfc5003a96cde42e0161abc5710a7b69b Author: Andrei Popov Date: 2016-11-22 (Tue, 22 Nov 2016) Changed paths: M draft-ietf-tokbind-https-07.xml M draft-ietf-tokbind-protocol-11.xml Log Message: ----------- Merging PR #81: renegotiation requirements. ----==_mimepart_5834bbab649bf_ac973fa3112c713c3362d-- From nobody Wed Nov 23 09:04:16 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB5BA129B67 for ; Tue, 22 Nov 2016 12:01:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.18 X-Spam-Level: X-Spam-Status: No, score=-4.18 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pxqpq1yhUYDq for ; Tue, 22 Nov 2016 12:01:30 -0800 (PST) Received: from o4.sgmail.github.com (o4.sgmail.github.com [192.254.112.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16CF0129EA3 for ; Tue, 22 Nov 2016 12:01:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com; h=from:reply-to:to:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=j4ONEmtpbp1LSsWbD0Obe4OZ+Eg=; b=qn+f2sszZzfiAmIJ 06QfzS6Kcr64lIdC1kOP2VrcNnOR3SegKJMtQ2yf6vvschivstzUZpEtQsOhaov5 TDgOef0DshOH4i5NEcNgJX/i6CDNvtwSAVoMXBgFnWkTxj694iGAABbGvPLOm6mL z+8+NRiV6lqjGkyL0I6YsOP5l0w= Received: by filter0415p1mdw1.sendgrid.net with SMTP id filter0415p1mdw1-19563-5834A3F4-5E 2016-11-22 20:00:52.679866773 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0001p1iad1.sendgrid.net (SG) with ESMTP id LKRuk78USH-6AoVmsrNZiQ for ; Tue, 22 Nov 2016 20:00:52.631 +0000 (UTC) Date: Tue, 22 Nov 2016 12:00:52 -0800 From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5834a3f4662bc_2eef3fd1e00bf134207427"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYqQPM/sj5auiredyJ2tQSNp9ZPP2XBJT2bn9X Y6KC7SOyZ8ecwk8vIVNEofIoWXsFm19p8o1+17Rsi4VTXjTZNyN+OwwNpvf41XwVC4BhM8qSF+GVQH KMPuGm/P3k1MGDQwCHH0JemM3ZxudF1Gd40nAdzzSAV8ba1YVwhtAfLF7U3habnEG+KPwazwUty5Kc 4= Archived-At: X-Mailman-Approved-At: Wed, 23 Nov 2016 09:04:15 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Update language around renegotiation (#81) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Nov 2016 20:01:32 -0000 ----==_mimepart_5834a3f4662bc_2eef3fd1e00bf134207427 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #81. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/81#event-868782300 ----==_mimepart_5834a3f4662bc_2eef3fd1e00bf134207427 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #81.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5834a3f4662bc_2eef3fd1e00bf134207427-- From nobody Wed Nov 23 10:56:11 2016 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3389E12A369; Wed, 23 Nov 2016 10:56:05 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.38.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147992736520.32761.7376823657668202029.idtracker@ietfa.amsl.com> Date: Wed, 23 Nov 2016 10:56:05 -0800 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-https-07.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Nov 2016 18:56:05 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding of the IETF. Title : Token Binding over HTTP Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Jeff Hodges Filename : draft-ietf-tokbind-https-07.txt Pages : 22 Date : 2016-11-23 Abstract: This document describes a collection of mechanisms that allow HTTP servers to cryptographically bind authentication tokens (such as cookies and OAuth tokens) to TLS [RFC5246] connections. We describe both _first-party_ and _federated_ scenarios. In a first-party scenario, an HTTP server is able to cryptographically bind the security tokens it issues to a client, and which the client subsequently returns to the server, to the TLS connection between the client and server. Such bound security tokens are protected from misuse since the server can generally detect if they are replayed inappropriately, e.g., over other TLS connections. Federated token bindings, on the other hand, allow servers to cryptographically bind security tokens to a TLS connection that the client has with a _different_ server than the one issuing the token. This Internet-Draft is a companion document to The Token Binding Protocol [I-D.ietf-tokbind-protocol] The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-https/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-https-07 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-https-07 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Nov 23 10:57:32 2016 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B4BD9129A2D; Wed, 23 Nov 2016 10:57:30 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.38.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147992745073.316.15116935291557535895.idtracker@ietfa.amsl.com> Date: Wed, 23 Nov 2016 10:57:30 -0800 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-negotiation-06.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Nov 2016 18:57:31 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding of the IETF. Title : Transport Layer Security (TLS) Extension for Token Binding Protocol Negotiation Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Filename : draft-ietf-tokbind-negotiation-06.txt Pages : 8 Date : 2016-11-23 Abstract: This document specifies a Transport Layer Security (TLS) [RFC5246] extension for the negotiation of Token Binding protocol [I-D.ietf-tokbind-protocol] version and key parameters. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-negotiation/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-06 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-negotiation-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Nov 23 10:58:48 2016 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B25EE12A36A; Wed, 23 Nov 2016 10:58:43 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.38.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147992752372.370.1484905892721935362.idtracker@ietfa.amsl.com> Date: Wed, 23 Nov 2016 10:58:43 -0800 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-protocol-11.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Nov 2016 18:58:44 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding of the IETF. Title : The Token Binding Protocol Version 1.0 Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Jeff Hodges Filename : draft-ietf-tokbind-protocol-11.txt Pages : 17 Date : 2016-11-23 Abstract: This document specifies Version 1.0 of the Token Binding protocol. The Token Binding protocol allows client/server applications to create long-lived, uniquely identifiable TLS [RFC5246] bindings spanning multiple TLS sessions and connections. Applications are then enabled to cryptographically bind security tokens to the TLS layer, preventing token export and replay attacks. To protect privacy, the Token Binding identifiers are only transmitted encrypted and can be reset by the user at any time. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-protocol-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-protocol-11 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Nov 23 12:04:18 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D004129B3E for ; Wed, 23 Nov 2016 12:04:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id utlVolNq8QTM for ; Wed, 23 Nov 2016 12:04:15 -0800 (PST) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0126.outbound.protection.outlook.com [104.47.32.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66ED3129A06 for ; Wed, 23 Nov 2016 12:04:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=52PvX3en6nctvW5YTBtsplsS4ittXXOvTWlVSFQ3Was=; b=eHjtTv8suH9nDpvHN4XvIZFvT8Ui9tQQd8sF/gWkyXVxgntqFRZjNcyG3w4rUhe0R09S9CW0BeyUvdNbVSyrEiRpFahVH2gBkREKeBPayi1m8onU3j/8S3M5jmCsldj/Lz+h/QHVjRHRLYnvLrWVTD/b54RRa1RtBs7I1YQpN+w= Received: from BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) by BN3PR0301MB0833.namprd03.prod.outlook.com (10.160.154.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Wed, 23 Nov 2016 20:02:10 +0000 Received: from BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) by BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) with mapi id 15.01.0693.009; Wed, 23 Nov 2016 20:02:10 +0000 From: Andrei Popov To: IETF Tokbind WG Thread-Topic: New TBNEGO, TBPROTO, HTTPSTB Revisions Thread-Index: AdJFvG6Tidq0Y6MEQzqUyhYw3kuudw== Date: Wed, 23 Nov 2016 20:02:10 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0833; 7:38XLFHF0AKKsBXE1eGvxEwO2kU6wthXgtt2SACiHRAJh9X8vL7Pi0kzI2f13OOumIdmuMNht9QJ+cSIfW/B/TQ92i6nEmSF1Pegl7A3ORKgvynoBN6iweHAuoCKLxb3IbJKIocFcHu/PXW+KdCTtuML0lFd38YfNDx/o+iNbKbAiw8e7bilIvP+MewJfNYAVwhefDmal80aOAfhVNL1f9rz6AdZyrLi3kQ4GG2aCsB7096Ql7mW/PbdgwZg5CVd5cKrhtbCGz52F51OOT9ZWwDgS7aZQfGdseNl1OrCswHlDOaPjIuW/sZjhMN/sOM+w+rsO79YlOMKfaIStKvDlQt7sK0zoMxwTMD1RSwe7B5QWIXcILX0J4M+JCN0G14Sb x-ms-office365-filtering-correlation-id: fa719b00-d8f3-4421-4070-08d413db9c20 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:BN3PR0301MB0833; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040307)(6060326)(6045199)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(6061324)(6046074)(6042181); SRVR:BN3PR0301MB0833; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0833; x-forefront-prvs: 013568035E x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(189002)(199003)(6916009)(50986999)(68736007)(101416001)(106356001)(6116002)(105586002)(10090500001)(77096005)(81156014)(10290500002)(102836003)(5005710100001)(790700001)(33656002)(450100001)(3660700001)(8936002)(8990500004)(3280700002)(2900100001)(6506003)(97736004)(81166006)(189998001)(38730400001)(92566002)(86612001)(110136003)(54356999)(122556002)(107886002)(2906002)(74316002)(7736002)(5660300001)(86362001)(99286002)(7846002)(9686002)(7696004)(76576001)(8676002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0833; H:BN3PR0301MB0836.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN3PR0301MB083655CBED1AFC0D008990F28CB70BN3PR0301MB0836_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Nov 2016 20:02:10.1455 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0833 Archived-At: Subject: [Unbearable] New TBNEGO, TBPROTO, HTTPSTB Revisions X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Nov 2016 20:04:17 -0000 --_000_BN3PR0301MB083655CBED1AFC0D008990F28CB70BN3PR0301MB0836_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Updated versions of the Token Binding I-Ds address WGLC comments we've rece= ived so far: 1. Connection termination is no longer required when TB validation fa= ils; 2. Applications other than Web browsers MAY use key scoping rules oth= er than eTLS+1; 3. Issues and requirements related to TLS renegotiation are described= ; 4. Signaling mechanisms other than Include-Referred-Token-Binding-ID = HTTP response header are explicitly allowed; 5. Renegotiation Indication TLS extension is required in all cases (a= gain); 6. EKM length is defined at 32 bytes for the currently defined signat= ure schemes, but could be longer in the future. Cheers, Andrei --_000_BN3PR0301MB083655CBED1AFC0D008990F28CB70BN3PR0301MB0836_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Updated versions of the Token Binding I-Ds address W= GLC comments we’ve received so far:

1.     &= nbsp; Connection termination is no longer required when T= B validation fails;

2.     &= nbsp; Applications other than Web browsers MAY use key sc= oping rules other than eTLS+1;

3.     &= nbsp; Issues and requirements related to TLS renegotiatio= n are described;

4.     &= nbsp; Signaling mechanisms other than Include-Referred-To= ken-Binding-ID HTTP response header are explicitly allowed;

5.     &= nbsp; Renegotiation Indication TLS extension is required = in all cases (again);

6.     &= nbsp; EKM length is defined at 32 bytes for the currently= defined signature schemes, but could be longer in the future.

 

Cheers,

 

