From nobody Tue Jan 10 11:49:15 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99AEF129564 for ; Tue, 10 Jan 2017 11:49:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnt-se.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ruhCv6hYSvbX for ; Tue, 10 Jan 2017 11:49:11 -0800 (PST) Received: from mail-lf0-x22b.google.com (mail-lf0-x22b.google.com [IPv6:2a00:1450:4010:c07::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B4DB129465 for ; Tue, 10 Jan 2017 11:49:11 -0800 (PST) Received: by mail-lf0-x22b.google.com with SMTP id o140so67741155lff.3 for ; Tue, 10 Jan 2017 11:49:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnt-se.20150623.gappssmtp.com; s=20150623; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=y3zkhUbVRmGT9ie6xbaUQVjeTJajFYsIrRr0TuPWt3A=; b=VMLA5lzzNApo131CMPk4AbHgcoknZsDJ8e0MZ0knoDzX6lfTMpVGgaWbOBWi+firL+ bKkzWfWz5cwdYVFYlExOB+XUGAwJr2cbqEvdGqCxk4yLMXothQyReXfuxc97ZWQ41UFt d3xtDXmfrjT+IZ2ZVKJhNmoPN0m1ergkecU924lGKlSJfiYo9M0ecjL4rgSxmNECRAfJ yx+nubi/7cMk/goyfvcorkzzBJzn5/6raD2SatNkzoTtJbwJKVAjZziEBH46bxQSCX+p eO4iTsUvCk8ApUxF9ZcNBOIcn7LS9cbIE+bPGzoObwK2HhnXdAyri5+tiJMRDzxGnlHo JcKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=y3zkhUbVRmGT9ie6xbaUQVjeTJajFYsIrRr0TuPWt3A=; b=rznDnCBV+30eKh1hIkmy1QmaoKfE6iXtXT80TXurdE7NeR4oTXzhIkI5O4kH4TlcEE gRPerEN9zNaedgyGBWhJbDWIbeAYuUUcIi5+aACaLfg7vqk6q60U7uOSs38896Smo1jL UPxM9nM23kpmxzCdtLQ49qsuD16i0DIW0GHTOjmAt3VArlZJi5DblMQkSzjQMf1BrYfl RkvecZTj8TEh+Fpw4/7XCfWRNDO8l50RM1mvcgcAe88ZyOrppv6avWCss2wL7aQeW0bk oQmC2PvYn3dY02bVaYQpKKc/nMnQaQkzvZbhbHBZI6xPZSQVentAuDO+IcS2JA2bpPBq rXJw== X-Gm-Message-State: AIkVDXKDRUBVYE8C8TKSfAjx+nBNXByRLohNyV+Njf15rrKnSNahheji7ErH6XCfQkYzWg== X-Received: by 10.46.74.10 with SMTP id x10mr1740973lja.8.1484077749229; Tue, 10 Jan 2017 11:49:09 -0800 (PST) Received: from [10.0.0.149] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by smtp.gmail.com with ESMTPSA id z68sm710111lff.35.2017.01.10.11.49.08 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 10 Jan 2017 11:49:08 -0800 (PST) To: unbearable@ietf.org From: Leif Johansson Message-ID: Date: Tue, 10 Jan 2017 20:49:07 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] respin WGLC X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jan 2017 19:49:13 -0000 Since we got so much feedback on the last WGLC the chairs propose a quick re-spin of the WGLC. If the authors would cut a new version of the core documents, we'll issue a new 2 week WGLC and hopefully take this one all the way! Cheers Leif From nobody Wed Jan 11 13:01:28 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C7BC12945C for ; Wed, 11 Jan 2017 13:01:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HdUM9h_MkkVp for ; Wed, 11 Jan 2017 13:01:25 -0800 (PST) Received: from mail-io0-x22a.google.com (mail-io0-x22a.google.com [IPv6:2607:f8b0:4001:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA0D912985F for ; Wed, 11 Jan 2017 13:01:25 -0800 (PST) Received: by mail-io0-x22a.google.com with SMTP id l66so3225863ioi.1 for ; Wed, 11 Jan 2017 13:01:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=DjB4Q8Lmx3XiVntIKdOD+CRVGjQoR8XGeVIqyZZbjtM=; b=M9H0lpwJARoQi7orsxmn0xNHgjMfnxAdviILEzwXpr/6DHDzYtVi0qmHtJY0OvbHl2 mxrO4WLFIAJerhf7P+CIQiaB9ZAFojV72bbrF3uHj5yetFQRfNXIMfTWMboqB/3ylwwH gFYUOelX9KK7prIigtOnRny3HJim8iU1Gh1BY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=DjB4Q8Lmx3XiVntIKdOD+CRVGjQoR8XGeVIqyZZbjtM=; b=I0GJerMkuTprxuLCiR40JQ14pbXgxTZCgKlpZPe9U+t/dnDo6EtjQTRV3NMzKWtwGE FJyV0yf9MO3q4qtmzgeNLL3auWH6CDsmBLFEim+kRhcb79Pps1dfnOegz2doCbnXHQ8l Nkn/y8JnvziLbWmiiE527mMZAVAgFlhw9TlH47kvCtExNzYNUI7PzfM/LR/aC4P9hDFr e/iYpLrvBokd+UDCuun4ilShCJ6t10JJJfXX6Corrn6lz7Wrl4DF4fvbteih35w5g/u2 fBxGFBZkpHNZ6xe4BpGnh1JT+64VzF2mAl0rNqp0jofpHzLD3j+6iU2Re7vEomr8wS99 SM1Q== X-Gm-Message-State: AIkVDXItdh0SXlHwD8zFwrrjqqCDf6d5nWj/U/YhJv7AQQeH+lTLoW15ofpoYKUU1DGI8NnUlDgyQnU2tsQ13Yiq X-Received: by 10.107.161.83 with SMTP id k80mr9788062ioe.47.1484168485080; Wed, 11 Jan 2017 13:01:25 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Wed, 11 Jan 2017 13:00:54 -0800 (PST) In-Reply-To: References: <148416636025.8139.11121446658834117013.idtracker@ietfa.amsl.com> From: Brian Campbell Date: Wed, 11 Jan 2017 14:00:54 -0700 Message-ID: To: IETF Tokbind WG Content-Type: multipart/alternative; boundary=001a1140fd3c5744a30545d7e7a0 Archived-At: Subject: [Unbearable] Fwd: New Version Notification for draft-campbell-tokbind-tls-term-00.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jan 2017 21:01:27 -0000 --001a1140fd3c5744a30545d7e7a0 Content-Type: text/plain; charset=UTF-8 Hi Unbearable Folks, I've uploaded the below individual draft, which is an initial attempt at describing how Token Binding would work with HTTP applications behind TLS terminating reverse proxies. This is the document that at end of the meeting in Seoul I said I was going to work on. But despite it taking me a long time to write, it isn't very long so should be an easy and quick read. Feedback is of course welcome. Thanks, Brian ---------- Forwarded message ---------- From: Date: Wed, Jan 11, 2017 at 1:26 PM Subject: New Version Notification for draft-campbell-tokbind-tls-term-00.txt A new version of I-D, draft-campbell-tokbind-tls-term-00.txt has been successfully submitted by Brian Campbell and posted to the IETF repository. Name: draft-campbell-tokbind-tls-term Revision: 00 Title: HTTPS Token Binding and TLS Terminating Reverse Proxies Document date: 2017-01-11 Group: Individual Submission Pages: 7 URL: https://www.ietf.org/internet-drafts/draft-campbell-tokbind- tls-term-00.txt Status: https://datatracker.ietf.org/doc/draft-campbell-tokbind-tls -term/ Htmlized: https://tools.ietf.org/html/draft-campbell-tokbind-tls-term -00 Abstract: This document defines an HTTP header field that enables a TLS terminating reverse proxy to convey the information a backend server needs in order for it to process and validate a Token Binding Message sent by the client. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --001a1140fd3c5744a30545d7e7a0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Unbearable Folks,