Andrei

--_000_BN3PR0301MB083655CBED1AFC0D008990F28CB70BN3PR0301MB0836_-- From nobody Wed Nov 23 16:31:40 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25C741295AE for ; Wed, 23 Nov 2016 16:31:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QpXrZ-ZfKlfR for ; Wed, 23 Nov 2016 16:31:37 -0800 (PST) Received: from mail-io0-x22c.google.com (mail-io0-x22c.google.com [IPv6:2607:f8b0:4001:c06::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A404D1295BD for ; Wed, 23 Nov 2016 16:31:37 -0800 (PST) Received: by mail-io0-x22c.google.com with SMTP id c21so48910423ioj.1 for ; Wed, 23 Nov 2016 16:31:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=N2o04zXTwW49s/zrRobkHOnP0E93arPpnjtCYQp7aK0=; b=QgyJnvItFNOBH+DcjWna8/cy7AKrV4ywUXcHqzmdHUzDyDKo43rjX1WoIa/T3i9iZp tFd6xwycX5UDQFYX596Q5SUAwHfnnk6ufe4hLYwrbrXqRlZhNzVF7c3wTraWITkc9sCB uPWXKwuFAjHip8wBeiHQM+zgCkVwuwapOQPMfXjxRL//+pINHupi1ZKIY9Db3ooeEt+j 3ik+0t8jAitwAZUWwJkGJz/Bdv+dtuoHexi5zIP4jYy5wo5/x4vseQl5uQAMZjJGoSKv LInffBvEHTPklGB/0m6+NY9RC8HJk7NgXYTfQV4qccMRsxThSkFYqvNEtz12GwfQ+nMt xaGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=N2o04zXTwW49s/zrRobkHOnP0E93arPpnjtCYQp7aK0=; b=QoQYEciCRM0dzXkZxfRDb33ima1rYy+VM+a+E2LyjBn0tXesw9KjlHZ4tOrYDm6D8c WOUdraHq83QYVsFzDpxM6w6Eu8+MsW9Vw3v4arSyvdzqqMmpTbk7WC1OjcraR3h+nkBe 0ytn0IG2J2Lwct11va7Zt0zfMy1f14ajJ2VT9Xeqhry2Wu4P+WjBTm6J+J2Ph4MbZS0p 1NjEG6a50Vh16OJjHNk5r8zdpbagzsYRm5XpO3eAdpbruahdIoVDgJKry04KrJWNUbjh TyhqVn1ta8yG0yISsXbTgJI6ngZgy8k66tqAUU0VUmSVRVYQI1Gg+fHWxyJjocBincw3 cWmQ== X-Gm-Message-State: AKaTC00Oz8o9cCAcpNiP1bl64dYONfHH+cgw/QO+6G0ly70C8s9dDTBpOXUh9h+qWVBlN+fjcj+lIIoR7AxkCc8Z X-Received: by 10.36.228.194 with SMTP id o185mr5578938ith.112.1479947496795; Wed, 23 Nov 2016 16:31:36 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.79.216 with HTTP; Wed, 23 Nov 2016 16:31:36 -0800 (PST) In-Reply-To: References: From: Piotr Sikora Date: Wed, 23 Nov 2016 16:31:36 -0800 Message-ID: To: Tokbind WG Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: Bill Cox Subject: Re: [Unbearable] Open source token binding libraries available X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Nov 2016 00:31:39 -0000 Hey, NGINX module was released last week, and it's available at: https://github.com/google/ngx_token_binding It provides two features, which can be combined: 1. Transparent binding & verification of HTTP cookies, which can be used without any modifications to the backend. In this mode, NGINX adds HMAC to selected cookies before sending them to the clients, and it verifies that the signature is correct in selected cookies before forwarding them to the backend. This way, clients always see bound cookies, and backend servers always see unbound cookies. 2. Forwarding of base64url-encoded SHA256 of Token Binding ID to the backend servers. This allows backend to use Token Binding, even when it doesn't terminate TLS connections from the clients. Please let me know if you have any questions! Best regards, Piotr Sikora On Mon, Nov 14, 2016 at 3:30 PM, Bill Cox wrote: > My long awaited library is at github.com/google/token_bind. As a > super-awesome bonus, Piotr also open-sourced an NGINX module that uses it to > provide token binding securityfor NGINX proxies, but I'll leave it up to > Piotr to describe his work. Thanks again, Piotr! > > Bill From nobody Tue Nov 29 12:26:13 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DE5F129510 for ; Tue, 29 Nov 2016 12:26:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aobbHAQIxDQz for ; Tue, 29 Nov 2016 12:26:11 -0800 (PST) Received: from gproxy6-pub.mail.unifiedlayer.com (gproxy6-pub.mail.unifiedlayer.com [67.222.39.168]) by ietfa.amsl.com (Postfix) with SMTP id CD8DF129C67 for ; Tue, 29 Nov 2016 12:17:54 -0800 (PST) Received: (qmail 11517 invoked by uid 0); 29 Nov 2016 20:17:51 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy6.mail.unifiedlayer.com with SMTP; 29 Nov 2016 20:17:51 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id DwHm1u0192UhLwi01wHpAH; Tue, 29 Nov 2016 13:17:50 -0700 X-Authority-Analysis: v=2.1 cv=YNIMl32x c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=L24OOQBejmoA:10 a=48vgC7mUAAAA:8 a=VysLwuxkH1znHGhGU-wA:9 a=QEXdDO2ut3YA:10 a=w1C3t2QeGrPiZgrLijVG:22 Received: from [173.224.162.79] (port=22115 helo=[192.168.93.253]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cBoqa-0007QO-C1 for unbearable@ietf.org; Tue, 29 Nov 2016 13:17:48 -0700 To: IETF TokBind WG From: =JeffH Message-ID: Date: Tue, 29 Nov 2016 12:17:46 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.79 X-Exim-ID: 1cBoqa-0007QO-C1 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.93.253]) [173.224.162.79]:22115 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Nov 2016 20:26:12 -0000 in we now have this 2nd parag after the list of bullet items.. > Specifications defining the use of Token Binding with various > application protocols, such as Token Binding over HTTP > [I-D.ietf-tokbind-https], may prohibit the use of TLS renegotiation > in combination with Token Binding. Alternatively, such > specifications need to define a way to determine which EKM value > corresponds to a given TokenBindingMessage, and a mechanism > preventing a TokenBindingMessage from being split across the > renegotiation boundary. I am wondering about what the 2nd sentence above is saying, especially the after the 2nd comma, and am curious whether the below is an equivalent (and more clear) way to write it.. Alternatively, such specifications need to define a way to determine which EKM value corresponds to a given TokenBindingMessage, and a mechanism ensuring that TokenBindingMessages sent after a renegotiation event are signing the post-renegotiation EKM value. ..? thanks, =JeffH From nobody Tue Nov 29 12:34:21 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F3B4129C71 for ; Tue, 29 Nov 2016 12:34:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u64fYieg9PAR for ; Tue, 29 Nov 2016 12:34:17 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0109.outbound.protection.outlook.com [104.47.33.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7306129C61 for ; Tue, 29 Nov 2016 12:34:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=NnMMkNJUUYjlsrZooMAsfRjz7pvcxPjpddjU3Ox2BHE=; b=D7wRp079qKG+OSu/SzWMQ4y+LlVszI6eI6EjJqEhG1C5AjSkBBZz9g5icFORk4a3P0xh7wkZDiJxyRz99zy+I+vIdeIgSvlizvmUUYDMUqkP+pzimgtPGfJj37hc6cUhKzGrk1beRFALEnL0d9urgHNMzrrkKzqexnuco3dPBVQ= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0843.namprd03.prod.outlook.com (10.160.163.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.649.16; Tue, 29 Nov 2016 20:34:12 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0649.027; Tue, 29 Nov 2016 20:34:12 +0000 From: Andrei Popov To: =JeffH , IETF TokBind WG , Nick Harper Thread-Topic: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag Thread-Index: AQHSSn7a7mdOp6sg7kWdo8atNZZnr6DwaR9A Date: Tue, 29 Nov 2016 20:34:12 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0843; 7:Nzy08/4MZ4+beBlYbKKQmk0fBuB2uLyymJrfSvRc9ydeA9mN/Kt5HP9hBcYDeAI4jjsu7C8fNbH5qob5KDHXNcRyuq7foLymxSGV9vMK75P12PNhUH+Lchj86cvJdP9L6eqEdX6cVc7/1Odg7fTMTGsHHG2abVVelUVDzNlTw84iWMDdYPX6F4bO/f/HLR2yfPAKzqHIomKivFFWOhKshWlfPydTDAqevF8beu6julEfVkS7O7KNvLcQDtuo63gXWpTTn7U276JLQrSZ4JwIcs/KyF5TjVKD+F6yUqPID3RTcsJ4cf5Bq/N3j/65yVD+5imDWaqGhTvaOeIAqjA2TDLaQKx2W9Uxf5izSizqVaYYRqAWF2+/hMB6aSSdAD33 x-ms-office365-filtering-correlation-id: 80926d70-0300-490f-cf1a-08d41897143e x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0843; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123564025)(20161123562025)(20161123560025)(6047074)(6042181); SRVR:CY1PR0301MB0843; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0843; x-forefront-prvs: 01415BB535 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(13464003)(377454003)(189002)(199003)(102836003)(10290500002)(76576001)(81156014)(7696004)(229853002)(2906002)(6116002)(5001770100001)(5660300001)(6506003)(8676002)(86362001)(2950100002)(92566002)(107886002)(7846002)(2900100001)(189998001)(3660700001)(68736007)(9686002)(54356999)(10090500001)(3280700002)(122556002)(5005710100001)(86612001)(8990500004)(97736004)(74316002)(106356001)(305945005)(81166006)(50986999)(106116001)(38730400001)(105586002)(7736002)(101416001)(33656002)(76176999)(77096006)(99286002)(8936002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0843; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Nov 2016 20:34:12.3152 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0843 Archived-At: Subject: Re: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Nov 2016 20:34:20 -0000 > and a mechanism > preventing a TokenBindingMessage from being split across the > renegotiation boundary. Nick refers to the fact that an application_data message can be fragmented,= with some fragments delivered before renegotiation and others after renego= tiation. If one fragmented TB message is therefore sent both before and after a rene= gotiation, it's not clear which EKM it's using (probably from before the re= negotiation, but then it's not the current one). Nick's solution is to prohibit such splitting of TB messages across the ren= egotiation boundary. (Nick please correct if I mis-represented). Cheers, Andrei ----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of =3DJeffH Sent: Tuesday, November 29, 2016 12:18 PM To: IETF TokBind WG Subject: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag in we now have this 2nd parag after the list of bullet items.. > Specifications defining the use of Token Binding with various > application protocols, such as Token Binding over HTTP > [I-D.ietf-tokbind-https], may prohibit the use of TLS renegotiation > in combination with Token Binding. Alternatively, such > specifications need to define a way to determine which EKM value > corresponds to a given TokenBindingMessage, and a mechanism > preventing a TokenBindingMessage from being split across the > renegotiation boundary. I am wondering about what the 2nd sentence above is saying, especially the = after the 2nd comma, and am curious whether the below is an equivalent (and= more clear) way to write it.. Alternatively, such specifications need to define a way to determine which EKM value corresponds to a given TokenBindingMessage, and a mechanism ensuring that TokenBindingMessages sent after a renegotiation event are signing the post-renegotiation EKM value. ..? thanks, =3DJeffH _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Tue Nov 29 13:33:44 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92A76129492 for ; Tue, 29 Nov 2016 13:33:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y-wFFlO0CsjC for ; Tue, 29 Nov 2016 13:33:41 -0800 (PST) Received: from mail-qt0-x22f.google.com (mail-qt0-x22f.google.com [IPv6:2607:f8b0:400d:c0d::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EA891293F9 for ; Tue, 29 Nov 2016 13:33:41 -0800 (PST) Received: by mail-qt0-x22f.google.com with SMTP id w33so169087668qtc.3 for ; Tue, 29 Nov 2016 13:33:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=E4KKTbY6bVBuCOPgTCvx8CxL/tSy1XalAg+VpCPYD2c=; b=p1meSblZognTU+Sbb17XCzTdd0jiIktDdKWq9BJm2pZopYNNAKp1FhtjgEf3d6jajN +IraryN3vTD6poqNZaozfxSGHjefAweIwMii7GTICfHauZw7cs75YiKvWHanMX15yiBO oCJiaY+Zd3DoTVbsgbmSu4voMNPlvjlgRq53SbjURYl6RgjfCpDucfjlU7+y4pyJlDxU RpebBw4ZveqaTYRnVRIf4zrXQMeVldLEQlr+HVXh09ut8EwsSMLlDeLT8vgpgl320FGf A5sMvX0rjlBVH1J7HE1pgef4Ai4Mw3FoOBoOI5FgCfDaLekw1+G1w2U2zMWf1ujkNzUv Mkew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=E4KKTbY6bVBuCOPgTCvx8CxL/tSy1XalAg+VpCPYD2c=; b=EWFl3ZgmnW+xJCnsqsC+6DBEcMGRxsmRtLB6WcDQciK/bJAkUpaQhuA0FjAJwfp1eV kICTSpiQBk6l1l38Q0sC3VPderN191qUAwkipYIKg+HAYjTX3wY4ttYgCOyRnE5x+Vn4 DsAVeyNFP2uupyVMpjtfQo/GnykMcQUZAmWqz2IR/UtA53jZQYqeaWMx/oPK2A36wn+i B94Fnh796cdP2WJwo5SiyC4zAlEEvdjPnS0K3Noefxs3eghT6RD0rrUVkamSObmDWMe9 mXKAtilp2cb4dreYlKlreidX6SbviWSVH/Ml/SMXaSM5ey9QkOctw3Z/iZwbwIvpiU1K YTig== X-Gm-Message-State: AKaTC01SHkIzci/1KtNXbI188I0tBt7USYuDbnjEuAX10y0dW+BofgAnD3NGiJgQxZnrQ9kdsCUvYgKW62n4ZZ4f X-Received: by 10.200.39.43 with SMTP id g40mr29626604qtg.58.1480455220593; Tue, 29 Nov 2016 13:33:40 -0800 (PST) MIME-Version: 1.0 Received: by 10.12.150.185 with HTTP; Tue, 29 Nov 2016 13:33:20 -0800 (PST) In-Reply-To: References: From: Nick Harper Date: Tue, 29 Nov 2016 13:33:20 -0800 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=001a1135b13887e52d05427757c7 Archived-At: Cc: IETF TokBind WG , =JeffH Subject: Re: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Nov 2016 21:33:43 -0000 --001a1135b13887e52d05427757c7 Content-Type: text/plain; charset=UTF-8 Yes, that's one way for a TokenBindingMessage to be split across the renegotiation boundary. There also isn't a one-to-one mapping from bytes in a TokenBindingMessage to (unencrypted) bytes in application_data records. E.g. an application protocol could have the TokenBindingMessage in something that's compressed, so the bytes necessary to form a TokenBindingMessage may be from various different application_data records, e.g. some bytes in a recent record which references a dictionary sent a while ago. When I refer to the TokenBindingMessage being split across a renegotiation boundary, I don't mean requiring that those underlying bytes not span the boundary (e.g. if the compressed TokenBindingMessage falls after the boundary, but references a dictionary before the boundary), but that the TokenBindingMessage from the perspective of the application semantics not span that boundary. I think Jeff's language has the same effect, in that if a TokenBindingMessage is split across the renegotiation boundary, then part of it falls after renegotiation, meaning that it has to use the post-renegotiation EKM, which isn't possible unless the whole TokenBindingMessage is post renegotiation. On Tue, Nov 29, 2016 at 12:34 PM, Andrei Popov wrote: > > and a mechanism > > preventing a TokenBindingMessage from being split across the > > renegotiation boundary. > > Nick refers to the fact that an application_data message can be > fragmented, with some fragments delivered before renegotiation and others > after renegotiation. > If one fragmented TB message is therefore sent both before and after a > renegotiation, it's not clear which EKM it's using (probably from before > the renegotiation, but then it's not the current one). > Nick's solution is to prohibit such splitting of TB messages across the > renegotiation boundary. > > (Nick please correct if I mis-represented). > > Cheers, > > Andrei > > ----Original Message----- > From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of =JeffH > Sent: Tuesday, November 29, 2016 12:18 PM > To: IETF TokBind WG > Subject: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag > > in > > we now have this 2nd parag after the list of bullet items.. > > > Specifications defining the use of Token Binding with various > > application protocols, such as Token Binding over HTTP > > [I-D.ietf-tokbind-https], may prohibit the use of TLS renegotiation > > in combination with Token Binding. Alternatively, such > > specifications need to define a way to determine which EKM value > > corresponds to a given TokenBindingMessage, and a mechanism > > preventing a TokenBindingMessage from being split across the > > renegotiation boundary. > > I am wondering about what the 2nd sentence above is saying, especially the > after the 2nd comma, and am curious whether the below is an equivalent (and > more clear) way to write it.. > > Alternatively, such > specifications need to define a way to determine which EKM value > corresponds to a given TokenBindingMessage, and a mechanism > ensuring that TokenBindingMessages sent after a renegotiation event > are signing the post-renegotiation EKM value. > > ..? > > thanks, > > =JeffH > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > --001a1135b13887e52d05427757c7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Yes, that's one way for a TokenBindingMessage to be sp= lit across the renegotiation boundary. There also isn't a one-to-one ma= pping from bytes in a TokenBindingMessage to (unencrypted) bytes in applica= tion_data records. E.g. an application protocol could have the TokenBinding= Message in something that's compressed, so the bytes necessary to form = a TokenBindingMessage may be from various different application_data record= s, e.g. some bytes in a recent record which references a dictionary sent a = while ago. When I refer to the TokenBindingMessage being split across a ren= egotiation boundary, I don't mean requiring that those underlying bytes= not span the boundary (e.g. if the compressed TokenBindingMessage falls af= ter the boundary, but references a dictionary before the boundary), but tha= t the TokenBindingMessage from the perspective of the application semantics= not span that boundary.

I think Jeff's language has= the same effect, in that if a TokenBindingMessage is split across the rene= gotiation boundary, then part of it falls after renegotiation, meaning that= it has to use the post-renegotiation EKM, which isn't possible unless = the whole TokenBindingMessage is post renegotiation.

On Tue, Nov 29, 2016 at 12:= 34 PM, Andrei Popov <Andrei.Popov@microsoft.com> wr= ote:
=C2=A0>=C2=A0 = =C2=A0and a mechanism
=C2=A0>=C2=A0 =C2=A0 preventing a TokenBindingMessage from being split a= cross the
=C2=A0>=C2=A0 =C2=A0 renegotiation boundary.

Nick refers to the fact that an application_data message can be frag= mented, with some fragments delivered before renegotiation and others after= renegotiation.
If one fragmented TB message is therefore sent both before and after a rene= gotiation, it's not clear which EKM it's using (probably from befor= e the renegotiation, but then it's not the current one).
Nick's solution is to prohibit such splitting of TB messages across the= renegotiation boundary.

(Nick please correct if I mis-represented).

Cheers,

Andrei

----Original Message-----
From: Unbearable [mailto:unb= earable-bounces@ietf.org] On Behalf Of =3DJeffH
Sent: Tuesday, November 29, 2016 12:18 PM
To: IETF TokBind WG <unbearable@i= etf.org>
Subject: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag
in
<https://tools.ietf.org/htm= l/draft-ietf-tokbind-protocol-11#section-3.3>
we now have this 2nd parag after the list of bullet items..

=C2=A0>=C2=A0 =C2=A0 Specifications defining the use of Token Binding wi= th various
=C2=A0>=C2=A0 =C2=A0 application protocols, such as Token Binding over H= TTP
=C2=A0>=C2=A0 =C2=A0 [I-D.ietf-tokbind-https], may prohibit the use of T= LS renegotiation
=C2=A0>=C2=A0 =C2=A0 in combination with Token Binding.=C2=A0 Alternativ= ely, such
=C2=A0>=C2=A0 =C2=A0 specifications need to define a way to determine wh= ich EKM value
=C2=A0>=C2=A0 =C2=A0 corresponds to a given TokenBindingMessage, and a m= echanism
=C2=A0>=C2=A0 =C2=A0 preventing a TokenBindingMessage from being split a= cross the
=C2=A0>=C2=A0 =C2=A0 renegotiation boundary.

I am wondering about what the 2nd sentence above is saying, especially the = after the 2nd comma, and am curious whether the below is an equivalent (and= more clear) way to write it..

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Al= ternatively, such
=C2=A0 =C2=A0 specifications need to define a way to determine which EKM va= lue
=C2=A0 =C2=A0 corresponds to a given TokenBindingMessage, and a mechanism =C2=A0 =C2=A0 ensuring that TokenBindingMessages sent after a renegotiation= event
=C2=A0 =C2=A0 are signing the post-renegotiation EKM value.

..?