I've uploaded th= e below individual draft, which is an initial attempt at describing how Tok= en Binding would work with HTTP applications behind TLS terminating reverse= proxies. This is the document that at end of the meeting in Seoul I said I= was going to work on. But despite it taking me a long time to write, it is= n't very long so should be an easy and quick read. Feedback is of cours= e welcome.

Thanks,
Brian


<= div>

---------- Forwarded message ----------
From: <internet-drafts@ietf.org>
Date:= Wed, Jan 11, 2017 at 1:26 PM
Subject: New Version Notification for draf= t-campbell-tokbind-tls-term-00.txt



A new version of I-D, draft-campbell-tokbind-tls-term-00.txt
has been successfully submitted by Brian Campbell and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-campbell-tokbind-tls-te= rm
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HTTPS Token Binding and TLS Termin= ating Reverse Proxies
Document date:=C2=A0 2017-01-11
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 7
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-campbe= ll-tokbind-tls-term-00.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-campbell-tokbind-tls= -term/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0ht= tps://tools.ietf.org/html/draft-campbell-tokbind-tls-term-00<= br>

Abstract:
=C2=A0 =C2=A0This document defines an HTTP header field that enables a TLS<= br> =C2=A0 =C2=A0terminating reverse proxy to convey the information a backend = server
=C2=A0 =C2=A0needs in order for it to process and validate a Token Binding = Message
=C2=A0 =C2=A0sent by the client.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat



--001a1140fd3c5744a30545d7e7a0-- From nobody Wed Jan 11 14:20:14 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E958E129439 for ; Wed, 11 Jan 2017 14:20:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ix2SjjAmMZ9X for ; Wed, 11 Jan 2017 14:20:11 -0800 (PST) Received: from mail-qk0-x229.google.com (mail-qk0-x229.google.com [IPv6:2607:f8b0:400d:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 15B741295A5 for ; Wed, 11 Jan 2017 14:20:11 -0800 (PST) Received: by mail-qk0-x229.google.com with SMTP id s140so2161144qke.0 for ; Wed, 11 Jan 2017 14:20:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=TjO3/fSkAn5qs1wi04Jh1ZT9n7nTDRyvVNzrq4GHwe8=; b=Lhg0p4EHezC+EuN5P7OtNfe5r2768XpM7k+oVO4HfiOb8PbqpEyBK5JjCA1RYBqgHL y2549PCx/ysCP+ui7bLXkAwVO9RNkdM5cKBgSFjp45NSJxsiFKYrTDR8ho+SvprHoE0K 1fDcWOTBcicOqInu60cS1RQpJ20Q2ummpfwtXYg4ZLChgN+3uZlyHoVIc/l966YUKuxE 1eLV+4StT9osQVmHhUujazr9/O2ItKvPvzJsNWuPxZf+cIc2AN6mBfcEA0yf4A0Wjw6b kX7cf/lJAdMg0ixy5ZAQ+9KFp9IxAHQ5KcahEFle8NmVR11soydItHUtJfT026Fwf/76 Fb6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=TjO3/fSkAn5qs1wi04Jh1ZT9n7nTDRyvVNzrq4GHwe8=; b=b19as01rjCz4euuV8xPo6PEPISg0t3uWxLFKjXFaXc1Z5NvwxOmUyMi5qVi+Y0ArIZ vjn7+nkzS1c0Y4pSJSk+TWtGEXD2N+Qgeg3tsZHVq01Ryow8QHqRthgLNS8PyR1rS+qE FrvBZYotROtdAmKnLAie4bi2++dii0crwRxnZ0Rdi1ZWnFe3RdZE7BMaYW0jD3jEHmOv 4sR6+KhFAqvXNIX89S6f14O5o44x60g2rVyiRmVrpKUfv0/dXHlnYly6KlUnLGXScAZ/ II1rc3hLAqDeYNNdSudCiew5sU5i9ao/8UJxXCESndJBPPTiwPFCx3ZPRBjS3PHtxw6A /WQQ== X-Gm-Message-State: AIkVDXJIwabgs0D0zQSQGE7qaLA5WtHqsmHiD2up3swvgcz0aPswcHuDagWE+2Y716tCiHN/ X-Received: by 10.55.210.131 with SMTP id f125mr10890045qkj.98.1484173210084; Wed, 11 Jan 2017 14:20:10 -0800 (PST) Received: from jbradley-r.lan ([191.115.178.163]) by smtp.gmail.com with ESMTPSA id j9sm5129007qtc.23.2017.01.11.14.20.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 11 Jan 2017 14:20:09 -0800 (PST) From: John Bradley Message-Id: Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 11 Jan 2017 19:19:50 -0300 In-Reply-To: To: Brian Campbell References: <148416636025.8139.11121446658834117013.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3259) Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="94eb2c04f06afc86aa0545d9007d" Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] Fwd: New Version Notification for draft-campbell-tokbind-tls-term-00.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jan 2017 22:20:13 -0000 --94eb2c04f06afc86aa0545d9007d Content-Type: multipart/alternative; boundary="Apple-Mail=_DE0BC4E0-8BDC-4A2D-B5B2-7D06C2DB219A" --Apple-Mail=_DE0BC4E0-8BDC-4A2D-B5B2-7D06C2DB219A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Thanks Brian, Perhaps you can explain why you chose to pass along the EKM and = additional parameters to the server and have it validate the token = binding vs having the reverse proxy validate it and pass along the = validated token binding ID. I would like to capture that to the list as it will be asked. After some discussion we can decide if the WG wants to adopt this draft = as a WG document. John B. > On Jan 11, 2017, at 6:00 PM, Brian Campbell = wrote: >=20 > Hi Unbearable Folks, >=20 > I've uploaded the below individual draft, which is an initial attempt = at describing how Token Binding would work with HTTP applications behind = TLS terminating reverse proxies. This is the document that at end of the = meeting in Seoul I said I was going to work on. But despite it taking me = a long time to write, it isn't very long so should be an easy and quick = read. Feedback is of course welcome.=20 >=20 > Thanks, > Brian >=20 >=20 >=20 > ---------- Forwarded message ---------- > From: > > Date: Wed, Jan 11, 2017 at 1:26 PM > Subject: New Version Notification for = draft-campbell-tokbind-tls-term-00.txt >=20 >=20 >=20 > A new version of I-D, draft-campbell-tokbind-tls-term-00.txt > has been successfully submitted by Brian Campbell and posted to the > IETF repository. >=20 > Name: draft-campbell-tokbind-tls-term > Revision: 00 > Title: HTTPS Token Binding and TLS Terminating Reverse = Proxies > Document date: 2017-01-11 > Group: Individual Submission > Pages: 7 > URL: = https://www.ietf.org/internet-drafts/draft-campbell-tokbind-tls-term-00.tx= t = > Status: = https://datatracker.ietf.org/doc/draft-campbell-tokbind-tls-term/ = > Htmlized: = https://tools.ietf.org/html/draft-campbell-tokbind-tls-term-00 = >=20 >=20 > Abstract: > This document defines an HTTP header field that enables a TLS > terminating reverse proxy to convey the information a backend = server > needs in order for it to process and validate a Token Binding = Message > sent by the client. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org = . >=20 > The IETF Secretariat >=20 >=20 >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail=_DE0BC4E0-8BDC-4A2D-B5B2-7D06C2DB219A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Thanks Brian,

Perhaps you can explain why you chose to pass along the EKM = and additional parameters to the server and have it validate the token = binding vs having the reverse proxy validate it and pass along the = validated token binding ID.

I would like to capture that to the list as it will be = asked.

After = some discussion we can decide if the WG wants to adopt this draft as a = WG document.

John B.

On Jan 11, 2017, at 6:00 PM, = Brian Campbell <bcampbell@pingidentity.com> wrote:

Hi Unbearable Folks,

I've uploaded the below individual draft, = which is an initial attempt at describing how Token Binding would work = with HTTP applications behind TLS terminating reverse proxies. This is = the document that at end of the meeting in Seoul I said I was going to = work on. But despite it taking me a long time to write, it isn't very = long so should be an easy and quick read. Feedback is of course welcome. =

Thanks,
Brian



---------- Forwarded message ----------
From: <internet-drafts@ietf.org>
Date: Wed, Jan 11, 2017 at 1:26 PM
Subject: New = Version Notification for draft-campbell-tokbind-tls-term-00.txt



A new version of I-D, draft-campbell-tokbind-tls-term-00.txt
has been successfully submitted by Brian Campbell and posted to the
IETF repository.

Name:          =  draft-campbell-tokbind-tls-term
Revision:       00
Title:          HTTPS Token Binding and TLS = Terminating Reverse Proxies
Document date:  2017-01-11
Group:          Individual Submission
Pages:          7
URL:            https://www.ietf.org/internet-drafts/draft-campbell-tokbind-tls-term-00.txt
Status:         https://datatracker.ietf.org/doc/draft-campbell-tokbind-tls-term/
Htmlized:       https://tools.ietf.org/html/draft-campbell-tokbind-tls-term-00


Abstract:
   This document defines an HTTP header field that enables a = TLS
   terminating reverse proxy to convey the information a = backend server
   needs in order for it to process and validate a Token = Binding Message
   sent by the client.




Please note that it may take a couple of minutes from the time of = submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat



_______________________________________________
Unbearable = mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

= --Apple-Mail=_DE0BC4E0-8BDC-4A2D-B5B2-7D06C2DB219A-- --94eb2c04f06afc86aa0545d9007d Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIRGwYJKoZIhvcNAQcCoIIRDDCCEQgCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg gg4rMIIErzCCA5egAwIBAgIRAOAjyxUSg1OJrWFuelRnayEwDQYJKoZIhvcNAQELBQAwbzELMAkG A1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDAeFw0xNDEy MjIwMDAwMDBaFw0yMDA1MzAxMDQ4MzhaMIGbMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRl ciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRl ZDFBMD8GA1UEAxM4Q09NT0RPIFNIQS0yNTYgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1 cmUgRW1haWwgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCJsQ3aelMZTnBSHbxW pgYmt7hJ4JbnUavx8FoTSRWjtIwbYLx6UUKneYykIt8XYU6R1XYjChTTSgJ/th0JgG6lBD3ZursW /qGHqS5DUkMWfK8yUMimT1rpCNjPkyWce4joMGTmpPhWgP0qJBQzF5msROVpi6NGBkvCM9TpQJ8G sLGsk0C5tQiTOpwqU6MQ2z0gYTxVA47ZTnYlAiEp+qN8cXZP7uFfgen7VIDbw3s1UreE3iI9LDAt MX9ZvVI3sDNpLUPr+tal8Zd3Z1GM2e4n67ylBzh2jKSpOP/fjPUDrEm+yvdzmToPMquclToTPQ5G Old0YVC+xkA/y+Tin6IhAgMBAAGjggEXMIIBEzAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTvA73g JMtUGjAdBgNVHQ4EFgQUkmFrguGioKpP7GfxwqP3tIAAwewwDgYDVR0PAQH/BAQDAgGGMBIGA1Ud EwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBEGA1UdIAQKMAgw BgYEVR0gADBEBgNVHR8EPTA7MDmgN6A1hjNodHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vQWRkVHJ1 c3RFeHRlcm5hbENBUm9vdC5jcmwwNQYIKwYBBQUHAQEEKTAnMCUGCCsGAQUFBzABhhlodHRwOi8v b2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQAbKm6sVcE6q4jF2O3NVfOqa2Er wAkQI5kPxWZqb7H1tLV3Xg8CYQDffQX+ErOkgIAA/PsdW2pyAgpBvAW6wVjVJsLq1U2E+/6CmM9Y G+MiY5xS+LsFNqt9WKXeqztj5drVc+/s4Pt74qP/8EIjnMq2jU0+5EsYA7KoLdTYu0JLkGmFENum NzToe+ABEKWcyjrHn0+ING6KZdAairup3MrKNtH0/MJkKTWv1rGncRHSA0Oxjz6a7J4yU/R2ksqG NAe5LMrmHErYmQ3BhuKQkvtaQmojIRDpZcf11bt+6oyFIAJi6tE6ByxZxZkz8jiJ5bbpFnofeRT2 ShAaJvp8ivubMIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3 b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoX DTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYD VQQLEx1BZGRUcnVzdCBFeHRlcm5hbCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0 ZXJuYWwgQ0EgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTng TlvtH7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9uMq/Nzgt Hj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzXmk6vBbOmcZSccbNQYArH E504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LXa0Tkx63ubUFfclpxCDezeWWkWaCUN/cA Lw3CknLa0Dhy2xSoRcRdKn23tNbE7qzNE0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3Citl ttNCbxWyuHv77+ldU9U0WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTL VBowCwYDVR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0Jvf6 xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQG A1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0IEV4 dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5 gdkeWxQHIzZlj7DYd7usQWxHYINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKW t9x+Tu5w/Rw56wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEXc4g/VhsxOBi0 cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5amnkPIAou1Z5jJh5VkpTYghda e9C8x49OhgQwggU6MIIEIqADAgECAhEA2TLMtWuXNcB2cbqZ/VgVujANBgkqhkiG9w0BAQsFADCB mzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2Fs Zm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxQTA/BgNVBAMTOENPTU9ETyBTSEEtMjU2 IENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMB4XDTE3MDEwOTAwMDAw MFoXDTE4MDEwOTIzNTk1OVowIjEgMB4GCSqGSIb3DQEJARYRdmU3anRiQHZlN2p0Yi5jb20wggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDW2rqobOFQ/XmzH3DG2UK1Dt6jtc+OFZ71KQoB o8IZa/V94Ey12BPjBcoj+cjHNVsLd2QiUpMcf5sZFMX1cmvpR7TiUISgVcHe8zgiUUvN5Jn5tPDM Kb4E34TtDEG2X5FyY35AwCl8NV/loj2D5KLid9BLdVTJjfqokjLQ/4qCQjWBjfTpIdAdr3lXfg5f a5UPyIkphEIplM8/yGfX0W/PBl804XAL0gesLrfEMdgG58UCN1wJMgH4uRKmKU/U2Ap4W9hTpioN M722U8x7N6P1v6MqTAWCUaskdOp+ktNxFGxOlCE7BEo/EIaWbEt5RHwDePctScDLsi56+VI3TysR AgMBAAGjggHvMIIB6zAfBgNVHSMEGDAWgBSSYWuC4aKgqk/sZ/HCo/e0gADB7DAdBgNVHQ4EFgQU