thanks,

=3DJeffH

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e

--001a1135b13887e52d05427757c7-- From nobody Tue Nov 29 13:40:21 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0825129C94 for ; Tue, 29 Nov 2016 13:40:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Y_vaBdgtQiN for ; Tue, 29 Nov 2016 13:40:18 -0800 (PST) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0131.outbound.protection.outlook.com [104.47.40.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83D50129544 for ; Tue, 29 Nov 2016 13:40:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=dl9bKrEoz6l7HferF8wnhGN89KtdIejmd5A55XNf88o=; b=k6BiRp4aFS/vVasDjpyQT0QlS0GhjERMOeURWWbGyrP3Wodz80RDXZV+Iet/Vmma7lxy4lI3VeqM7kbRBaU+F9Vc4c2B54LpDAMWyORO4PkjYZkzNJtyCcPKJjVN+m0Kof4Rm7bjV8mNqdx9CdU7+1F7rDgtCan2Mtf2BAr3huo= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.649.16; Tue, 29 Nov 2016 21:40:17 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0649.027; Tue, 29 Nov 2016 21:40:17 +0000 From: Andrei Popov To: Nick Harper Thread-Topic: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag Thread-Index: AQHSSn7a7mdOp6sg7kWdo8atNZZnr6DwaR9AgAASSwCAAACdUA== Date: Tue, 29 Nov 2016 21:40:16 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0842; 7:UTv1mS20lvCn/TKbUaOEnC6KVTCW6hFC20SKPOA4pfCz8yx/mrsGjXu3WN/k4eM1YHwlmTh27EuV9G2C7W4NgYkIw7o/bTuuN4+fLqICih7XQC6+Cb+S8K1NSjhQAaHVKqpjtmpjMEWCBuGuqFuwTrdupB1rLCjgfiN67qEt8WGEsXaRU0+9Q9F0a4nZc+ZrKl20meqz0MTFXnTXpiEMgn0P/0q4WcKBJMzGijkrhe3wsd6Bb5BVREn6SYwWkBMTxojqspzFCrakgVZHiT47PCWgRxbgziQ+4gak4jjF+OEUkVzHQCtTm0GdMFLJn1e+Yu9+OHwXHAyFTCCns7KIr9ovyiK3Z9AyEy23DqXDZjddFKciaYruw02rrk/aUAOe x-ms-office365-filtering-correlation-id: a9ae4b83-48c0-42ec-e829-08d418a04f55 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0842; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(211936372134217)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123564025)(20161123560025)(20161123562025)(6047074)(6042181); SRVR:CY1PR0301MB0842; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0842; x-forefront-prvs: 01415BB535 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(13464003)(199003)(189002)(377454003)(24454002)(97736004)(76176999)(106356001)(10090500001)(8676002)(76576001)(8936002)(54356999)(9686002)(7696004)(68736007)(92566002)(2950100002)(5660300001)(105586002)(77096006)(101416001)(106116001)(102836003)(5005710100001)(99286002)(74316002)(2900100001)(6116002)(6916009)(81156014)(7736002)(790700001)(4326007)(81166006)(7846002)(2906002)(33656002)(6506003)(8990500004)(86362001)(606004)(229853002)(38730400001)(10290500002)(122556002)(50986999)(7906003)(3280700002)(3660700001)(189998001)(86612001)(110136003); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0842; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB08425DC178726518154BEE5A8C8D0CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Nov 2016 21:40:16.9384 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0842 Archived-At: Cc: IETF TokBind WG , =JeffH Subject: Re: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Nov 2016 21:40:20 -0000 --_000_CY1PR0301MB08425DC178726518154BEE5A8C8D0CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIEkgdGhpbmsgSmVmZidzIGxhbmd1YWdlIGhhcyB0aGUgc2FtZSBlZmZlY3QsIGluIHRoYXQg aWYgYSBUb2tlbkJpbmRpbmdNZXNzYWdlIGlzIHNwbGl0IGFjcm9zcyB0aGUgcmVuZWdvdGlhdGlv biBib3VuZGFyeSwgdGhlbiBwYXJ0IG9mIGl0IGZhbGxzIGFmdGVyIHJlbmVnb3RpYXRpb24sIG1l YW5pbmcgdGhhdCBpdCBoYXMgdG8gdXNlIHRoZSBwb3N0LXJlbmVnb3RpYXRpb24gRUtNLCB3aGlj aCBpc24ndCBwb3NzaWJsZSB1bmxlc3MgdGhlIHdob2xlIFRva2VuQmluZGluZ01lc3NhZ2UgaXMg cG9zdCByZW5lZ290aWF0aW9uLg0KSXQncyBwb3NzaWJsZSB0aGF0IEplZmbigJlzIGxhbmd1YWdl IGhhcyB0aGUgc2FtZSBlZmZlY3QsIGJ1dCBJIHN0aWxsIHByZWZlciB5b3VyIGxhbmd1YWdlLCBi ZWNhdXNlIGl0IHNlZW1zIHRvIHJlZmVyIHRvIHRoZSBpc3N1ZSBpbiBhIG1vcmUgZGlyZWN0IHdh eeKApg0KDQpGcm9tOiBOaWNrIEhhcnBlciBbbWFpbHRvOm5oYXJwZXJAZ29vZ2xlLmNvbV0NClNl bnQ6IFR1ZXNkYXksIE5vdmVtYmVyIDI5LCAyMDE2IDE6MzMgUE0NClRvOiBBbmRyZWkgUG9wb3Yg PEFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tPg0KQ2M6ID1KZWZmSCA8SmVmZi5Ib2RnZXNAa2lu Z3Ntb3VudGFpbi5jb20+OyBJRVRGIFRva0JpbmQgV0cgPHVuYmVhcmFibGVAaWV0Zi5vcmc+DQpT dWJqZWN0OiBSZTogW1VuYmVhcmFibGVdIFtUQlBST1RPXSBjbGFyaWZpY2F0aW9uIG9mIHJlbmVn byBhbmQgRUtNIDJuZCBwYXJhZw0KDQpZZXMsIHRoYXQncyBvbmUgd2F5IGZvciBhIFRva2VuQmlu ZGluZ01lc3NhZ2UgdG8gYmUgc3BsaXQgYWNyb3NzIHRoZSByZW5lZ290aWF0aW9uIGJvdW5kYXJ5 LiBUaGVyZSBhbHNvIGlzbid0IGEgb25lLXRvLW9uZSBtYXBwaW5nIGZyb20gYnl0ZXMgaW4gYSBU b2tlbkJpbmRpbmdNZXNzYWdlIHRvICh1bmVuY3J5cHRlZCkgYnl0ZXMgaW4gYXBwbGljYXRpb25f ZGF0YSByZWNvcmRzLiBFLmcuIGFuIGFwcGxpY2F0aW9uIHByb3RvY29sIGNvdWxkIGhhdmUgdGhl IFRva2VuQmluZGluZ01lc3NhZ2UgaW4gc29tZXRoaW5nIHRoYXQncyBjb21wcmVzc2VkLCBzbyB0 aGUgYnl0ZXMgbmVjZXNzYXJ5IHRvIGZvcm0gYSBUb2tlbkJpbmRpbmdNZXNzYWdlIG1heSBiZSBm cm9tIHZhcmlvdXMgZGlmZmVyZW50IGFwcGxpY2F0aW9uX2RhdGEgcmVjb3JkcywgZS5nLiBzb21l IGJ5dGVzIGluIGEgcmVjZW50IHJlY29yZCB3aGljaCByZWZlcmVuY2VzIGEgZGljdGlvbmFyeSBz ZW50IGEgd2hpbGUgYWdvLiBXaGVuIEkgcmVmZXIgdG8gdGhlIFRva2VuQmluZGluZ01lc3NhZ2Ug YmVpbmcgc3BsaXQgYWNyb3NzIGEgcmVuZWdvdGlhdGlvbiBib3VuZGFyeSwgSSBkb24ndCBtZWFu IHJlcXVpcmluZyB0aGF0IHRob3NlIHVuZGVybHlpbmcgYnl0ZXMgbm90IHNwYW4gdGhlIGJvdW5k YXJ5IChlLmcuIGlmIHRoZSBjb21wcmVzc2VkIFRva2VuQmluZGluZ01lc3NhZ2UgZmFsbHMgYWZ0 ZXIgdGhlIGJvdW5kYXJ5LCBidXQgcmVmZXJlbmNlcyBhIGRpY3Rpb25hcnkgYmVmb3JlIHRoZSBi b3VuZGFyeSksIGJ1dCB0aGF0IHRoZSBUb2tlbkJpbmRpbmdNZXNzYWdlIGZyb20gdGhlIHBlcnNw ZWN0aXZlIG9mIHRoZSBhcHBsaWNhdGlvbiBzZW1hbnRpY3Mgbm90IHNwYW4gdGhhdCBib3VuZGFy eS4NCg0KSSB0aGluayBKZWZmJ3MgbGFuZ3VhZ2UgaGFzIHRoZSBzYW1lIGVmZmVjdCwgaW4gdGhh dCBpZiBhIFRva2VuQmluZGluZ01lc3NhZ2UgaXMgc3BsaXQgYWNyb3NzIHRoZSByZW5lZ290aWF0 aW9uIGJvdW5kYXJ5LCB0aGVuIHBhcnQgb2YgaXQgZmFsbHMgYWZ0ZXIgcmVuZWdvdGlhdGlvbiwg bWVhbmluZyB0aGF0IGl0IGhhcyB0byB1c2UgdGhlIHBvc3QtcmVuZWdvdGlhdGlvbiBFS00sIHdo aWNoIGlzbid0IHBvc3NpYmxlIHVubGVzcyB0aGUgd2hvbGUgVG9rZW5CaW5kaW5nTWVzc2FnZSBp cyBwb3N0IHJlbmVnb3RpYXRpb24uDQoNCk9uIFR1ZSwgTm92IDI5LCAyMDE2IGF0IDEyOjM0IFBN LCBBbmRyZWkgUG9wb3YgPEFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tPG1haWx0bzpBbmRyZWku UG9wb3ZAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KID4gICBhbmQgYSBtZWNoYW5pc20NCiA+ICAg IHByZXZlbnRpbmcgYSBUb2tlbkJpbmRpbmdNZXNzYWdlIGZyb20gYmVpbmcgc3BsaXQgYWNyb3Nz IHRoZQ0KID4gICAgcmVuZWdvdGlhdGlvbiBib3VuZGFyeS4NCg0KTmljayByZWZlcnMgdG8gdGhl IGZhY3QgdGhhdCBhbiBhcHBsaWNhdGlvbl9kYXRhIG1lc3NhZ2UgY2FuIGJlIGZyYWdtZW50ZWQs IHdpdGggc29tZSBmcmFnbWVudHMgZGVsaXZlcmVkIGJlZm9yZSByZW5lZ290aWF0aW9uIGFuZCBv dGhlcnMgYWZ0ZXIgcmVuZWdvdGlhdGlvbi4NCklmIG9uZSBmcmFnbWVudGVkIFRCIG1lc3NhZ2Ug aXMgdGhlcmVmb3JlIHNlbnQgYm90aCBiZWZvcmUgYW5kIGFmdGVyIGEgcmVuZWdvdGlhdGlvbiwg aXQncyBub3QgY2xlYXIgd2hpY2ggRUtNIGl0J3MgdXNpbmcgKHByb2JhYmx5IGZyb20gYmVmb3Jl IHRoZSByZW5lZ290aWF0aW9uLCBidXQgdGhlbiBpdCdzIG5vdCB0aGUgY3VycmVudCBvbmUpLg0K TmljaydzIHNvbHV0aW9uIGlzIHRvIHByb2hpYml0IHN1Y2ggc3BsaXR0aW5nIG9mIFRCIG1lc3Nh Z2VzIGFjcm9zcyB0aGUgcmVuZWdvdGlhdGlvbiBib3VuZGFyeS4NCg0KKE5pY2sgcGxlYXNlIGNv cnJlY3QgaWYgSSBtaXMtcmVwcmVzZW50ZWQpLg0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQotLS0t T3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBVbmJlYXJhYmxlIFttYWlsdG86dW5iZWFyYWJs ZS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzp1bmJlYXJhYmxlLWJvdW5jZXNAaWV0Zi5vcmc+XSBP biBCZWhhbGYgT2YgPUplZmZIDQpTZW50OiBUdWVzZGF5LCBOb3ZlbWJlciAyOSwgMjAxNiAxMjox OCBQTQ0KVG86IElFVEYgVG9rQmluZCBXRyA8dW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86dW5i ZWFyYWJsZUBpZXRmLm9yZz4+DQpTdWJqZWN0OiBbVW5iZWFyYWJsZV0gW1RCUFJPVE9dIGNsYXJp ZmljYXRpb24gb2YgcmVuZWdvIGFuZCBFS00gMm5kIHBhcmFnDQoNCmluDQo8aHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1wcm90b2NvbC0xMSNzZWN0aW9uLTMu Mz4NCndlIG5vdyBoYXZlIHRoaXMgMm5kIHBhcmFnIGFmdGVyIHRoZSBsaXN0IG9mIGJ1bGxldCBp dGVtcy4uDQoNCiA+ICAgIFNwZWNpZmljYXRpb25zIGRlZmluaW5nIHRoZSB1c2Ugb2YgVG9rZW4g QmluZGluZyB3aXRoIHZhcmlvdXMNCiA+ICAgIGFwcGxpY2F0aW9uIHByb3RvY29scywgc3VjaCBh cyBUb2tlbiBCaW5kaW5nIG92ZXIgSFRUUA0KID4gICAgW0ktRC5pZXRmLXRva2JpbmQtaHR0cHNd LCBtYXkgcHJvaGliaXQgdGhlIHVzZSBvZiBUTFMgcmVuZWdvdGlhdGlvbg0KID4gICAgaW4gY29t YmluYXRpb24gd2l0aCBUb2tlbiBCaW5kaW5nLiAgQWx0ZXJuYXRpdmVseSwgc3VjaA0KID4gICAg c3BlY2lmaWNhdGlvbnMgbmVlZCB0byBkZWZpbmUgYSB3YXkgdG8gZGV0ZXJtaW5lIHdoaWNoIEVL TSB2YWx1ZQ0KID4gICAgY29ycmVzcG9uZHMgdG8gYSBnaXZlbiBUb2tlbkJpbmRpbmdNZXNzYWdl LCBhbmQgYSBtZWNoYW5pc20NCiA+ICAgIHByZXZlbnRpbmcgYSBUb2tlbkJpbmRpbmdNZXNzYWdl IGZyb20gYmVpbmcgc3BsaXQgYWNyb3NzIHRoZQ0KID4gICAgcmVuZWdvdGlhdGlvbiBib3VuZGFy eS4NCg0KSSBhbSB3b25kZXJpbmcgYWJvdXQgd2hhdCB0aGUgMm5kIHNlbnRlbmNlIGFib3ZlIGlz IHNheWluZywgZXNwZWNpYWxseSB0aGUgYWZ0ZXIgdGhlIDJuZCBjb21tYSwgYW5kIGFtIGN1cmlv dXMgd2hldGhlciB0aGUgYmVsb3cgaXMgYW4gZXF1aXZhbGVudCAoYW5kIG1vcmUgY2xlYXIpIHdh eSB0byB3cml0ZSBpdC4uDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgQWx0ZXJuYXRpdmVseSwgc3VjaA0KICAgIHNwZWNpZmljYXRpb25zIG5lZWQgdG8gZGVmaW5l IGEgd2F5IHRvIGRldGVybWluZSB3aGljaCBFS00gdmFsdWUNCiAgICBjb3JyZXNwb25kcyB0byBh IGdpdmVuIFRva2VuQmluZGluZ01lc3NhZ2UsIGFuZCBhIG1lY2hhbmlzbQ0KICAgIGVuc3VyaW5n IHRoYXQgVG9rZW5CaW5kaW5nTWVzc2FnZXMgc2VudCBhZnRlciBhIHJlbmVnb3RpYXRpb24gZXZl bnQNCiAgICBhcmUgc2lnbmluZyB0aGUgcG9zdC1yZW5lZ290aWF0aW9uIEVLTSB2YWx1ZS4NCg0K Li4/DQoNCnRoYW5rcywNCg0KPUplZmZIDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBp ZXRmLm9yZzxtYWlsdG86VW5iZWFyYWJsZUBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZQ0KDQo= --_000_CY1PR0301MB08425DC178726518154BEE5A8C8D0CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBl OnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNl Y3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAx LjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3Qg RGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjE2MzcxMDE3NDsNCgltc28t bGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE3MzQxNTAzMjIgLTIy Njc0MjE2MCA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5 ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0 YXJ0LWF0OjM7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7 fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0 IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGlu O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFn cmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+ PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OldpbmdkaW5ncyI+ PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAm cXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+ PCFbZW5kaWZdPkkgdGhpbmsgSmVmZidzIGxhbmd1YWdlIGhhcyB0aGUgc2FtZSBlZmZlY3QsIGlu IHRoYXQgaWYgYSBUb2tlbkJpbmRpbmdNZXNzYWdlIGlzIHNwbGl0IGFjcm9zcyB0aGUgcmVuZWdv dGlhdGlvbiBib3VuZGFyeSwgdGhlbiBwYXJ0IG9mIGl0IGZhbGxzIGFmdGVyIHJlbmVnb3RpYXRp b24sIG1lYW5pbmcgdGhhdCBpdCBoYXMgdG8gdXNlIHRoZSBwb3N0LXJlbmVnb3RpYXRpb24gRUtN LCB3aGljaA0KIGlzbid0IHBvc3NpYmxlIHVubGVzcyB0aGUgd2hvbGUgVG9rZW5CaW5kaW5nTWVz c2FnZSBpcyBwb3N0IHJlbmVnb3RpYXRpb24uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkl0J3MgcG9zc2libGUgdGhhdCBKZWZm4oCZcyBsYW5n dWFnZSBoYXMgdGhlIHNhbWUgZWZmZWN0LCBidXQgSSBzdGlsbCBwcmVmZXIgeW91ciBsYW5ndWFn ZSwgYmVjYXVzZSBpdCBzZWVtcyB0byByZWZlciB0byB0aGUgaXNzdWUgaW4gYSBtb3JlIGRpcmVj dCB3YXnigKY8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+IE5pY2sgSGFycGVyIFttYWlsdG86bmhhcnBlckBnb29nbGUuY29tXQ0KPGJyPg0KPGI+U2Vu dDo8L2I+IFR1ZXNkYXksIE5vdmVtYmVyIDI5LCAyMDE2IDE6MzMgUE08YnI+DQo8Yj5Ubzo8L2I+ IEFuZHJlaSBQb3BvdiAmbHQ7QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb20mZ3Q7PGJyPg0KPGI+ Q2M6PC9iPiA9SmVmZkggJmx0O0plZmYuSG9kZ2VzQGtpbmdzbW91bnRhaW4uY29tJmd0OzsgSUVU RiBUb2tCaW5kIFdHICZsdDt1bmJlYXJhYmxlQGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6 PC9iPiBSZTogW1VuYmVhcmFibGVdIFtUQlBST1RPXSBjbGFyaWZpY2F0aW9uIG9mIHJlbmVnbyBh bmQgRUtNIDJuZCBwYXJhZzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlll cywgdGhhdCdzIG9uZSB3YXkgZm9yIGEgVG9rZW5CaW5kaW5nTWVzc2FnZSB0byBiZSBzcGxpdCBh Y3Jvc3MgdGhlIHJlbmVnb3RpYXRpb24gYm91bmRhcnkuIFRoZXJlIGFsc28gaXNuJ3QgYSBvbmUt dG8tb25lIG1hcHBpbmcgZnJvbSBieXRlcyBpbiBhIFRva2VuQmluZGluZ01lc3NhZ2UgdG8gKHVu ZW5jcnlwdGVkKSBieXRlcyBpbiBhcHBsaWNhdGlvbl9kYXRhIHJlY29yZHMuIEUuZy4gYW4gYXBw bGljYXRpb24NCiBwcm90b2NvbCBjb3VsZCBoYXZlIHRoZSBUb2tlbkJpbmRpbmdNZXNzYWdlIGlu IHNvbWV0aGluZyB0aGF0J3MgY29tcHJlc3NlZCwgc28gdGhlIGJ5dGVzIG5lY2Vzc2FyeSB0byBm b3JtIGEgVG9rZW5CaW5kaW5nTWVzc2FnZSBtYXkgYmUgZnJvbSB2YXJpb3VzIGRpZmZlcmVudCBh cHBsaWNhdGlvbl9kYXRhIHJlY29yZHMsIGUuZy4gc29tZSBieXRlcyBpbiBhIHJlY2VudCByZWNv cmQgd2hpY2ggcmVmZXJlbmNlcyBhIGRpY3Rpb25hcnkgc2VudCBhDQogd2hpbGUgYWdvLiBXaGVu IEkgcmVmZXIgdG8gdGhlIFRva2VuQmluZGluZ01lc3NhZ2UgYmVpbmcgc3BsaXQgYWNyb3NzIGEg cmVuZWdvdGlhdGlvbiBib3VuZGFyeSwgSSBkb24ndCBtZWFuIHJlcXVpcmluZyB0aGF0IHRob3Nl IHVuZGVybHlpbmcgYnl0ZXMgbm90IHNwYW4gdGhlIGJvdW5kYXJ5IChlLmcuIGlmIHRoZSBjb21w cmVzc2VkIFRva2VuQmluZGluZ01lc3NhZ2UgZmFsbHMgYWZ0ZXIgdGhlIGJvdW5kYXJ5LCBidXQg cmVmZXJlbmNlcyBhDQogZGljdGlvbmFyeSBiZWZvcmUgdGhlIGJvdW5kYXJ5KSwgYnV0IHRoYXQg dGhlIFRva2VuQmluZGluZ01lc3NhZ2UgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2YgdGhlIGFwcGxp Y2F0aW9uIHNlbWFudGljcyBub3Qgc3BhbiB0aGF0IGJvdW5kYXJ5LjxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB0aGluayBKZWZmJ3MgbGFuZ3VhZ2UgaGFz IHRoZSBzYW1lIGVmZmVjdCwgaW4gdGhhdCBpZiBhIFRva2VuQmluZGluZ01lc3NhZ2UgaXMgc3Bs aXQgYWNyb3NzIHRoZSByZW5lZ290aWF0aW9uIGJvdW5kYXJ5LCB0aGVuIHBhcnQgb2YgaXQgZmFs bHMgYWZ0ZXIgcmVuZWdvdGlhdGlvbiwgbWVhbmluZyB0aGF0IGl0IGhhcyB0byB1c2UgdGhlIHBv c3QtcmVuZWdvdGlhdGlvbiBFS00sIHdoaWNoIGlzbid0IHBvc3NpYmxlDQogdW5sZXNzIHRoZSB3 aG9sZSBUb2tlbkJpbmRpbmdNZXNzYWdlIGlzIHBvc3QgcmVuZWdvdGlhdGlvbi48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBOb3Yg MjksIDIwMTYgYXQgMTI6MzQgUE0sIEFuZHJlaSBQb3BvdiAmbHQ7PGEgaHJlZj0ibWFpbHRvOkFu ZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+QW5kcmVpLlBvcG92QG1p Y3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmZ3Q7Jm5ic3A7ICZuYnNwO2FuZCBhIG1lY2hhbmlz bTxicj4NCiZuYnNwOyZndDsmbmJzcDsgJm5ic3A7IHByZXZlbnRpbmcgYSBUb2tlbkJpbmRpbmdN ZXNzYWdlIGZyb20gYmVpbmcgc3BsaXQgYWNyb3NzIHRoZTxicj4NCiZuYnNwOyZndDsmbmJzcDsg Jm5ic3A7IHJlbmVnb3RpYXRpb24gYm91bmRhcnkuPGJyPg0KPGJyPg0KTmljayByZWZlcnMgdG8g dGhlIGZhY3QgdGhhdCBhbiBhcHBsaWNhdGlvbl9kYXRhIG1lc3NhZ2UgY2FuIGJlIGZyYWdtZW50 ZWQsIHdpdGggc29tZSBmcmFnbWVudHMgZGVsaXZlcmVkIGJlZm9yZSByZW5lZ290aWF0aW9uIGFu ZCBvdGhlcnMgYWZ0ZXIgcmVuZWdvdGlhdGlvbi48YnI+DQpJZiBvbmUgZnJhZ21lbnRlZCBUQiBt ZXNzYWdlIGlzIHRoZXJlZm9yZSBzZW50IGJvdGggYmVmb3JlIGFuZCBhZnRlciBhIHJlbmVnb3Rp YXRpb24sIGl0J3Mgbm90IGNsZWFyIHdoaWNoIEVLTSBpdCdzIHVzaW5nIChwcm9iYWJseSBmcm9t IGJlZm9yZSB0aGUgcmVuZWdvdGlhdGlvbiwgYnV0IHRoZW4gaXQncyBub3QgdGhlIGN1cnJlbnQg b25lKS48YnI+DQpOaWNrJ3Mgc29sdXRpb24gaXMgdG8gcHJvaGliaXQgc3VjaCBzcGxpdHRpbmcg b2YgVEIgbWVzc2FnZXMgYWNyb3NzIHRoZSByZW5lZ290aWF0aW9uIGJvdW5kYXJ5Ljxicj4NCjxi cj4NCihOaWNrIHBsZWFzZSBjb3JyZWN0IGlmIEkgbWlzLXJlcHJlc2VudGVkKS48YnI+DQo8YnI+ DQpDaGVlcnMsPGJyPg0KPGJyPg0KQW5kcmVpPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCi0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS08YnI+ DQpGcm9tOiBVbmJlYXJhYmxlIFttYWlsdG86PGEgaHJlZj0ibWFpbHRvOnVuYmVhcmFibGUtYm91 bmNlc0BpZXRmLm9yZyI+dW5iZWFyYWJsZS1ib3VuY2VzQGlldGYub3JnPC9hPl0gT24gQmVoYWxm IE9mID1KZWZmSDxicj4NClNlbnQ6IFR1ZXNkYXksIE5vdmVtYmVyIDI5LCAyMDE2IDEyOjE4IFBN PGJyPg0KVG86IElFVEYgVG9rQmluZCBXRyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnVuYmVhcmFibGVA aWV0Zi5vcmciPnVuYmVhcmFibGVAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NClN1YmplY3Q6IFtVbmJl YXJhYmxlXSBbVEJQUk9UT10gY2xhcmlmaWNhdGlvbiBvZiByZW5lZ28gYW5kIEVLTSAybmQgcGFy YWc8YnI+DQo8YnI+DQppbjxicj4NCiZsdDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLXByb3RvY29sLTExI3NlY3Rpb24tMy4zIiB0YXJnZXQ9 Il9ibGFuayI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1w cm90b2NvbC0xMSNzZWN0aW9uLTMuMzwvYT4mZ3Q7PGJyPg0Kd2Ugbm93IGhhdmUgdGhpcyAybmQg cGFyYWcgYWZ0ZXIgdGhlIGxpc3Qgb2YgYnVsbGV0IGl0ZW1zLi48YnI+DQo8YnI+DQombmJzcDsm Z3Q7Jm5ic3A7ICZuYnNwOyBTcGVjaWZpY2F0aW9ucyBkZWZpbmluZyB0aGUgdXNlIG9mIFRva2Vu IEJpbmRpbmcgd2l0aCB2YXJpb3VzPGJyPg0KJm5ic3A7Jmd0OyZuYnNwOyAmbmJzcDsgYXBwbGlj YXRpb24gcHJvdG9jb2xzLCBzdWNoIGFzIFRva2VuIEJpbmRpbmcgb3ZlciBIVFRQPGJyPg0KJm5i c3A7Jmd0OyZuYnNwOyAmbmJzcDsgW0ktRC5pZXRmLXRva2JpbmQtaHR0cHNdLCBtYXkgcHJvaGli aXQgdGhlIHVzZSBvZiBUTFMgcmVuZWdvdGlhdGlvbjxicj4NCiZuYnNwOyZndDsmbmJzcDsgJm5i c3A7IGluIGNvbWJpbmF0aW9uIHdpdGggVG9rZW4gQmluZGluZy4mbmJzcDsgQWx0ZXJuYXRpdmVs eSwgc3VjaDxicj4NCiZuYnNwOyZndDsmbmJzcDsgJm5ic3A7IHNwZWNpZmljYXRpb25zIG5lZWQg dG8gZGVmaW5lIGEgd2F5IHRvIGRldGVybWluZSB3aGljaCBFS00gdmFsdWU8YnI+DQombmJzcDsm Z3Q7Jm5ic3A7ICZuYnNwOyBjb3JyZXNwb25kcyB0byBhIGdpdmVuIFRva2VuQmluZGluZ01lc3Nh Z2UsIGFuZCBhIG1lY2hhbmlzbTxicj4NCiZuYnNwOyZndDsmbmJzcDsgJm5ic3A7IHByZXZlbnRp bmcgYSBUb2tlbkJpbmRpbmdNZXNzYWdlIGZyb20gYmVpbmcgc3BsaXQgYWNyb3NzIHRoZTxicj4N CiZuYnNwOyZndDsmbmJzcDsgJm5ic3A7IHJlbmVnb3RpYXRpb24gYm91bmRhcnkuPGJyPg0KPGJy Pg0KSSBhbSB3b25kZXJpbmcgYWJvdXQgd2hhdCB0aGUgMm5kIHNlbnRlbmNlIGFib3ZlIGlzIHNh eWluZywgZXNwZWNpYWxseSB0aGUgYWZ0ZXIgdGhlIDJuZCBjb21tYSwgYW5kIGFtIGN1cmlvdXMg d2hldGhlciB0aGUgYmVsb3cgaXMgYW4gZXF1aXZhbGVudCAoYW5kIG1vcmUgY2xlYXIpIHdheSB0 byB3cml0ZSBpdC4uPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtB bHRlcm5hdGl2ZWx5LCBzdWNoPGJyPg0KJm5ic3A7ICZuYnNwOyBzcGVjaWZpY2F0aW9ucyBuZWVk IHRvIGRlZmluZSBhIHdheSB0byBkZXRlcm1pbmUgd2hpY2ggRUtNIHZhbHVlPGJyPg0KJm5ic3A7 ICZuYnNwOyBjb3JyZXNwb25kcyB0byBhIGdpdmVuIFRva2VuQmluZGluZ01lc3NhZ2UsIGFuZCBh IG1lY2hhbmlzbTxicj4NCiZuYnNwOyAmbmJzcDsgZW5zdXJpbmcgdGhhdCBUb2tlbkJpbmRpbmdN ZXNzYWdlcyBzZW50IGFmdGVyIGEgcmVuZWdvdGlhdGlvbiBldmVudDxicj4NCiZuYnNwOyAmbmJz cDsgYXJlIHNpZ25pbmcgdGhlIHBvc3QtcmVuZWdvdGlhdGlvbiBFS00gdmFsdWUuPGJyPg0KPGJy Pg0KLi4/PGJyPg0KPGJyPg0KdGhhbmtzLDxicj4NCjxicj4NCj1KZWZmSDxicj4NCjxicj4NCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KVW5iZWFy YWJsZSBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86VW5iZWFyYWJsZUBpZXRmLm9y ZyI+VW5iZWFyYWJsZUBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGU8L2E+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8 L2h0bWw+DQo= --_000_CY1PR0301MB08425DC178726518154BEE5A8C8D0CY1PR0301MB0842_-- From nobody Tue Nov 29 14:18:18 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AEF831294FD for ; Tue, 29 Nov 2016 14:18:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6CujKyKmgUCb for ; Tue, 29 Nov 2016 14:18:14 -0800 (PST) Received: from gproxy10-pub.mail.unifiedlayer.com (gproxy10-pub.mail.unifiedlayer.com [69.89.20.226]) by ietfa.amsl.com (Postfix) with SMTP id 56BDC129C9A for ; Tue, 29 Nov 2016 14:18:13 -0800 (PST) Received: (qmail 7717 invoked by uid 0); 29 Nov 2016 22:18:07 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by gproxy10.mail.unifiedlayer.com with SMTP; 29 Nov 2016 22:18:07 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by CMOut01 with id DyJ11u01j2UhLwi01yJ4zw; Tue, 29 Nov 2016 15:18:06 -0700 X-Authority-Analysis: v=2.1 cv=E8Je+8tl c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=L24OOQBejmoA:10 a=48vgC7mUAAAA:8 a=NEAV23lmAAAA:8 a=gGMEuCISn2TgvE7MQo0A:9 a=FhNRPtM6GZmms9hS:21 a=9wAamYyGXPkzV5-a:21 a=QEXdDO2ut3YA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from [173.224.162.79] (port=5481 helo=[192.168.93.253]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cBqix-0003qJ-D3 for unbearable@ietf.org; Tue, 29 Nov 2016 15:18:03 -0700 To: IETF TokBind WG From: =JeffH Message-ID: Date: Tue, 29 Nov 2016 14:18:02 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.79 X-Exim-ID: 1cBqix-0003qJ-D3 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.93.253]) [173.224.162.79]:5481 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] Draft minutes - errors