Yg3SsFWhMro4Abonbn1IX4JKj5QwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwIAYDVR0l BBkwFwYIKwYBBQUHAwQGCysGAQQBsjEBAwUCMBEGCWCGSAGG+EIBAQQEAwIFIDBGBgNVHSAEPzA9 MDsGDCsGAQQBsjEBAgEBATArMCkGCCsGAQUFBwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8ubmV0 L0NQUzBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9TSEEy NTZDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3VyZUVtYWlsQ0EuY3JsMIGQBggrBgEFBQcBAQSB gzCBgDBYBggrBgEFBQcwAoZMaHR0cDovL2NydC5jb21vZG9jYS5jb20vQ09NT0RPU0hBMjU2Q2xp ZW50QXV0aGVudGljYXRpb25hbmRTZWN1cmVFbWFpbENBLmNydDAkBggrBgEFBQcwAYYYaHR0cDov L29jc3AuY29tb2RvY2EuY29tMBwGA1UdEQQVMBOBEXZlN2p0YkB2ZTdqdGIuY29tMA0GCSqGSIb3 DQEBCwUAA4IBAQCC26y+6/+SJoRQWepca+rB9eSSwaCAb8nNqA+00ZiOHb+6UbbV1xa7Z8wDIuEL 5UKbNtQ2NDArvzF9YI0xNafoV1AEmP/3+ljxQHSEI0U1p2h401sOx+nSjcwtTzACso1lw+I0oJYM JFITOIfZy8HgFpCipBrQAp9jMJ+KSKDX3xu/hzPosfdnXp7sV1KAjkFrAtR3AnQYfJ5W8QrsmC4N BbiAKoYWUSdklqn3v1neTG/+oOhcw7hcGZo+YmPyF9Cdy0gBtwSHPt8hluhg2TlzmqYfi0dVL/mU jCBNUY/BFH+MBqKF7sOIRMv8ALWceVaM/NEcBciKs4eR99A4cw9ZMYICtDCCArACAQEwgbEwgZsx CzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZv cmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMUEwPwYDVQQDEzhDT01PRE8gU0hBLTI1NiBD bGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRANkyzLVrlzXAdnG6mf1Y FbowDQYJYIZIAWUDBAIBBQCggdQwLwYJKoZIhvcNAQkEMSIEIIo7acROJJ+NYY7rikn5r3O5bHqk nys+WpXSuSvrORKiMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE3 MDExMTIyMjAxMFowaQYJKoZIhvcNAQkPMVwwWjALBglghkgBZQMEASowCwYJYIZIAWUDBAEWMAsG CWCGSAFlAwQBAjAKBggqhkiG9w0DBzALBgkqhkiG9w0BAQowCwYJKoZIhvcNAQEHMAsGCWCGSAFl AwQCATANBgkqhkiG9w0BAQEFAASCAQC3+1XOk4eYLbCr7GQyVgpklf2FGKEoLFM1qSsc7a27zOsZ glZqKyD542eC4xKXcZGtY6KL8CDZYY8j6Pj3QBEcRBImSXvDfAX1fNNBSxQIUAIuWRf9KerhtHCc YwlHeiQiWCWB+zwz79mUfYWJWiWa2VKKhDLaEanMpHPhgdPsokIlsHPhkReWRuk+C9ez7ospuHXK rQ2HKbqPrtGmJ4ouTjMb3fEMpBQp6D7cOZSJb0wF142QM+10H2p4LEg8Eyri6QHHxvpSZEWB+pOf XIAfYoP8XnF6tOIDLxMOckmuZ41KdtV2NN5eXbadVyC0g8gzirjE6hkxCAsgZKrzZZiS --94eb2c04f06afc86aa0545d9007d-- From nobody Wed Jan 11 15:39:55 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C4D7129476 for ; Wed, 11 Jan 2017 15:39:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wyVGIme1tzPZ for ; Wed, 11 Jan 2017 15:39:51 -0800 (PST) Received: from mail-it0-x235.google.com (mail-it0-x235.google.com [IPv6:2607:f8b0:4001:c0b::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11A9F1295BE for ; Wed, 11 Jan 2017 15:39:51 -0800 (PST) Received: by mail-it0-x235.google.com with SMTP id r185so996139ita.0 for ; Wed, 11 Jan 2017 15:39:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=lOdep142bW30rsglbGaHIoUpdqoyN90heEdBpXoxcLc=; b=I26dSRwsTR+LkzJ8eJ2NNc2MFQno3P5jJxm2yENwgHx6C3hlakHvqAOBxfxJm6+uCi M/SRAltFAqalcumgKNJxO18IdUCspgy+leeXWFIJHqVBJE8wPOkXQzsvjiiFsi173nd2 6qqF211yUIKm7d4Gc+7at6P2mw5yvPif3jp3Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=lOdep142bW30rsglbGaHIoUpdqoyN90heEdBpXoxcLc=; b=QdLzmwvlrQy0aVCJFwUkfh7HSy5PUZapqslE1WIilibde1CSutUqY+aKoh/8TR8JLg FrCERcMLnnUURraY+zMMys9LuNgPtaKMqV44Kg0R0fJ1xBJ4saq8/b/4IZGOvYQ7/iAA hbhFk5GiAT1cLgZYuJnyIo0WiJrHJ3D9gLOYYoZdAg35Jg05LQcfq9Ai/bM56uvFaCfR XQGaJbL7RkoylxuOmrGUrZSoDHG/yFNF5/5w102h8mD5uEe30vbcP00uphXYH0bXuS+X 2PKqHEwLIn15HSWrdcawrd/WxFD6PdIVOGwRQTpaWGrGrm9qseuTSlQqelP3Q7agY7c0 Me7w== X-Gm-Message-State: AIkVDXKOHafbGVq9742ftphTKKgwmh6BbtlJ2OOOcYBhqNOoY/Iywxb28Ri4CfweXOxR/WRqEyMYdE0n2K6uZnhX X-Received: by 10.36.225.195 with SMTP id n186mr7506434ith.35.1484177990283; Wed, 11 Jan 2017 15:39:50 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Wed, 11 Jan 2017 15:39:19 -0800 (PST) In-Reply-To: References: <148416636025.8139.11121446658834117013.idtracker@ietfa.amsl.com> From: Brian Campbell Date: Wed, 11 Jan 2017 16:39:19 -0700 Message-ID: To: John Bradley Content-Type: multipart/alternative; boundary=94eb2c19d676e50e860545da1d17 Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] Fwd: New Version Notification for draft-campbell-tokbind-tls-term-00.