are my own X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Nov 2016 22:18:17 -0000 fyi/fwiw, I went thru Martin's most excellent minutes and noticed a few things from my notes to add/clarify.. > IETF97 tokbind [ minutes by Martin Thomson ] > > Andrei - core drafts > > Martin Thomson - RI is needed - Karthik Bhargavan pointed out an > attack: > > > Nick Harper - RI is easy to implement > > Martin - base64url is defined in RFC7515 > > > > Renegotiation see slides 9 and 10 > > Martin - if you do this, then unless you have some constraints, > there are always error cases. It's unlikely, but we need to > deal with those cases somehow. > > Nick - suggest using a profile - you can only use renego under > certain conditions if you also use tokbind. For instance, h1 > is the only place we can use this and you have to freeze the > connection there. > > Martin - we should not use the original EKM > > Nick - tbproto should prohibit renegotiation unless the profile > describes how it works. h1 mapping describes how we interleave > renegotiation with the rest of the protocol. > > JeffH/DirkB - sounds good > > JeffH - propose that we WGLC now and treat these last few issues > as LC comments > > Chairs - WGLC starts after this session > > > Brian Campbell - on 0-RTT review there was a comment - are we OK > with a fixed length EKM > > Andrei - wants a TLS unique > > Brian - what if we need a new algorithm that uses a longer key, > is that OK to use with 32 bytes? > > Martin - not a cryptographer, but my understanding is that 32 is > enough (similar enough to other cases), 32 bytes needs to be an > absolute minimum. Might want to allow a bit of flexibility. > > > Subodh Iyengar - do we have a strategy to manage key type rollover? > > Andrei - once in a few years, asking for users to re-type their > password (or otherwise reauthenticate), is hard > > Martin - concerned about complexity > > Andrei - proponents could write an internet draft and we could > evaluate it > > Dirk - sort of agree about complexity, we might want to think about > migration > > Brian - forcing a login happens naturally anyway > > Nick - if the preference for key type doesn't change consistently > across a fleet of servers, that reauthentication might be forced > multiple times > > JeffH - what about github issues ? > > Chairs - if it isn't on the list, it doesn't exist, please bring > github issues to the list > > Brian - even on the list, issues get ignored > > > Brian - OAuth clients don't have explicit signaling about being able > to reveal the referred token binding. If the client is > pre-configured to use referred information, then it shouldn't need > explicit signaling; there is already an understanding that the > client wants to do this. > > Andrei - discussed in OAuth, we (inc. Dirk) agreed that this is a > change we wanted > > Brian - will generate a PR > > Nick - explicit signal OR pre-arrangement is OK > > John Bradley - Fetch JS doesn't really have an explicit signal > either, so we have to avoid making the language too restrictive > > Vinod Anupam - The current plan is that the javascript will make the > decision > > Martin - You have three parties involved > > John - the origin that owns the referred token, the target of the > request, and the origin of the javascript > > Dirk - the JS cannot talk about token bindings for other origins, if > it requests a referred binding, it is its own origin > > John - that kills a bunch of use cases; which might be OK for > security reasons > > Dirk - the boolean in fetch doesn't allow you to identify another > origin for referral > > Andrei - to do anything else would allow sites to scrape the browser > for tokens; we need this restriction from a security perspective > > Ben Kaduk - we have to have a signal from the owner of the token to > allow this > > JeffH - the fetch() PR is still open, participate the fetch() PR is still open, can still participate Update Fetch to support Token Binding. #325 https://github.com/whatwg/fetch/pull/325 > Martin - Another CORS header is probably unwise, particularly since > that would allow any resource on any of the eTLD+1 origins to > "release" the token identity > > > 0-RTT slides: > Martin - 0-RTT exporters has different properties to other exporters > > Martin - What about replays of stuff that got rejected? > > Nick - Header fields will have to be overridden on retry. That > doesn'thappen in current implementations (not that there are > many). > > Martin - We don't need the anti-replay indicator extension, or if we > do, then we would benefit from having this generically. > > Andrei - Basing exporter keys on 0-RTT makes the token binding keys > replayable. There are mitigations, and it might be useful for the > client to know. > > Martin - If we have that capability, we should build it generically. > > Nick - we might only have replay protection for token binding stuff, > but maybe the granularity isn't needed > > Kyle Nektritz - Replay only exists for the specific 0-RTT data that > included the token binding. > > Ben - a combination of ticket age with other 0-RTT mitigations makes > those other mitigations much easier to deploy > > Martin - Can we agree not to use 0-RTT exporters for long? > > Nick - Has an alternative that latches > > Martin - Does that require trial-verification? What about defining > new types for early exporter stuff? MT: we need to complete discussion of 'early exporter' (so dont want to use that in TB at this time) suggests including "early" or "late" signal in keyparams types > Subodh - how do you decide to latch? What about an HTTP/2 message > for it? subodh: in h2 probably need a latch frame that says we're now non-0-RTT > Dirk - Meta: we should take on this work, and there are concerns we > can resolve if we do adopt. > > Chairs - hum to adopt > > DECISION - adopt as a WG draft i.e.: > JeffH - can we proceed with existing docs before finishing this? Do > we say anything about zero-RTT? > > Nick - Maybe we don't need to worry if we don't reference TLS 1.3. > We can pretend that TLS 1.3 doesn't exist. > > Leif - Maybe we won't have 1.3 mentioned. > > JeffH - the spec doesn't explicitly say 1.2 right now. but in any case, this I-D is tls13 specific so does not affect present spec set > Martin - early exporters are very different to exporters, maybe we > can say that in the document, maybe more so if we end up referring > to TLS 1.3, but we don't have to because exporter != early exporter > > Chairs - please create a PR for us (no stuckee identified) > > > TLS Termination > Andrei - if the terminator is parsing and verifying, then it should > pass the identifiers > > Brian - what about referred? > > Andrei - an array > > Martin - Prefer passing the EKM Martin - Prefer passing the EKM - it puts the onus on the web app i.e. option #2 in slides. > Brian - hard to deal with killing the connection Brian - there's more info that needs to goto web app, so more difficult to do option 2 correctly -- also tbproto sez u drop connection in certain cases but web app doesn't own tls connection in this scenario > Martin - that's a bad requirement ;) Martin - if the TB is bad, want to drop the present spec requirement to drop the connection > Action: create PR for dropping the connection you can use these > architectures > > Subodh - what about pure TLS terminators that proxy at the TCP layer? > > Brian - I don't know... > > Subodh - hard to account for pure TLS terminators > > Subodh - if we have a PR to drop the connection drop requirement, we > should talk about status codes subdoh added: we need to document which http status code is used to convey to the app -- see RFC 7239 -- that is about doing these sort of things, but folks have privacy issues with the latter spec, so need to keep that in mind > > Chairs - adopt? > > DECISION - consensus to work on the problem i.e. for someone(s) to write an I-D for this > Tony Nadalin - if we adopt this, nothing will be slowed > > Chairs - yes, as long as we change the connection-closing language > > Martin - wanted to propose RFC 7239 as a candidate > > Brian - looking for guidance on TCP layer termination > > Subodh - maybe you can talk about that as being a problem; most of > these are moved into an out-of-band channel Dirk -- open source impl of token binding github.com/google/token_bind can put nginx proxy in front of your http server and it can add tb to cookie nginx proxy: /nginx_token_bind chrome 56 has latest version of TB in it --- end From nobody Tue Nov 29 14:55:30 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E47FE129CCB for ; Tue, 29 Nov 2016 14:55:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VdrqmLH1tGgD for ; Tue, 29 Nov 2016 14:55:27 -0800 (PST) Received: from gproxy4-pub.mail.unifiedlayer.com (gproxy4-pub.mail.unifiedlayer.com [69.89.23.142]) by ietfa.amsl.com (Postfix) with SMTP id 67A6B129CAF for ; Tue, 29 Nov 2016 14:55:27 -0800 (PST) Received: (qmail 2051 invoked by uid 0); 29 Nov 2016 22:55:25 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy4.mail.unifiedlayer.com with SMTP; 29 Nov 2016 22:55:25 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id DyvK1u00c2UhLwi01yvNsW; Tue, 29 Nov 2016 15:55:23 -0700 X-Authority-Analysis: v=2.1 cv=YNIMl32x c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=L24OOQBejmoA:10 a=48vgC7mUAAAA:8 a=NEAV23lmAAAA:8 a=VDMNOJxZGI3kKQyXwzwA:9 a=QEXdDO2ut3YA:10 a=bcCEKtPz9fYA:10 a=gmDBqFSbs50A:10 a=w1C3t2QeGrPiZgrLijVG:22 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from [173.224.162.79] (port=20786 helo=[192.168.93.253]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cBrJ3-0005f4-Ey for unbearable@ietf.org; Tue, 29 Nov 2016 15:55:21 -0700 To: IETF TokBind WG From: =JeffH Message-ID: Date: Tue, 29 Nov 2016 14:55:17 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.79 X-Exim-ID: 1cBrJ3-0005f4-Ey X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.93.253]) [173.224.162.79]:20786 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 2 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Nov 2016 22:55:29 -0000 > > and a mechanism > > preventing a TokenBindingMessage from being split across the > > renegotiation boundary. > > Nick refers... ah yes, this stuff is in that long "Renegotiation info extension" thread (and associated threads) on the list it seems. here's a relevant msg from nick (nharper) from that thread... ..though I do not find on the list where Nick discussed the below wrt the the possibility of the TB message (which is included in an app-layer msg, which is conveyed in a TLS application_data msg) being "split" across a renego boundary. > to the fact that an application_data message can be > fragmented, with some fragments delivered before renegotiation and > others after renegotiation. If one fragmented TB message is therefore > sent both before and after a renegotiation, it's not clear which EKM > it's using (probably from before the renegotiation, but then it's not > the current one). Nick's solution is to prohibit such splitting of TB > messages across the renegotiation boundary. though, the language he apparently proposed for both HTTPSTB and TBPROTO is here.. https://github.com/TokenBinding/Internet-Drafts/commit/99e6b49392b417cd23c5341fd57f720e5e2575ee ..however the explanation above is more understandable due to including some details. =JeffH From nobody Tue Nov 29 14:59:25 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11A11129CCA for ; Tue, 29 Nov 2016 14:59:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DPvdiO8AV_qv for ; Tue, 29 Nov 2016 14:59:22 -0800 (PST) Received: from gproxy10-pub.mail.unifiedlayer.com (gproxy10-pub.mail.unifiedlayer.com [69.89.20.226]) by ietfa.amsl.com (Postfix) with SMTP id B7E0C129CCB for ; Tue, 29 Nov 2016 14:59:02 -0800 (PST) Received: (qmail 20484 invoked by uid 0); 29 Nov 2016 22:59:02 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by gproxy10.mail.unifiedlayer.com with SMTP; 29 Nov 2016 22:59:02 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw4 with id Dyyy1u00r2UhLwi01yz1dC; Tue, 29 Nov 2016 15:59:02 -0700 X-Authority-Analysis: v=2.1 cv=Zpp+dbLG c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=L24OOQBejmoA:10 a=xMRMcpxmuWJyHVKVYasA:9 a=0HLf66FjzE4eR050:21 a=yw-xKxRdQ_zYD3LL:21 a=QEXdDO2ut3YA:10 Received: from [173.224.162.79] (port=33356 helo=[192.168.93.253]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cBrMY-0007Bw-JS for unbearable@ietf.org; Tue, 29 Nov 2016 15:58:58 -0700 To: IETF TokBind WG From: =JeffH Message-ID: Date: Tue, 29 Nov 2016 14:58:55 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.79 X-Exim-ID: 1cBrMY-0007Bw-JS X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.93.253]) [173.224.162.79]:33356 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 3 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Nov 2016 22:59:23 -0000 Dear tokbind co-chairs, > This starts a working group last call for the following documents: > > draft-ietf-tokbind-https-06 > draft-ietf-tokbind-negotiation-05 > draft-ietf-tokbind-protocol-10 > > Any comments should be send to the list before EOB November 30th Ok, I have some modest editorial comments/polishing I'm trying to get done, but the 2 week WGLC is sorta short given us american's feast of thanksgiving last week and various end-of-year corporate must-dos. I'll get my comments in by the end of this week, I trust that'll be ok. thanks, =JeffH From nobody Tue Nov 29 16:14:52 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5F3F129485 for ; Tue, 29 Nov 2016 16:14:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ui7euqrTJNyQ for ; Tue, 29 Nov 2016 16:14:51 -0800 (PST) Received: from gproxy7-pub.mail.unifiedlayer.com (gproxy7-pub.mail.unifiedlayer.com [70.40.196.235]) by ietfa.amsl.com (Postfix) with SMTP id 1597B129474 for ; Tue, 29 Nov 2016 16:14:51 -0800 (PST) Received: (qmail 29634 invoked by uid 0); 30 Nov 2016 00:14:49 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by gproxy7.mail.unifiedlayer.com with SMTP; 30 Nov 2016 00:14:49 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by CMOut01 with id E0Ek1u0142UhLwi010En5r; Tue, 29 Nov 2016 17:14:47 -0700 X-Authority-Analysis: v=2.1 cv=E8Je+8tl c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=L24OOQBejmoA:10 a=0xy9bg8NCoRDSxNeRngA:9 a=QEXdDO2ut3YA:10 Received: from [173.224.162.79] (port=50911 helo=[192.168.93.253]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cBsXu-0006HV-Eb for unbearable@ietf.org; Tue, 29 Nov 2016 17:14:46 -0700 From: =JeffH To: IETF TokBind WG Message-ID: <407633e5-aaf0-779c-a902-22697c4a1709@KingsMountain.com> Date: Tue, 29 Nov 2016 16:14:45 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.79 X-Exim-ID: 1cBsXu-0006HV-Eb X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.93.253]) [173.224.162.79]:50911 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] [TBPROTO] clarification of renego and EKM 2nd parag X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2016 00:14:52 -0000 Oh, and because DMARC and (ietf) mailing lists do not play well together, I didn't see the last couple replies to this thread from Nick and Andrei until just now (after I'd sent my reply prior to this one). fyi/fwiw... =JeffH From nobody Wed Nov 30 11:46:49 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AB1B1299CC for ; Wed, 30 Nov 2016 11:46:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.69 X-Spam-Level: X-Spam-Status: No, score=-2.69 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dnNi6pGgeiTQ for ; Wed, 30 Nov 2016 11:46:45 -0800 (PST) Received: from mail-io0-x235.google.com (mail-io0-x235.google.com [IPv6:2607:f8b0:4001:c06::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F7E21299BE for ; Wed, 30 Nov 2016 11:46:22 -0800 (PST) Received: by mail-io0-x235.google.com with SMTP id c21so344702937ioj.1 for ; Wed, 30 Nov 2016 11:46:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=8e3UJfBbFGl1y4KUCW2Y4dkA7CfOAf6q7im/AefQHLU=; b=pY939Pgj8GLj6TD8bQXSBnXbDbsxcBST/he/Onqs0crTbPgOF3K5XkP15XFWgEy5+p hPrho+I6v0Duf1AvBmO6bA4uoTwz8MoUtRZK23oHD4RCIehaemnOdjNKAK9ezzjjGcNU X2N97l2iCVT44YLuCefrvYW0Q4EeCTf1x5dzs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=8e3UJfBbFGl1y4KUCW2Y4dkA7CfOAf6q7im/AefQHLU=; b=R+Yfe8lPthzJ9hcpfDS/ItyUTnbTfOGCPbXx/RxZIyWnKioW0Bj4+K+r+sx6G0TqM9 LjhgA11qz/bbJvLhr0M9wYnr+B1G6qEAliAoJ6xLiLjQYgzDhqWDcrjmLt5ZicEAOUmf 8yG6na1TAW2On/tKVCfovH4TiZgBolJlyflrFzg+lhKYFp7iYN7UnhIyUPIyxVzt8jS8 M5Vhq+tHrcethhlxy7HjPoFJG1kk13SLkpP+pxf2qCP5IR/e84TC29j0vXpaKcUHENUc IdOCYmuacHoGR3Uyx5xkuGGxrcC24WeVxejc5VJUBNJAQcFT6u1AUzCdSNSAHZaPfQvL vm9A== X-Gm-Message-State: AKaTC02y0WU3mROmSRjmRpilubcWHCrErUyBculUI0jmP43GMtjEiogswpj5H4r3KL5QnNsxeQojSqOXBiwBFZWa X-Received: by 10.107.201.86 with SMTP id z83mr30173898iof.156.1480535179739; Wed, 30 Nov 2016 11:46:19 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.208.118 with HTTP; Wed, 30 Nov 2016 11:45:49 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Wed, 30 Nov 2016 12:45:49 -0700 Message-ID: To: "=JeffH" Content-Type: multipart/alternative; boundary=94eb2c0b92ac7793d7054289f541 Archived-At: Cc: IETF TokBind WG Subject: Re: [Unbearable] WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2016 19:46:47 -0000 --94eb2c0b92ac7793d7054289f541 Content-Type: text/plain; charset=UTF-8 Jeff makes a good point here that starting WGLC during the meeting and Thanksgiving for many people right after that likely means many won't have a chance to do a review for WGLC (I'm just returning from family vacation myself on top of it). Given all that and the somewhat recent publication of new revisions of the drafts, might it make sense to extend the WGLC period? On Tue, Nov 29, 2016 at 3:58 PM, =JeffH wrote: > Dear tokbind co-chairs, > > > This starts a working group last call for the following documents: > > > > draft-ietf-tokbind-https-06 > > draft-ietf-tokbind-negotiation-05 > > draft-ietf-tokbind-protocol-10 > > > > Any comments should be send to the list before EOB November 30th > > > Ok, I have some modest editorial comments/polishing I'm trying to get > done, but the 2 week WGLC is sorta short given us american's feast of > thanksgiving last week and various end-of-year corporate must-dos. I'll get > my comments in by the end of this week, I trust that'll be ok. > > thanks, > > =JeffH > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > -- [image: Ping Identity] Brian Campbell Distinguished Engineer bcampbell@pingidentity.com w: +1 720.317.2061 c: +1 303.918.9415 Connect with us: [image: Glassdoor logo] [image: LinkedIn logo] [image: twitter logo] [image: facebook logo] [image: youtube logo] [image: Google+ logo] [image: Blog logo] --94eb2c0b92ac7793d7054289f541 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Jeff makes a good point here that starting WGLC during the= meeting and Thanksgiving for many people right after that likely means man= y won't have a chance to do a review for WGLC (I'm just returning f= rom family vacation myself on top of it). Given all that and the somewhat r= ecent publication of new revisions of the drafts, might it make sense to ex= tend the WGLC period?

On Tue, Nov 29, 2016 at 3:58 PM, =3DJeffH &= lt;Jeff.= Hodges@kingsmountain.com> wrote:
Dear tokbind co-chairs,

> This starts a working group last call for the following documents:
>
> draft-ietf-tokbind-https-06
> draft-ietf-tokbind-negotiation-05
> draft-ietf-tokbind-protocol-10
>
> Any comments should be send to the list before EOB November 30th


Ok, I have some modest editorial comments/polishing I'm trying to get d= one, but the 2 week WGLC is sorta short given us american's feast of th= anksgiving last week and various end-of-year corporate must-dos. I'll g= et my comments in by the end of this week, I trust that'll be ok.

thanks,

=3DJeffH

_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearabl= e



--
3D"Ping
Brian Campbell
Distinguished Engineer =
bcampbell@pingidentity.com=
w: +1 720.317.2061
c: +1 303.= 918.9415
<= /tr> =
Connect with us: 3D"Glassdoor 3D"LinkedIn = 3D"twitter=3D"facebook 3D"youtube 3D"Google+ = 3D"Blog
--94eb2c0b92ac7793d7054289f541-- From nobody Wed Nov 30 12:09:14 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D36B5129A39 for ; Wed, 30 Nov 2016 12:09:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.59 X-Spam-Level: X-Spam-Status: No, score=-2.59 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kC1zogeN_z1R for ; Wed, 30 Nov 2016 12:09:11 -0800 (PST) Received: from mail-qk0-x22e.google.com (mail-qk0-x22e.google.com [IPv6:2607:f8b0:400d:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FA7B129A3D for ; Wed, 30 Nov 2016 12:06:48 -0800 (PST) Received: by mail-qk0-x22e.google.com with SMTP id n21so222036608qka.3 for ; Wed, 30 Nov 2016 12:06:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=N6buO+XS19dKrPneFTwO/UMbsgR9x/aoRE0dhUFec7w=; b=iWUVhqF6/woq/ILoCRY/MRmq2MQkgFZrvxBambupYKhILbhU7+YUNfoBbZ6q9uETPg Uh/0mzOQ/Y3C7dUQ3Gr9BHxYvyG62Q348HUqDpCWiXVGv2NJUojwxi9l1TXp8pjrMKyR TWbuLg0ui+lRWGPr57BWj16jw2bP1U/eLy6whfbE977jF/Zjkj3oBTXI5g6F1a3ujbyc HzTKRcBc/n53/ybR6k0TqKclD2UMgJtcTFWhVmdVYlP6FOIh5Nw1lWauIZK+Jru2XTbz 9SzGJrRNPzN9A7R5mHtym+wfrfh4d8JWpkwFsxD9fJYyalN+ysbZ2fwFjMURgxCNbTs5 /AZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=N6buO+XS19dKrPneFTwO/UMbsgR9x/aoRE0dhUFec7w=; b=QnQxEyXH3qY5eGrnXZ32dzqr8s0QQpeKfbHeKRgjDXNgyRxqx2MCBwzjhmdWVaSJdt 3Jn+zb1TosU6dpqm578Ivxem3wfOhKaGdO6Vtr5riR6RqYoVpjtMhEFJLI6jHMOyqfRf XMW6w71AnGacF5W3jhQGceYjY08TS6qlm70+qGokC8wNU06bW7WRM+kp+7qh6S2X+bvT sU3aR/TWSbYPS2G5fUdjCSm44yjOvbjKiXKpvpoBwRVeL0dasC4OrM79kuO5us8IhLPT U0x9yBqsac3tzEZdxT5RyUzzzXd8YYxj1IERxi5AgXPPXSFBTn0Pe8jKENKyOTqfBJhe VQDA== X-Gm-Message-State: AKaTC00BXnGsP0Q12L5kWnOAXqPVHBCutIuxgHXZm/IyyoedR/hVhmFq7Sf6kjyi+q05x9Dz X-Received: by 10.55.75.17 with SMTP id y17mr22328609qka.26.1480536396334; Wed, 30 Nov 2016 12:06:36 -0800 (PST) Received: from [192.168.8.100] ([181.201.171.170]) by smtp.gmail.com with ESMTPSA id 46sm34222632qtw.6.2016.11.30.12.06.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 30 Nov 2016 12:06:35 -0800 (PST) From: John Bradley Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_A87CE0AA-211B-4B86-A22E-427B0DD8B63B" Mime-Version: 1.0 (Mac OS X Mail 10.1 \(3251\)) Date: Wed, 30 Nov 2016 17:06:33 -0300 In-Reply-To: To: Brian Campbell References: X-Mailer: Apple Mail (2.3251) Archived-At: Cc: IETF TokBind WG , =JeffH Hodges Subject: Re: [Unbearable] WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2016 20:09:14 -0000 --Apple-Mail=_A87CE0AA-211B-4B86-A22E-427B0DD8B63B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Sorry with neither of us being American we did not take your 4 day = weekend into account. =20 I am personally fine with a week extension and reviewing it then if = people think they have something they haven't had time to contribute. However we do want to wind this up so extensions will be limited. John B. > On Nov 30, 2016, at 4:45 PM, Brian Campbell = wrote: >=20 > Jeff makes a good point here that starting WGLC during the meeting and = Thanksgiving for many people right after that likely means many won't = have a chance to do a review for WGLC (I'm just returning from family = vacation myself on top of it). Given all that and the somewhat recent = publication of new revisions of the drafts, might it make sense to = extend the WGLC period? >=20 > On Tue, Nov 29, 2016 at 3:58 PM, =3DJeffH = > = wrote: > Dear tokbind co-chairs, >=20 > > This starts a working group last call for the following documents: > > > > draft-ietf-tokbind-https-06 > > draft-ietf-tokbind-negotiation-05 > > draft-ietf-tokbind-protocol-10 > > > > Any comments should be send to the list before EOB November 30th >=20 >=20 > Ok, I have some modest editorial comments/polishing I'm trying to get = done, but the 2 week WGLC is sorta short given us american's feast of = thanksgiving last week and various end-of-year corporate must-dos. I'll = get my comments in by the end of this week, I trust that'll be ok. >=20 > thanks, >=20 > =3DJeffH >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable = >=20 >=20 >=20 > --=20 > =09 > Brian Campbell=09 > Distinguished Engineer=09 > bcampbell@pingidentity.com =09 > w: +1 720.317.2061=09 > c: +1 303.918.9415 > Connect with us: = = = = = = = =09= > = ______________________________= _________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail=_A87CE0AA-211B-4B86-A22E-427B0DD8B63B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Sorry with neither of us being American we did not take your = 4 day weekend into account.  

I am personally fine with a week = extension and reviewing it then if people think they have something they = haven't had time to contribute.

However we do want to wind this up so = extensions will be limited.

John B.


On Nov 30, 2016, at 4:45 PM, Brian Campbell <bcampbell@pingidentity.com> wrote:

Jeff makes a good point here that starting WGLC during the = meeting and Thanksgiving for many people right after that likely means = many won't have a chance to do a review for WGLC (I'm just returning = from family vacation myself on top of it). Given all that and the = somewhat recent publication of new revisions of the drafts, might it = make sense to extend the WGLC period?

On Tue, = Nov 29, 2016 at 3:58 PM, =3DJeffH <Jeff.Hodges@kingsmountain.com> wrote:
Dear tokbind = co-chairs,

> This starts a working group last call for the following = documents:
>
> draft-ietf-tokbind-https-06
> draft-ietf-tokbind-negotiation-05
> draft-ietf-tokbind-protocol-10
>
> Any comments should be send to the list before EOB November 30th


Ok, I have some modest editorial comments/polishing I'm trying to get = done, but the 2 week WGLC is sorta short given us american's feast of = thanksgiving last week and various end-of-year corporate must-dos. I'll = get my comments in by the end of this week, I trust that'll be ok.

thanks,

=3DJeffH

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable



--
= = = = =
= 3D"Ping = = = =
= Brian Campbell =
= Distinguished Engineer =
= bcampbell@pingidentity.com =
= = w: +1 720.317.2061 =
= = c: +1 303.918.9415 =
=
=
Connect with us: 3D"Glassdoor = 3D"LinkedIn 3D"twitter = 3D"facebook = 3D"youtube = 3D"Google+ = 3D"Blog =
_______________________________________________
Unbearable = mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