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jan 2017 23:39:53 -0000 --94eb2c19d676e50e860545da1d17 Content-Type: text/plain; charset=UTF-8 I wavered back and forth on it, to be honest. The change in TBPROTO-11/HTTPSTB-07 to application specific handling of rejected Token Bindings rather than terminating the connection tilted me in this direction. My sense of the room in Seoul was also that there was some preference for this approach (some said so explicitly but my general feeling about the room seemed to be such). It lets the TLS terminator be as dumb as possible with respect to token binding, which I suspect will be desirable in many cases. It feels (to me anyway) like the more logical separation of duties where the TLS terminator/reverse proxy does the negotiation and connection and then provides just enough info from the TLS layer to the upstream application that will do the message/token processing and validation. That's some of my thinking on it anyway. On Wed, Jan 11, 2017 at 3:19 PM, John Bradley wrote: > Thanks Brian, > > Perhaps you can explain why you chose to pass along the EKM and additional > parameters to the server and have it validate the token binding vs having > the reverse proxy validate it and pass along the validated token binding ID. > > I would like to capture that to the list as it will be asked. > > After some discussion we can decide if the WG wants to adopt this draft as > a WG document. > > John B. > > On Jan 11, 2017, at 6:00 PM, Brian Campbell > wrote: > > Hi Unbearable Folks, > > I've uploaded the below individual draft, which is an initial attempt at > describing how Token Binding would work with HTTP applications behind TLS > terminating reverse proxies. This is the document that at end of the > meeting in Seoul I said I was going to work on. But despite it taking me a > long time to write, it isn't very long so should be an easy and quick read. > Feedback is of course welcome. > > Thanks, > Brian > > > > ---------- Forwarded message ---------- > From: > Date: Wed, Jan 11, 2017 at 1:26 PM > Subject: New Version Notification for draft-campbell-tokbind-tls-ter > m-00.txt > > > > A new version of I-D, draft-campbell-tokbind-tls-term-00.txt > has been successfully submitted by Brian Campbell and posted to the > IETF repository. > > Name: draft-campbell-tokbind-tls-term > Revision: 00 > Title: HTTPS Token Binding and TLS Terminating Reverse Proxies > Document date: 2017-01-11 > Group: Individual Submission > Pages: 7 > URL: https://www.ietf.org/internet- > drafts/draft-campbell-tokbind-tls-term-00.txt > Status: https://datatracker.ietf.org/ > doc/draft-campbell-tokbind-tls-term/ > Htmlized: https://tools.ietf.org/html/d > raft-campbell-tokbind-tls-term-00 > > > Abstract: > This document defines an HTTP header field that enables a TLS > terminating reverse proxy to convey the information a backend server > needs in order for it to process and validate a Token Binding Message > sent by the client. > > > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > The IETF Secretariat > > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > > --94eb2c19d676e50e860545da1d17 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I wavered back and forth on it, to be honest. The change i= n TBPROTO-11/HTTPSTB-07 to application specific handling of rejected Token = Bindings rather than terminating the connection tilted me in this direction= . My sense of the room in Seoul was also that there was some preference for= this approach (some said so explicitly but my general feeling about the ro= om seemed to be such). It lets the TLS terminator be as dumb as possible wi= th respect to token binding, which I suspect will be desirable in many case= s. It feels (to me anyway) like the more logical separation of duties where= the TLS terminator/reverse proxy does the negotiation and connection and t= hen provides just enough info from the TLS layer to the upstream applicatio= n that will do the message/token processing and validation. That's some= of my thinking on it anyway.