= --Apple-Mail=_A87CE0AA-211B-4B86-A22E-427B0DD8B63B-- From nobody Wed Nov 30 12:35:50 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6412129A45 for ; Wed, 30 Nov 2016 12:35:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.69 X-Spam-Level: X-Spam-Status: No, score=-2.69 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rsEx8yvoBF6K for ; Wed, 30 Nov 2016 12:35:44 -0800 (PST) Received: from mail-io0-x22e.google.com (mail-io0-x22e.google.com [IPv6:2607:f8b0:4001:c06::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6855F129AAF for ; Wed, 30 Nov 2016 12:32:33 -0800 (PST) Received: by mail-io0-x22e.google.com with SMTP id j65so370742827iof.0 for ; Wed, 30 Nov 2016 12:32:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=YRhumgoIUeiB/C4zUIqyTw/TcIhiXW8Z1uIAY8WECmc=; b=pWtC7sL4j9PWTwiPBnJCX/jDoU3Bpp0/nZkmACxFsqanonjqgXunYSW1Vt4gRadX4k NSg0MNUMk/rkkVK+tp0OOOAgD/4/D4nmWUIslp8wA8D9xmLBBUbLIsiC3y+54i1HIzpX OsiYKvYgNpgwvjv3Cqf1HYGvgTliShZO9s78M= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=YRhumgoIUeiB/C4zUIqyTw/TcIhiXW8Z1uIAY8WECmc=; b=HKHUlkb03dDC/kEPyN4isdl7OOgJweviaTgNPDZxxcTpBeH2H2arRaT5PVPdF1ibRC LI3h5pfrlHX/Gz6QMwUybj/Pptw59B3zXCuaZtQs9B0UrnobE/On19KNfTc74CZqd7pe o9hNNxOHmkCw0g9SBTH43pX908uI7hEaC4dLGrLMpA2QShVHTO4NFISDC+4bLXgo2yLG 0dFm9rzMiG9900jbIsbpHoUDLPTXCiLm7m1+4LEImzwwC29vnmrfFuH8bITJNmwuSEiI BJfubZK2+UaNq1V54kG6+uK/NLbXEDn8tYMmYM1+xDvB+HoCy5oUrRYoUxDL+LKyX7s5 whUg== X-Gm-Message-State: AKaTC01dMTnWH84mcYFP9APdP8V68y2kcbdBaGfs5fj6/PPL+C5Cd1VxLEzQr30Knz+PdAgE33X5LeaIUGxpzgFs X-Received: by 10.107.13.137 with SMTP id 131mr28161040ion.122.1480537952609; Wed, 30 Nov 2016 12:32:32 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.208.118 with HTTP; Wed, 30 Nov 2016 12:32:02 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Wed, 30 Nov 2016 13:32:02 -0700 Message-ID: To: John Bradley Content-Type: multipart/alternative; boundary=001a113fdfd4bdf05805428a9a62 Archived-At: Cc: IETF TokBind WG , =JeffH Hodges Subject: Re: [Unbearable] WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2016 20:35:48 -0000 --001a113fdfd4bdf05805428a9a62 Content-Type: text/plain; charset=UTF-8 Just speaking for myself, I've been following along and think I'm good with the state of things. But other than glancing at the recent changes, I've not had a chance to sit down and do the end-to-end review of the documents that I'd like to for WGLC. And just given things like staring it during the meeting and USA being great again with 4 day weekends, I'm not sure when I'll be able to do that. Will try to soon. On Wed, Nov 30, 2016 at 1:06 PM, John Bradley wrote: > Sorry with neither of us being American we did not take your 4 day weekend > into account. > > I am personally fine with a week extension and reviewing it then if people > think they have something they haven't had time to contribute. > > However we do want to wind this up so extensions will be limited. > > John B. > > > On Nov 30, 2016, at 4:45 PM, Brian Campbell > wrote: > > Jeff makes a good point here that starting WGLC during the meeting and > Thanksgiving for many people right after that likely means many won't have > a chance to do a review for WGLC (I'm just returning from family vacation > myself on top of it). Given all that and the somewhat recent publication of > new revisions of the drafts, might it make sense to extend the WGLC period? > > On Tue, Nov 29, 2016 at 3:58 PM, =JeffH > wrote: > >> Dear tokbind co-chairs, >> >> > This starts a working group last call for the following documents: >> > >> > draft-ietf-tokbind-https-06 >> > draft-ietf-tokbind-negotiation-05 >> > draft-ietf-tokbind-protocol-10 >> > >> > Any comments should be send to the list before EOB November 30th >> >> >> Ok, I have some modest editorial comments/polishing I'm trying to get >> done, but the 2 week WGLC is sorta short given us american's feast of >> thanksgiving last week and various end-of-year corporate must-dos. I'll get >> my comments in by the end of this week, I trust that'll be ok. >> >> thanks, >> >> =JeffH >> >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable >> > > > > -- > [image: Ping Identity] > > Brian Campbell > Distinguished Engineer > bcampbell@pingidentity.com > w: +1 720.317.2061 <(720)%20317-2061> > c: +1 303.918.9415 <(303)%20918-9415> > Connect with us: [image: Glassdoor logo] > [image: > LinkedIn logo] [image: twitter > logo] [image: facebook logo] > [image: youtube logo] > [image: Google+ logo] > [image: Blog logo] > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > > -- [image: Ping Identity] Brian Campbell Distinguished Engineer bcampbell@pingidentity.com w: +1 720.317.2061 c: +1 303.918.9415 Connect with us: [image: Glassdoor logo] [image: LinkedIn logo] [image: twitter logo] [image: facebook logo] [image: youtube logo] [image: Google+ logo] [image: Blog logo] --001a113fdfd4bdf05805428a9a62 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Just speaking for myself, I've been following along an= d think I'm good with the state of things. But other than glancing at t= he recent changes, I've not had a chance to sit down and do the end-to-= end review of the documents that I'd like to for WGLC. And just given t= hings like staring it during the meeting and USA being great again with 4 d= ay weekends, I'm not sure when I'll be able to do that. Will try to= soon.

= On Wed, Nov 30, 2016 at 1:06 PM, John Bradley <ve7jtb@ve7jtb.com> wrote:
Sorry with neither of us being American we did not take your 4 day = weekend into account. =C2=A0

I am personally fine with a= week extension and reviewing it then if people think they have something t= hey haven't had time to contribute.

However we= do want to wind this up so extensions will be limited.

John B.


On Nov 30, 2016, at 4:45 PM, Brian Campbell <= bcampbell@p= ingidentity.com> wrote:

Jeff makes a good point here th= at starting WGLC during the meeting and Thanksgiving for many people right = after that likely means many won't have a chance to do a review for WGL= C (I'm just returning from family vacation myself on top of it). Given = all that and the somewhat recent publication of new revisions of the drafts= , might it make sense to extend the WGLC period?

On Tue, Nov 29, 2016 at 3:58 PM, = =3DJeffH <Jeff.Hodges@kingsmountain.com> wr= ote:
Dear tokbind co-chairs,

> This starts a working group last call for the following documents:
>
> draft-ietf-tokbind-https-06
> draft-ietf-tokbind-negotiation-05
> draft-ietf-tokbind-protocol-10
>
> Any comments should be send to the list before EOB November 30th


Ok, I have some modest editorial comments/polishing I'm trying to get d= one, but the 2 week WGLC is sorta short given us american's feast of th= anksgiving last week and various end-of-year corporate must-dos. I'll g= et my comments in by the end of this week, I trust that'll be ok.

thanks,

=3DJeffH

_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearabl= e



--
=
3D"Ping Brian Campbell
Distinguished Engineer
bcampbell@pingidentity.com<= /a>
w: +1 720.317.2061
c: +1 303.918.9415
= =
Connect with us: 3D"LinkedIn = 3D"twitter = 3D"faceboo= 3D"youtube 3D"Google+ = 3D"Blog
_______________________________________________
Unbearable mailing = list
Unbearable= @ietf.org
https://www.ietf.org/mailman/listinfo/unbearable<= /a>




--
--001a113fdfd4bdf05805428a9a62-- From nobody Wed Nov 30 14:22:45 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DB0B129B8F for ; Wed, 30 Nov 2016 14:22:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1rpxTZVZ4iCq for ; Wed, 30 Nov 2016 14:22:41 -0800 (PST) Received: from smtp5-g21.free.fr (smtp5-g21.free.fr [IPv6:2a01:e0c:1:1599::14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD196129B95 for ; Wed, 30 Nov 2016 14:22:40 -0800 (PST) Received: from zimbra57-e10.priv.proxad.net (unknown [172.20.243.207]) by smtp5-g21.free.fr (Postfix) with ESMTP id 6EA7E5FE49; Wed, 30 Nov 2016 23:22:38 +0100 (CET) Date: Wed, 30 Nov 2016 23:22:38 +0100 (CET) From: denis.ietf@free.fr To: unbearable@ietf.org Message-ID: <1193122970.740772372.1480544558065.JavaMail.root@zimbra57-e10.priv.proxad.net> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [190.82.19.134] X-Mailer: Zimbra 7.2.0-GA2598 (zclient/7.2.0-GA2598) X-Authenticated-User: denis.ietf@free.fr Archived-At: Cc: John Bradley , IETF TokBind WG , =JeffH Hodges Subject: [Unbearable] Answer to WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2016 22:22:44 -0000 This set of documents failed to meet the terms of r=C3=A9f=C3=A9rences of t= he WG charter. It is not resistant to the ABC attack (Alice and Bob collusion attack). In this attack Bob who is older than 18 colloborates with Alice and transmi= ts a token to Alice who is only 14 so that she can d=C3=A9monstrateur to a = RS that she is older than 18. This kind of attack is not even mentionned in the security considerations s= ection. This set of documents should not be progressed to IETF last call unless the= attack can be countered. Denis >> >> > This starts a working group last call for the following documents: >> > >> > draft-ietf-tokbind-https-06 >> > draft-ietf-tokbind-negotiation-05 >> > draft-ietf-tokbind-protocol-10 >> > >> > Any comments should be send to the list before EOB November 30th >> >> >> Ok, I have some modest editorial comments/polishing I'm trying to get >> done, but the 2 week WGLC is sorta short given us american's feast of >> thanksgiving last week and various end-of-year corporate must-dos. I'll = get >> my comments in by the end of this week, I trust that'll be ok. >> >> thanks, >> >> =3DJeffH >> >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable >> > > > > -- > [image: Ping Identity] > > Brian Campbell > Distinguished Engineer > bcampbell@pingidentity.com > w: +1 720.317.2061 <(720)%20317-2061> > c: +1 303.918.9415 <(303)%20918-9415> > Connect with us: [image: Glassdoor logo] > [image: > LinkedIn logo] [image: twitter > logo] [image: facebook logo] > [image: youtube logo] > [image: Google+ logo] > [image: Blog logo] > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > > --=20 [image: Ping Identity] Brian Campbell Distinguished Engineer bcampbell@pingidentity.com w: +1 720.317.2061 c: +1 303.918.9415 Connect with us: [image: Glassdoor logo] [image: LinkedIn logo] [image: twitter logo] [image: facebook logo] [image: youtube logo] [image: Google+ logo] [image: Blog logo] From nobody Wed Nov 30 15:20:09 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0068129B2D for ; Wed, 30 Nov 2016 15:20:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jFa1t0IY69kf for ; Wed, 30 Nov 2016 15:20:04 -0800 (PST) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0100.outbound.protection.outlook.com [104.47.42.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B81C6129963 for ; Wed, 30 Nov 2016 15:20:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=RgmuqgbF2XzJJUNChmUKtkxjGzBqNoyo2HV//xiBsIg=; b=K9ikAWg9nKf8I4LWjvWptJ+kD5z9RfHn4Ow2voJGFs/AEUVpXBTszU6l9UjsOv882Axf/IY9KkkVMVHqV9zY9JJwumND4HXTC4RJzPDqs3Tn8l7+vBdoK+xiPoGd/KaxFDjAswn/bezkpOab7QB17BEcAARc8ZInn+Xta52kMFc= Received: from BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) by BN3PR0301MB0835.namprd03.prod.outlook.com (10.160.154.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Wed, 30 Nov 2016 23:20:02 +0000 Received: from BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) by BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) with mapi id 15.01.0693.009; Wed, 30 Nov 2016 23:20:02 +0000 From: Andrei Popov To: "denis.ietf@free.fr" , "unbearable@ietf.org" Thread-Topic: [Unbearable] Answer to WGLC for core document set Thread-Index: AQHSS1hNfUojx6TjTUekaYfRKb4PR6DyJ3lg Date: Wed, 30 Nov 2016 23:20:01 +0000 Message-ID: References: <1193122970.740772372.1480544558065.JavaMail.root@zimbra57-e10.priv.proxad.net> In-Reply-To: <1193122970.740772372.1480544558065.JavaMail.root@zimbra57-e10.priv.proxad.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:8::1d2] x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0835; 7:XFpn1nES6YELBgl4oDMrY21NUGeJvF2DZv4igVY4Qt97b7au5tXeZeRwvVhQDQg/8vnT6mDllsQ01x3XdzYiKW2LRmf7zVmBUkBgc8K8ABNH09IHPtthzyCvIcXHYk3+aED/TqX0DrMQmgQHQpWFlP2FNqWTpBkgO/BHgTaDIWIgeaHsP04YssUcC1t3v30gLJi+WBivMsbTyOZs8ZPQ1VIsFkVUWnNPYbflJN/oIThJa3OQpZwS4jB0K4feOlD9DaubEIrAu0R7Qm9iqU0NBlRkUC/XqK+5oiNGIdVQ7Gynfi7CcT2Qd3lqaqZyY2v28ktYXRICZ6Y5XLsjxLIYq9fV97JFY3NzHmgKqcCeIFOTzLJkx34iUfyHEqYVYEx/ x-ms-office365-filtering-correlation-id: 0cb951b7-a36b-4b87-9133-08d419776917 x-microsoft-antispam: UriScan:(266515866835815); BCL:0; PCL:0; RULEID:(22001); SRVR:BN3PR0301MB0835; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(266515866835815)(191636701735510)(148322886591682)(192374486261705)(31418570063057)(116415991822766)(258669246490384)(128460861657000)(211936372134217)(80641642340047); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123564025)(20161123562025)(20161123560025)(6072148)(6047074)(6042181); SRVR:BN3PR0301MB0835; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0835; x-forefront-prvs: 0142F22657 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(979002)(6009001)(7916002)(199003)(189002)(13464003)(377454003)(189998001)(38730400001)(8936002)(101416001)(8676002)(122556002)(7846002)(10090500001)(7736002)(3660700001)(76176999)(77096006)(7696004)(5001770100001)(106116001)(8990500004)(105586002)(54356999)(50986999)(10290500002)(99286002)(2950100002)(92566002)(106356001)(68736007)(5005710100001)(229853002)(2906002)(6506003)(5660300001)(305945005)(81156014)(2900100001)(86612001)(9686002)(74316002)(81166006)(4000630100001)(33656002)(102836003)(4326007)(76576001)(2501003)(3280700002)(6116002)(97736004)(230673001)(86362001)(15866825004)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0835; H:BN3PR0301MB0836.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Nov 2016 23:20:01.8405 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0835 Archived-At: Cc: John Bradley , IETF TokBind WG , =JeffH Hodges Subject: Re: [Unbearable] Answer to WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2016 23:20:08 -0000 SGkgRGVuaXMsDQoNCkZvciBhbiBSUCB0byBhY2NlcHQgdGhlIGJvdW5kIHRva2VuIHRoYXQgQWxp Y2UgaGFzIHJlY2VpdmVkIGZyb20gQm9iLCBBbGljZSBuZWVkcyB0byBwcm92ZSBwb3NzZXNzaW9u IG9mIHRoZSBjb3JyZXNwb25kaW5nIFRva2VuIEJpbmRpbmcga2V5LiBTbyBCb2Igd291bGQgaGF2 ZSB0byBlaXRoZXI6DQoxLiBleHBvcnQgdGhlIFRCIGtleSB0byBBbGljZSwgb3IgDQoyLiBiZSB3 aWxsaW5nIHRvIHNpZ24gQWxpY2UncyBkYXRhIHdpdGggaGlzIFRCIGtleS4NCg0KSWYgd2UncmUg bWlzc2luZyBzb21ldGhpbmcgYW5kIHlvdSBoYXZlIGEgc2NlbmFyaW8gdGhhdCBhbGxvd3MgQWxp Y2UgdG8gcmVwbGF5IGEgYm91bmQgdG9rZW4gYW5kIGhhdmUgYW4gUlAgYWNjZXB0IGl0LCBwbGVh c2UgZXhwbGFpbiBpbiBtb3JlIGRldGFpbC4NCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0KLS0tLS1P cmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFVuYmVhcmFibGUgW21haWx0bzp1bmJlYXJhYmxl LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBkZW5pcy5pZXRmQGZyZWUuZnINClNlbnQ6 IFdlZG5lc2RheSwgTm92ZW1iZXIgMzAsIDIwMTYgMjoyMyBQTQ0KVG86IHVuYmVhcmFibGVAaWV0 Zi5vcmcNCkNjOiBKb2huIEJyYWRsZXkgPHZlN2p0YkB2ZTdqdGIuY29tPjsgSUVURiBUb2tCaW5k IFdHIDx1bmJlYXJhYmxlQGlldGYub3JnPjsgPUplZmZIIEhvZGdlcyA8SmVmZi5Ib2RnZXNAa2lu Z3Ntb3VudGFpbi5jb20+DQpTdWJqZWN0OiBbVW5iZWFyYWJsZV0gQW5zd2VyIHRvIFdHTEMgZm9y IGNvcmUgZG9jdW1lbnQgc2V0DQoNClRoaXMgc2V0IG9mIGRvY3VtZW50cyBmYWlsZWQgdG8gbWVl dCB0aGUgdGVybXMgb2YgcsOpZsOpcmVuY2VzIG9mIHRoZSBXRyBjaGFydGVyLg0KDQpJdCBpcyBu b3QgcmVzaXN0YW50IHRvIHRoZSBBQkMgYXR0YWNrIChBbGljZSBhbmQgQm9iIGNvbGx1c2lvbiBh dHRhY2spLg0KSW4gdGhpcyBhdHRhY2sgQm9iIHdobyBpcyBvbGRlciB0aGFuIDE4IGNvbGxvYm9y YXRlcyB3aXRoIEFsaWNlIGFuZCB0cmFuc21pdHMgYSB0b2tlbiB0byBBbGljZSB3aG8gaXMgb25s eSAxNCBzbyB0aGF0IHNoZSBjYW4gZMOpbW9uc3RyYXRldXIgdG8gYSBSUyB0aGF0IHNoZSBpcyBv bGRlciB0aGFuIDE4Lg0KDQpUaGlzIGtpbmQgb2YgYXR0YWNrIGlzIG5vdCBldmVuIG1lbnRpb25u ZWQgaW4gdGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIHNlY3Rpb24uDQoNClRoaXMgc2V0IG9m IGRvY3VtZW50cyBzaG91bGQgbm90IGJlIHByb2dyZXNzZWQgdG8gSUVURiBsYXN0IGNhbGwgdW5s ZXNzIHRoZSBhdHRhY2sgY2FuIGJlIGNvdW50ZXJlZC4NCg0KRGVuaXMNCj4+DQo+PiA+IFRoaXMg c3RhcnRzIGEgd29ya2luZyBncm91cCBsYXN0IGNhbGwgZm9yIHRoZSBmb2xsb3dpbmcgZG9jdW1l bnRzOg0KPj4gPg0KPj4gPiBkcmFmdC1pZXRmLXRva2JpbmQtaHR0cHMtMDYNCj4+ID4gZHJhZnQt aWV0Zi10b2tiaW5kLW5lZ290aWF0aW9uLTA1DQo+PiA+IGRyYWZ0LWlldGYtdG9rYmluZC1wcm90 b2NvbC0xMA0KPj4gPg0KPj4gPiBBbnkgY29tbWVudHMgc2hvdWxkIGJlIHNlbmQgdG8gdGhlIGxp c3QgYmVmb3JlIEVPQiBOb3ZlbWJlciAzMHRoDQo+Pg0KPj4NCj4+IE9rLCBJIGhhdmUgc29tZSBt b2Rlc3QgZWRpdG9yaWFsIGNvbW1lbnRzL3BvbGlzaGluZyBJJ20gdHJ5aW5nIHRvIGdldCANCj4+ IGRvbmUsIGJ1dCB0aGUgMiB3ZWVrIFdHTEMgaXMgc29ydGEgc2hvcnQgZ2l2ZW4gdXMgYW1lcmlj YW4ncyBmZWFzdCBvZiANCj4+IHRoYW5rc2dpdmluZyBsYXN0IHdlZWsgYW5kIHZhcmlvdXMgZW5k LW9mLXllYXIgY29ycG9yYXRlIG11c3QtZG9zLiANCj4+IEknbGwgZ2V0IG15IGNvbW1lbnRzIGlu IGJ5IHRoZSBlbmQgb2YgdGhpcyB3ZWVrLCBJIHRydXN0IHRoYXQnbGwgYmUgb2suDQo+Pg0KPj4g dGhhbmtzLA0KPj4NCj4+ID1KZWZmSA0KPj4NCj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fDQo+PiBVbmJlYXJhYmxlIG1haWxpbmcgbGlzdA0KPj4gVW5i ZWFyYWJsZUBpZXRmLm9yZw0KPj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by91bmJlYXJhYmxlDQo+Pg0KPg0KPg0KPg0KPiAtLQ0KPiA8aHR0cHM6Ly93d3cucGluZ2lkZW50 aXR5LmNvbS8+W2ltYWdlOiBQaW5nIElkZW50aXR5XSANCj4gPGh0dHBzOi8vd3d3LnBpbmdpZGVu dGl0eS5jb20vPiBCcmlhbiBDYW1wYmVsbCBEaXN0aW5ndWlzaGVkIEVuZ2luZWVyIA0KPiBiY2Ft cGJlbGxAcGluZ2lkZW50aXR5LmNvbQ0KPiB3OiArMSA3MjAuMzE3LjIwNjEgPCg3MjApJTIwMzE3 LTIwNjE+DQo+IGM6ICsxIDMwMy45MTguOTQxNSA8KDMwMyklMjA5MTgtOTQxNT4NCj4gQ29ubmVj dCB3aXRoIHVzOiBbaW1hZ2U6IEdsYXNzZG9vciBsb2dvXSANCj4gPGh0dHBzOi8vd3d3LmdsYXNz ZG9vci5jb20vT3ZlcnZpZXcvV29ya2luZy1hdC1QaW5nLUlkZW50aXR5LUVJX0lFMzgwOTA3LjEx LDI0Lmh0bT4gW2ltYWdlOg0KPiBMaW5rZWRJbiBsb2dvXSA8aHR0cHM6Ly93d3cubGlua2VkaW4u Y29tL2NvbXBhbnkvMjE4NzA+IFtpbWFnZTogDQo+IHR3aXR0ZXIgbG9nb10gPGh0dHBzOi8vdHdp dHRlci5jb20vcGluZ2lkZW50aXR5PiBbaW1hZ2U6IGZhY2Vib29rIA0KPiBsb2dvXSA8aHR0cHM6 Ly93d3cuZmFjZWJvb2suY29tL3BpbmdpZGVudGl0eXBhZ2U+IFtpbWFnZTogeW91dHViZSANCj4g bG9nb10gPGh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL3VzZXIvUGluZ0lkZW50aXR5VFY+IFtpbWFn ZTogR29vZ2xlKyANCj4gbG9nb10gPGh0dHBzOi8vcGx1cy5nb29nbGUuY29tL3UvMC8xMTQyNjY5 Nzc3MzkzOTc3MDg1NDA+IFtpbWFnZTogQmxvZyANCj4gbG9nb10gPGh0dHBzOi8vd3d3LnBpbmdp ZGVudGl0eS5jb20vZW4vYmxvZy5odG1sPg0KPiA8aHR0cHM6Ly93d3cucGluZ2lkZW50aXR5LmNv bS9lbi9hYm91dC5odG1sPg0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KPiBVbmJlYXJhYmxlIG1haWxpbmcgbGlzdA0KPiBVbmJlYXJhYmxlQGlldGYu b3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZQ0K Pg0KPg0KPg0KDQoNCi0tDQo8aHR0cHM6Ly93d3cucGluZ2lkZW50aXR5LmNvbT5baW1hZ2U6IFBp bmcgSWRlbnRpdHldIDxodHRwczovL3d3dy5waW5naWRlbnRpdHkuY29tPiBCcmlhbiBDYW1wYmVs bCBEaXN0aW5ndWlzaGVkIEVuZ2luZWVyIGJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tDQp3OiAr MSA3MjAuMzE3LjIwNjENCmM6ICsxIDMwMy45MTguOTQxNQ0KQ29ubmVjdCB3aXRoIHVzOiBbaW1h Z2U6IEdsYXNzZG9vciBsb2dvXSA8aHR0cHM6Ly93d3cuZ2xhc3Nkb29yLmNvbS9PdmVydmlldy9X b3JraW5nLWF0LVBpbmctSWRlbnRpdHktRUlfSUUzODA5MDcuMTEsMjQuaHRtPg0KW2ltYWdlOg0K TGlua2VkSW4gbG9nb10gPGh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9jb21wYW55LzIxODcwPiBb aW1hZ2U6IHR3aXR0ZXIgbG9nb10gPGh0dHBzOi8vdHdpdHRlci5jb20vcGluZ2lkZW50aXR5PiBb aW1hZ2U6IGZhY2Vib29rIGxvZ29dIDxodHRwczovL3d3dy5mYWNlYm9vay5jb20vcGluZ2lkZW50 aXR5cGFnZT4gW2ltYWdlOiB5b3V0dWJlIGxvZ29dIDxodHRwczovL3d3dy55b3V0dWJlLmNvbS91 c2VyL1BpbmdJZGVudGl0eVRWPiBbaW1hZ2U6IEdvb2dsZSsgbG9nb10gPGh0dHBzOi8vcGx1cy5n b29nbGUuY29tL3UvMC8xMTQyNjY5Nzc3MzkzOTc3MDg1NDA+IFtpbWFnZTogQmxvZyBsb2dvXSA8 aHR0cHM6Ly93d3cucGluZ2lkZW50aXR5LmNvbS9lbi9ibG9nLmh0bWw+DQo8aHR0cHM6Ly93d3cu cGluZ2lkZW50aXR5LmNvbS9lbi9hYm91dC5odG1sPg0KDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KVW5iZWFyYWJsZSBtYWlsaW5nIGxpc3QNClVuYmVh cmFibGVAaWV0Zi5vcmcNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5i ZWFyYWJsZQ0K From nobody Wed Nov 30 15:42:26 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70452129BD7 for ; Wed, 30 Nov 2016 15:42:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nWwu7pM6duq5 for ; Wed, 30 Nov 2016 15:42:17 -0800 (PST) Received: from mail-io0-x232.google.com (mail-io0-x232.google.com [IPv6:2607:f8b0:4001:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 35CBF129BD2 for ; Wed, 30 Nov 2016 15:42:17 -0800 (PST) Received: by mail-io0-x232.google.com with SMTP id c21so354699282ioj.1 for ; Wed, 30 Nov 2016 15:42:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=oY6SmH1D6kSVBuFssmCHpOYzUuMmejVB4b7/WO07PLA=; b=RCOIOsj1rea+e9aktNC1rbohazB0bF1HF41Tc28EfCbF5yMyl8Qvibg/TlIwVJI0cU dhjNtj9z0+v0QM9JFYzdTJhhyp5D9IdLCjjnf1Fmn5ocKml2089sFnK304mbZDSGR8Di 35ljFd/jCjxlRrq82QbkW+2vR3aS6/XcKfusyJS/p/O5Oc2QxGnXFOM1pGGgKnukqSDD /RIyZ/CL0NN1GQsHJ9jWyMe1NrpR0hmccpGzcmzkk0bYUG1BKS9zjsZ2gwGUkqakcDje z2pbvBhw0/DIJuylOWNv4wRTtFilt8RFZw1mxMy9/pDA0wVWue0OzqqJXwWLLmbm590P UJzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=oY6SmH1D6kSVBuFssmCHpOYzUuMmejVB4b7/WO07PLA=; b=BczDRIQtZXnrLghGgQHHZPVJb7kMUG6EyvoUxGb7CvKembo+LWCRoYeFEBWXfQlmtU CxmgBaK6IscxIR/OAevJVPfFz2AVVXCqBNxZym3TTQBk0ppD1Yjotr/CSo1+TxUvspoz y/WyBKHlW8pDqnB03gI5NvaTehgkNrIpv0eEQCAy3XQkIs7JyCKqO5TDJArA8JTjxbS3 uzW/6NS+D9BBpbikYIA97fMAUExMl6DKnu11gJuLMyiygst2cQrjUxMlpqvmVFjJTy4d JqvHX9EAZcp0OY9io3sobpIOAZ1j1LMmIWJR2CwSNU78o9v4ScGeyuVplpIvmJP7OnUG joVg== X-Gm-Message-State: AKaTC02hFq+lXDse6DCJUnTf3DPN7icCn7Se8gf0m8No173QBgpkMXV0B9815dOyVFB8/tmcI/ySNE5PhcNyA30h X-Received: by 10.107.56.84 with SMTP id f81mr29154737ioa.105.1480549334643; Wed, 30 Nov 2016 15:42:14 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.39.71 with HTTP; Wed, 30 Nov 2016 15:42:13 -0800 (PST) X-Originating-IP: [191.115.52.7] Received: by 10.79.39.71 with HTTP; Wed, 30 Nov 2016 15:42:13 -0800 (PST) In-Reply-To: <1193122970.740772372.1480544558065.JavaMail.root@zimbra57-e10.priv.proxad.net> References: <1193122970.740772372.1480544558065.JavaMail.root@zimbra57-e10.priv.proxad.net> From: John Bradley Date: Wed, 30 Nov 2016 20:42:13 -0300 Message-ID: To: Denis Content-Type: multipart/alternative; boundary=001a114ac1f62a0ce705428d413c Archived-At: Cc: unbearable@ietf.org, =JeffH Hodges Subject: Re: [Unbearable] Answer to WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Nov 2016 23:42:23 -0000 --001a114ac1f62a0ce705428d413c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable For this attack to work Bob would also need to transmit the token binding keys for the issued token to Alice. Is that what you mean by the collision attack? Would addressing in security considerations that this won't protect against user collision unless the token binding keys are stored in some sort of secure storage and not extractable by the user, satisfy your concern, Or are you imagining some other method of binding the token. Regards John B On Nov 30, 2016 19:22, wrote: > This set of documents failed to meet the terms of r=C3=A9f=C3=A9rences of= the WG > charter. > > It is not resistant to the ABC attack (Alice and Bob collusion attack). > In this attack Bob who is older than 18 colloborates with Alice and > transmits a token to Alice who is only 14 so that she can d=C3=A9monstrat= eur to > a RS that she is older than 18. > > This kind of attack is not even mentionned in the security considerations > section. > > This set of documents should not be progressed to IETF last call unless > the attack can be countered. > > Denis > >> > >> > This starts a working group last call for the following documents: > >> > > >> > draft-ietf-tokbind-https-06 > >> > draft-ietf-tokbind-negotiation-05 > >> > draft-ietf-tokbind-protocol-10 > >> > > >> > Any comments should be send to the list before EOB November 30th > >> > >> > >> Ok, I have some modest editorial comments/polishing I'm trying to get > >> done, but the 2 week WGLC is sorta short given us american's feast of > >> thanksgiving last week and various end-of-year corporate must-dos. I'l= l > get > >> my comments in by the end of this week, I trust that'll be ok. > >> > >> thanks, > >> > >> =3DJeffH > >> > >> _______________________________________________ > >> Unbearable mailing list > >> Unbearable@ietf.org > >> https://www.ietf.org/mailman/listinfo/unbearable > >> > > > > > > > > -- > > [image: Ping Identity] > > > > Brian Campbell > > Distinguished Engineer > > bcampbell@pingidentity.com > > w: +1 720.317.2061 <(720)%20317-2061> > > c: +1 303.918.9415 <(303)%20918-9415> > > Connect with us: [image: Glassdoor logo] > > Identity-EI_IE380907.11,24.htm> [image: > > LinkedIn logo] [image: twitter > > logo] [image: facebook logo] > > [image: youtube logo] > > [image: Google+ logo] > > [image: Blog logo] > > > > > > _______________________________________________ > > Unbearable mailing list > > Unbearable@ietf.org > > https://www.ietf.org/mailman/listinfo/unbearable > > > > > > > > > -- > [image: Ping Identity] > > Brian Campbell > Distinguished Engineer > bcampbell@pingidentity.com > w: +1 720.317.2061 > c: +1 303.918.9415 > Connect with us: [image: Glassdoor logo] > Identity-EI_IE380907.11,24.htm> > [image: > LinkedIn logo] [image: twitter > logo] [image: facebook logo] > [image: youtube logo] > [image: Google+ logo] > [image: Blog logo] > > > > --001a114ac1f62a0ce705428d413c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

For this attack to work Bob would also need to transmit the = token binding keys for the issued token to Alice.=C2=A0

Is that what you mean by the collision attack?=C2=A0

Would addressing in security considerations that this won= 9;t protect against user collision unless the token binding keys are stored= in some sort of secure storage and not extractable by the user, satisfy yo= ur concern, Or are you imagining some other method of binding the token.=C2= =A0

Regards
John B


On Nov 30, 2016 1= 9:22, <denis.ietf@free.fr>= wrote:
This set of = documents failed to meet the terms of r=C3=A9f=C3=A9rences of the WG charte= r.

It is not resistant to the ABC attack (Alice and Bob collusion attack).
In this attack Bob who is older than 18 colloborates with Alice and transmi= ts a token to Alice who is only 14 so that she can d=C3=A9monstrateur to a = RS that she is older than 18.

This kind of attack is not even mentionned in the security considerations s= ection.

This set of documents should not be progressed to IETF last call unless the= attack can be countered.

Denis
>>
>> > This starts a working group last call for the following docum= ents:
>> >
>> > draft-ietf-tokbind-https-06
>> > draft-ietf-tokbind-negotiation-05
>> > draft-ietf-tokbind-protocol-10
>> >
>> > Any comments should be send to the list before EOB November 3= 0th
>>
>>
>> Ok, I have some modest editorial comments/polishing I'm trying= to get
>> done, but the 2 week WGLC is sorta short given us american's f= east of
>> thanksgiving last week and various end-of-year corporate must-dos.= I'll get
>> my comments in by the end of this week, I trust that'll be ok.=
>>
>> thanks,
>>
>> =3DJeffH
>>
>> _______________________________________________
>> Unbearable mailing list
>> Unbearable@ietf.org
>> https://www.ietf.org/mailman/listinf= o/unbearable
>>
>
>
>
> --
> <https://www.pingidentity.com/>[image: Ping Identit= y]
> <https://www.pingidentity.com/>
> Brian Campbell
> Distinguished Engineer
> bcampbell@pingidentity.c= om
> w: +1 720.3= 17.2061 <(720)%20317-2061>
> c: +1 303.9= 18.9415 <(303)%20918-9415>
> Connect with us: [image: Glassdoor logo]
> <https://ww= w.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,= 24.htm> [image:
> LinkedIn logo] <https://www.linkedin.com/company/= 21870> [image: twitter
> logo] <https://twitter.com/pingidentity> [image:= facebook logo]
> <https://www.facebook.com/pingidentitypage= > [image: youtube logo]
> <https://www.youtube.com/user/PingIdentityTV= > [image: Google+ logo]
> <https://plus.google.com/u/0/11426697= 7739397708540> [image: Blog logo]
> <https://www.pingidentity.com/en/blog.html= >
> <https://www.pingidentity.com/en/about.html>
> _______________________________________________
> Unbearable mailing list
> Unbearable@ietf.org
> https://www.ietf.org/mailman/listinfo/unbe= arable
>
>
>


--
<https://www.pingidentity.com>[image: Ping Identity]
<https://www.pingidentity.com>
Brian Campbell
Distinguished Engineer
bcampbell@pingidentity.com
w: +1 720.317.20= 61
c: +1 303.918.94= 15
Connect with us: [image: Glassdoor logo]
<https://www.gla= ssdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.ht= m>
[image:
LinkedIn logo] <https://www.linkedin.com/company/218= 70> [image: twitter
logo] <https://twitter.com/pingidentity> [image: face= book logo]
<https://www.facebook.com/pingidentitypage> = [image: youtube logo]
<https://www.youtube.com/user/PingIdentityTV&= gt; [image: Google+ logo]
<https://plus.google.com/u/0/11426697773939= 7708540> [image: Blog logo]
<https://www.pingidentity.com/en/blog.html><= br> <https://www.pingidentity.com/en/about.html>= ;

--001a114ac1f62a0ce705428d413c-- From nobody Wed Nov 30 16:36:55 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DF46129519 for ; Wed, 30 Nov 2016 16:36:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AKhVT7H-t_z6 for ; Wed, 30 Nov 2016 16:36:50 -0800 (PST) Received: from smtp3-g21.free.fr (smtp3-g21.free.fr [212.27.42.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9099D129400 for ; Wed, 30 Nov 2016 16:36:50 -0800 (PST) Received: from zimbra57-e10.priv.proxad.net (unknown [172.20.243.207]) by smtp3-g21.free.fr (Postfix) with ESMTP id 8406313F86F; Thu, 1 Dec 2016 01:36:48 +0100 (CET) Date: Thu, 1 Dec 2016 01:36:48 +0100 (CET) From: denis.ietf@free.fr To: John Bradley Message-ID: <915363178.740920277.1480552608311.JavaMail.root@zimbra57-e10.priv.proxad.net> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [190.82.19.134] X-Mailer: Zimbra 7.2.0-GA2598 (zclient/7.2.0-GA2598) X-Authenticated-User: denis.ietf@free.fr Archived-At: Cc: unbearable@ietf.org, =JeffH Hodges Subject: [Unbearable] =?utf-8?q?Re=C2=A0=3A_Answer_to_WGLC_for_core_docume?= =?utf-8?q?nt_set?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 00:36:53 -0000 Hi Andrei It is option 2. Bob is willing to collaborateurs with Alice. He does not need to give away any secret but only using his secret key to c= ompute everything that Alice is needing. Denis ----- Mail d'origine ----- De: John Bradley =C3=80: Denis Cc: unbearable@ietf.org, =3DJeffH Hodges Envoy=C3=A9: Thu, 01 Dec 2016 00:42:13 +0100 (CET) Objet: Re: Answer to WGLC for core document set For this attack to work Bob would also need to transmit the token binding keys for the issued token to Alice. Is that what you mean by the collision attack? Would addressing in security considerations that this won't protect against user collision unless the token binding keys are stored in some sort of secure storage and not extractable by the user, satisfy your concern, Or are you imagining some other method of binding the token. Regards John B On Nov 30, 2016 19:22, wrote: > This set of documents failed to meet the terms of r=C3=A9f=C3=A9rences of= the WG > charter. > > It is not resistant to the ABC attack (Alice and Bob collusion attack). > In this attack Bob who is older than 18 colloborates with Alice and > transmits a token to Alice who is only 14 so that she can d=C3=A9monstrat= eur to > a RS that she is older than 18. > > This kind of attack is not even mentionned in the security considerations > section. > > This set of documents should not be progressed to IETF last call unless > the attack can be countered. > > Denis > >> > >> > This starts a working group last call for the following documents: > >> > > >> > draft-ietf-tokbind-https-06 > >> > draft-ietf-tokbind-negotiation-05 > >> > draft-ietf-tokbind-protocol-10 > >> > > >> > Any comments should be send to the list before EOB November 30th > >> > >> > >> Ok, I have some modest editorial comments/polishing I'm trying to get > >> done, but the 2 week WGLC is sorta short given us american's feast of > >> thanksgiving last week and various end-of-year corporate must-dos. I'l= l > get > >> my comments in by the end of this week, I trust that'll be ok. > >> > >> thanks, > >> > >> =3DJeffH > >> > >> _______________________________________________ > >> Unbearable mailing list > >> Unbearable@ietf.org > >> https://www.ietf.org/mailman/listinfo/unbearable > >> > > > > > > > > -- > > [image: Ping Identity] > > > > Brian Campbell > > Distinguished Engineer > > bcampbell@pingidentity.com > > w: +1 720.317.2061 <(720)%20317-2061> > > c: +1 303.918.9415 <(303)%20918-9415> > > Connect with us: [image: Glassdoor logo] > > Identity-EI_IE380907.11,24.htm> [image: > > LinkedIn logo] [image: twitter > > logo] [image: facebook logo] > > [image: youtube logo] > > [image: Google+ logo] > > [image: Blog logo] > > > > > > _______________________________________________ > > Unbearable mailing list > > Unbearable@ietf.org > > https://www.ietf.org/mailman/listinfo/unbearable > > > > > > > > > -- > [image: Ping Identity] > > Brian Campbell > Distinguished Engineer > bcampbell@pingidentity.com > w: +1 720.317.2061 > c: +1 303.918.9415 > Connect with us: [image: Glassdoor logo] > Identity-EI_IE380907.11,24.htm> > [image: > LinkedIn logo] [image: twitter > logo] [image: facebook logo] > [image: youtube logo] > [image: Google+ logo] > [image: Blog logo] > > > > From nobody Wed Nov 30 16:43:41 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CD7F129527 for ; Wed, 30 Nov 2016 16:43:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.34 X-Spam-Level: X-Spam-Status: No, score=-2.34 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BtecnBaTWjcf for ; Wed, 30 Nov 2016 16:43:36 -0800 (PST) Received: from mail-io0-x234.google.com (mail-io0-x234.google.com [IPv6:2607:f8b0:4001:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E74BF129671 for ; Wed, 30 Nov 2016 16:43:35 -0800 (PST) Received: by mail-io0-x234.google.com with SMTP id m5so246396648ioe.3 for ; Wed, 30 Nov 2016 16:43:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to:cc; bh=jyowZPWHho3u2MZYMe0Zb4j5brI4Hje6DkFuVyfoJ1w=; b=ibkFWc1IsU9CTX+iN5re557pP9lOvdt/ah0UFVbHBiJZVc6YYBapZxr+tpXaKqopz+ 4V3oGuN1ASRpFFTia/D0Lte0/Vs6MS5AqgNouBJnb/+0JS1VPLgCReLQ0v0wj990vPIk 6YmrWrPssZzNAY6PFFegf1qw15hVKO/oJvQFVi1XgCQl/UGmohC0tbVPJrTWQ7Ho1p8U DVuTVW/0WJXD6W80LXijj+tHWaBGATQcFnon5znkPAeEQBxwZOoj99wDxBHJ0gCPyeM/ Fn4xrQepvZtUQWTBH0wpSuJ+R9E0872vW2HplvlvYk14qKT7fj27qiowXpDwAUdfNlvc 9msQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=jyowZPWHho3u2MZYMe0Zb4j5brI4Hje6DkFuVyfoJ1w=; b=gnU2TtCaJUMlnd47/yecs48F8iGRlC4Yr5FG5ZBcpUIM4L7yUWdHTuIJ2cPCtVHUMy NCD3Itxl6q/tG5L7RCOJlJnBvpv4igQbmmLJ6eml830/iVRHltaGeOferuKh/In5dNEW J/Rj7TB2PGPfYaPrdt6vPFQ2iE+AtPMGTBcMW09rhYCOno/pXjxK36PPF+z2jDJQ29Ug IgTavsDt24kpYuiYzHNmh/yIzBWDuOK46oCanpQ6Oo9xd/JnKUN77JrPedjv+b1hPnm2 TrZFYk2qM7A1XSqokeA9ayANLA3hmk8/ZpAprUFr/ErkewJjXoecugkP2ubsevbDQM5N Yjcg== X-Gm-Message-State: AKaTC02Uf9vmIX+Mast+fnkLLFibd35fbI6CzlhaYDwudIARWKn6XVeG82oPHit1ZI/NOa+gj1oDDFBR0PKX7ROw X-Received: by 10.36.203.2 with SMTP id u2mr30940896itg.47.1480553015050; Wed, 30 Nov 2016 16:43:35 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.39.71 with HTTP; Wed, 30 Nov 2016 16:43:34 -0800 (PST) X-Originating-IP: [191.115.52.7] Received: by 10.79.39.71 with HTTP; Wed, 30 Nov 2016 16:43:34 -0800 (PST) From: John Bradley Date: Wed, 30 Nov 2016 21:43:34 -0300 Message-ID: To: Denis Content-Type: multipart/alternative; boundary=94eb2c0b017488bc3b05428e1c6b Archived-At: Cc: unbearable@ietf.org, =JeffH Hodges Subject: Re: [Unbearable] Answer to WGLC for core document set X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 00:43:39 -0000 --94eb2c0b017488bc3b05428e1c6b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Bob's private key needs to be used to sign the EKM for Alice's TLS session where she would present the cookie or token. Otherwise the server that receives the bound token will reject it because Alice cannot prove possession of the token binding ID associated with that token. Alice needs to provide her key material to Bob or Bob needs to provide his to Alice for your collision to work. Regards John B. On Nov 30, 2016 21:36, wrote: > For this attack to work Bob would also need to transmit the token binding > keys for the issued token to Alice. > > Is that what you mean by the collision attack? > > Would addressing in security considerations that this won't protect > against user collision unless the token binding keys are stored in some > sort of secure storage and not extractable by the user, satisfy your > concern, Or are you imagining some other method of binding the token. > > Regards > John B > > On Nov 30, 2016 19:22, wrote: > >> This set of documents failed to meet the terms of r=C3=A9f=C3=A9rences o= f the WG >> charter. >> >> It is not resistant to the ABC attack (Alice and Bob collusion attack). >> In this attack Bob who is older than 18 colloborates with Alice and >> transmits a token to Alice who is only 14 so that she can d=C3=A9monstra= teur to >> a RS that she is older than 18. >> >> This kind of attack is not even mentionned in the security consideration= s >> section. >> >> This set of documents should not be progressed to IETF last call unless >> the attack can be countered. >> >> Denis >> >> >> >> > This starts a working group last call for the following documents: >> >> > >> >> > draft-ietf-tokbind-https-06 >> >> > draft-ietf-tokbind-negotiation-05 >> >> > draft-ietf-tokbind-protocol-10 >> >> > >> >> > Any comments should be send to the list before EOB November 30th >> >> >> >> >> >> Ok, I have some modest editorial comments/polishing I'm trying to get >> >> done, but the 2 week WGLC is sorta short given us american's feast of >> >> thanksgiving last week and various end-of-year corporate must-dos. >> I'll get >> >> my comments in by the end of this week, I trust that'll be ok. >> >> >> >> thanks, >> >> >> >> =3DJeffH >> >> >> >> _______________________________________________ >> >> Unbearable mailing list >> >> Unbearable@ietf.org >> >> https://www.ietf.org/mailman/listinfo/unbearable >> >> >> > >> > >> > >> > -- >> > [image: Ping Identity] >> > >> > Brian Campbell >> > Distinguished Engineer >> > bcampbell@pingidentity.com >> > w: +1 720.317.2061 <(720)%20317-2061> >> > c: +1 303.918.9415 <(303)%20918-9415> >> > Connect with us: [image: Glassdoor logo] >> > > -EI_IE380907.11,24.htm> [image: >> > LinkedIn logo] [image: twitte= r >> > logo] [image: facebook logo] >> > [image: youtube logo] >> > [image: Google+ logo] >> > [image: Blog logo] >> > >> > >> > _______________________________________________ >> > Unbearable mailing list >> > Unbearable@ietf.org >> > https://www.ietf.org/mailman/listinfo/unbearable >> > >> > >> > >> >> >> -- >> [image: Ping Identity] >> >> Brian Campbell >> Distinguished Engineer >> bcampbell@pingidentity.com >> w: +1 720.317.2061 >> c: +1 303.918.9415 >> Connect with us: [image: Glassdoor logo] >> > -EI_IE380907.11,24.htm> >> [image: >> LinkedIn logo] [image: twitter >> logo] [image: facebook logo] >> [image: youtube logo] >> [image: Google+ logo] >> [image: Blog logo] >> >> >> >> --94eb2c0b017488bc3b05428e1c6b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Bob's private key needs to be used to sign the EKM for A= lice's TLS session where she would present the cookie or token.

Otherwise the server that receives the bound token will reje= ct it because Alice cannot prove possession of the token binding ID associa= ted with that token.

Alice needs to provide her key material to Bob or Bob needs = to provide his to Alice for your collision to work.=C2=A0

Regards
John B.


On Nov 30, 2016 2= 1:36, <denis.ietf@free.fr>= wrote:

For this attack to work Bob would also need to transmit the token bindin= g keys for the issued token to Alice.=C2=A0

Is that what you mean by the collision attack?=C2=A0

Would addressing in security considerations that this won= 9;t protect against user collision unless the token binding keys are stored= in some sort of secure storage and not extractable by the user, satisfy yo= ur concern, Or are you imagining some other method of binding the token.=C2= =A0

Regards
John B


On Nov 30, 2016 1= 9:22, <denis.ie= tf@free.fr> wrote:
This set of documents failed to meet the terms of r=C3=A9f=C3=A9rence= s of the WG charter.

It is not resistant to the ABC attack (Alice and Bob collusion attack).
In this attack Bob who is older than 18 colloborates with Alice and transmi= ts a token to Alice who is only 14 so that she can d=C3=A9monstrateur to a = RS that she is older than 18.

This kind of attack is not even mentionned in the security considerations s= ection.

This set of documents should not be progressed to IETF last call unless the= attack can be countered.

Denis
>>
>> > This starts a working group last call for the following docum= ents:
>> >
>> > draft-ietf-tokbind-https-06
>> > draft-ietf-tokbind-negotiation-05
>> > draft-ietf-tokbind-protocol-10
>> >
>> > Any comments should be send to the list before EOB November 3= 0th
>>
>>
>> Ok, I have some modest editorial comments/polishing I'm trying= to get
>> done, but the 2 week WGLC is sorta short given us american's f= east of
>> thanksgiving last week and various end-of-year corporate must-dos.= I'll get
>> my comments in by the end of this week, I trust that'll be ok.=
>>
>> thanks,
>>
>> =3DJeffH
>>
>> _______________________________________________
>> Unbearable mailing list
>> Unbearabl= e@ietf.org
>> https://www.ietf.org/mailman/listinf= o/unbearable
>>
>
>
>
> --
> <https://www.pingidentity.com/>[image: Ping Identit= y]
> <https://www.pingidentity.com/>
> Brian Campbell
> Distinguished Engineer
> bcampb= ell@pingidentity.com
> w: +1 720.317.2061 <(720)%20317-2061>
> c: +1 303.918.9415 <(303)%20918-9415>
> Connect with us: [image: Glassdoor logo]
> <https://ww= w.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,= 24.htm> [image:
> LinkedIn logo] <https://www.linkedin.com/company/= 21870> [image: twitter
> logo] <https://twitter.com/pingidentity> [image:= facebook logo]
> <https://www.facebook.com/pingidentitypage= > [image: youtube logo]
> <https://www.youtube.com/user/PingIdentityTV= > [image: Google+ logo]
> <https://plus.google.com/u/0/11426697= 7739397708540> [image: Blog logo]
> <https://www.pingidentity.com/en/blog.html= >
> <https://www.pingidentity.com/en/about.html>
> _______________________________________________
> Unbearable mailing list
> Unbearable@ie= tf.org
> https://www.ietf.org/mailman/listinfo/unbe= arable
>
>
>


--
<https://www.pingidentity.com>[image: Ping Identity]
<https://www.pingidentity.com>
Brian Campbell
Distinguished Engineer
bcampbell@p= ingidentity.com
w: +1 720.317.2061
c: +1 303.918.9415
Connect with us: [image: Glassdoor logo]
<https://www.gla= ssdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.ht= m>
[image:
LinkedIn logo] <https://www.linkedin.com/company/218= 70> [image: twitter
logo] <https://twitter.com/pingidentity> [image: face= book logo]
<https://www.facebook.com/pingidentitypage> = [image: youtube logo]
<https://www.youtube.com/user/PingIdentityTV&= gt; [image: Google+ logo]
<https://plus.google.com/u/0/11426697773939= 7708540> [image: Blog logo]
<https://www.pingidentity.com/en/blog.html><= br> <https://www.pingidentity.com/en/about.html>= ;

--94eb2c0b017488bc3b05428e1c6b-- From nobody Wed Nov 30 17:06:10 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63E1F129492 for ; Wed, 30 Nov 2016 17:05:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tO7jS_EMPg7r for ; Wed, 30 Nov 2016 17:05:55 -0800 (PST) Received: from smtp2-g21.free.fr (smtp2-g21.free.fr [IPv6:2a01:e0c:1:1599::11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C32F0127A91 for ; Wed, 30 Nov 2016 17:05:54 -0800 (PST) Received: from zimbra57-e10.priv.proxad.net (unknown [172.20.243.207]) by smtp2-g21.free.fr (Postfix) with ESMTP id 1B2BC200337; Thu, 1 Dec 2016 02:05:52 +0100 (CET) Date: Thu, 1 Dec 2016 02:05:52 +0100 (CET) From: denis.ietf@free.fr To: unbearable@ietf.org Message-ID: <159772809.740941621.1480554352453.JavaMail.root@zimbra57-e10.priv.proxad.net> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [190.82.19.134] X-Mailer: Zimbra 7.2.0-GA2598 (zclient/7.2.0-GA2598) X-Authenticated-User: denis.ietf@free.fr Archived-At: Cc: unbearable@ietf.org, =JeffH Hodges Subject: [Unbearable] =?utf-8?q?Re=C2=A0=3A_Answer_to_WGLC_for_core_docume?= =?utf-8?q?nt_set?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 01:05:58 -0000 For this attack to work there is not need to transmit any key but only doin= g the right computation at the right time. It is not a collision attack but collusion attack. You can also call it a = collaboration attack. A secure storage preventing the export of the key would indeed be needed bu= t would be insuficiant since Bob would still be able to perform computation= s for the benefit of Alice. Additional security properties need to be supported by a secure element. For exemple U-Prove from Microsoft and Idemix from IBM are both vulnerable = to the ABC attack. The ABC4Trust project which is now closed has ommitted t= o considerations this attack and is this vulnerable to the ABC attack. I am currently on a two weeks vacation in Patagonia and do not have a lapto= p with me.=20 I wanted to inform you about this issue but typing on a small keyboard with= one pencil takes much time. So, please excuse me for this short answer. Denis ----- Mail d'origine ----- De: John Bradley =C3=80: Denis Cc: unbearable@ietf.org, =3DJeffH Hodges Envoy=C3=A9: Thu, 01 Dec 2016 00:42:13 +0100 (CET) Objet: Re: Answer to WGLC for core document set For this attack to work Bob would also need to transmit the token binding keys for the issued token to Alice. Is that what you mean by the collision attack? Would addressing in security considerations that this won't protect against user collision unless the token binding keys are stored in some sort of secure storage and not extractable by the user, satisfy your concern, Or are you imagining some other method of binding the token. Regards John B On Nov 30, 2016 19:22, wrote: > This set of documents failed to meet the terms of r=C3=A9f=C3=A9rences of= the WG > charter. > > It is not resistant to the ABC attack (Alice and Bob collusion attack). > In this attack Bob who is older than 18 colloborates with Alice and > transmits a token to Alice who is only 14 so that she can d=C3=A9monstrat= eur to > a RS that she is older than 18. > > This kind of attack is not even mentionned in the security considerations > section. > > This set of documents should not be progressed to IETF last call unless > the attack can be countered. > > Denis > >> > >> > This starts a working group last call for the following documents: > >> > > >> > draft-ietf-tokbind-https-06 > >> > draft-ietf-tokbind-negotiation-05 > >> > draft-ietf-tokbind-protocol-10 > >> > > >> > Any comments should be send to the list before EOB November 30th > >> > >> > >> Ok, I have some modest editorial comments/polishing I'm trying to get > >> done, but the 2 week WGLC is sorta short given us american's feast of > >> thanksgiving last week and various end-of-year corporate must-dos. I'l= l > get > >> my comments in by the end of this week, I trust that'll be ok. > >> > >> thanks, > >> > >> =3DJeffH > >> > >> _______________________________________________ > >> Unbearable mailing list > >> Unbearable@ietf.org > >> https://www.ietf.org/mailman/listinfo/unbearable > >> > > > > > > > > -- > > [image: Ping Identity] > > > > Brian Campbell > > Distinguished Engineer > > bcampbell@pingidentity.com > > w: +1 720.317.2061 <(720)%20317-2061> > > c: +1 303.918.9415 <(303)%20918-9415> > > Connect with us: [image: Glassdoor logo] > > Identity-EI_IE380907.11,24.htm> [image: > > LinkedIn logo] [image: twitter > > logo] [image: facebook logo] > > [image: youtube logo] > > [image: Google+ logo] > > [image: Blog logo] > > > > > > _______________________________________________ > > Unbearable mailing list > > Unbearable@ietf.org > > https://www.ietf.org/mailman/listinfo/unbearable > > > > > > > > > -- > [image: Ping Identity] > > Brian Campbell > Distinguished Engineer > bcampbell@pingidentity.com > w: +1 720.317.2061 > c: +1 303.918.9415 > Connect with us: [image: Glassdoor logo] > Identity-EI_IE380907.11,24.htm> > [image: > LinkedIn logo] [image: twitter > logo] [image: facebook logo] > [image: youtube logo] > [image: Google+ logo] > [image: Blog logo] > > > >