On Wed, Jan 11, 2017 at 3:19 PM, John Bradley <ve7jtb@ve7= jtb.com> wrote:
Thanks Brian,

Perhaps you can = explain why you chose to pass along the EKM and additional parameters to th= e server and have it validate the token binding vs having the reverse proxy= validate it and pass along the validated token binding ID.

<= /div>
I would like to capture that to the list as it will be asked.

After some discussion we can decide if the WG wants t= o adopt this draft as a WG document.

John B.
=

On Jan 11, 2017, at 6:00 PM, Brian Campbell <bcampbell@pingidentity.= com> wrote:

Hi Unbearable Folks,

I= 've uploaded the below individual draft, which is an initial attempt at= describing how Token Binding would work with HTTP applications behind TLS = terminating reverse proxies. This is the document that at end of the meetin= g in Seoul I said I was going to work on. But despite it taking me a long t= ime to write, it isn't very long so should be an easy and quick read. F= eedback is of course welcome.

Thanks,
Brian
=


---------- Forwarded message ----------
From= : <internet-drafts@ietf.org&= gt;
Date: Wed, Jan 11, 2017 at 1:26 PM
Subject: New Version No= tification for draft-campbell-tokbind-tls-term-00.txt



A new version of I-D, draft-campbell-tokbind-tls-term-00.txt
has been successfully submitted by Brian Campbell and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-campbell-tokbind-tls-te= rm
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HTTPS Token Binding and TLS Termin= ating Reverse Proxies
Document date:=C2=A0 2017-01-11
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 7
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-campbe= ll-tokbind-tls-term-00.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-campbell-tokbind-tls= -term/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0ht= tps://tools.ietf.org/html/draft-campbell-tokbind-tls-term-00<= br>

Abstract:
=C2=A0 =C2=A0This document defines an HTTP header field that enables a TLS<= br> =C2=A0 =C2=A0terminating reverse proxy to convey the information a backend = server
=C2=A0 =C2=A0needs in order for it to process and validate a Token Binding = Message
=C2=A0 =C2=A0sent by the client.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat



_______________________________________________
Unbearable mailing = list
Unbearable= @ietf.org
https://www.ietf.org/mailman/listinfo/unbearable<= /a>


--94eb2c19d676e50e860545da1d17-- From nobody Wed Jan 11 15:50:59 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9345D1295BE for ; Wed, 11 Jan 2017 15:50:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GSa-ecpdojpg for ; Wed, 11 Jan 2017 15:50:55 -0800 (PST) Received: from mail-qk0-x229.google.com (mail-qk0-x229.google.com [IPv6:2607:f8b0:400d:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D057129476 for ; Wed, 11 Jan 2017 15:50:54 -0800 (PST) Received: by mail-qk0-x229.google.com with SMTP id a20so4044336qkc.1 for ; Wed, 11 Jan 2017 15:50:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ima9U5PLDC7ez8WH282Zd0vzVjuEIhBVY+ucDnCKs/8=; b=fTmfwgOEDL5ExE429hUrSY5AdbQSALWTLqoRVzqGBaijN7NoxohWrkhyFq/c6WaiKk OIZcsKa6PF7HgzK9xOHcnVPWstBGuNEGm2luOjG9aZCsdsdqUsDNtm8dRXNFxUCHVMqy gpkb/GJl5sn9WC3qykHnLCNRUogylTV/ffAgLUYVKaw3LfoTsrReyU4lmgQ4p4ZMJi3g Ex5Nn8+P/E+xt6CcEByjtkZk1mSR89sjy5WrnFo/PxQ1zgj7YLdWrWGTRllcgFy8WTLR Tm+6pDjh7/5dyCHAJb7UlTxdLXCxHv282vUnwnOrIm6yh6SXgGMPmZ3wy+BWhY7FKHs0 qKuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ima9U5PLDC7ez8WH282Zd0vzVjuEIhBVY+ucDnCKs/8=; b=ZLLK3Q+DYODDJnHC7KS/9yE1MVd3sATMa+CZjqL97Gh71+N1LYyDQ9UnrqfM+XJe5E k8Yya0Bkf8vfK2DvVPWnhS+I3qxOZGoSTxzCl7MF5rU7CIKl0jqitlSoR4aiv5kZ/vWs vqnZYETFj4pZkG5ItMeEM1ItGKTBPRwiFmBq4nEA63WIEUpLjB3+oObX5sNDMWhXoAMk FWfBmi1wYaI+zSUtt8r7vUUIQLmlHRBBpdaYNsZ+TEyd3TXgodRSrpqWJaVj8gprYNYY PWT69LjX1eX7KhJ1Ibz5bHf3AkS2h09BINkuyUj8MBfd4BnDurxKW5902uW+d0wOwumF M58A== X-Gm-Message-State: AIkVDXL/HUZnuGikMIVJi7jX7eNkCTZTXe6O+YlTseeaHUifX54s8FFqXrYhZLh/umN+Mefz X-Received: by 10.55.157.17 with SMTP id g17mr11854239qke.122.1484178653942; Wed, 11 Jan 2017 15:50:53 -0800 (PST) Received: from jbradley-r.lan ([191.115.178.163]) by smtp.gmail.com with ESMTPSA id q145sm5274228qke.37.2017.01.11.15.50.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 11 Jan 2017 15:50:53 -0800 (PST) From: John Bradley Message-Id: <48079792-5928-4497-8D3F-D64E0A61CADC@ve7jtb.com> Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 11 Jan 2017 20:50:17 -0300 In-Reply-To: To: Brian Campbell References: <148416636025.8139.11121446658834117013.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3259) Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="94eb2c06f1b6771dee0545da450c" Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] Fwd: New Version Notification for draft-campbell-tokbind-tls-term-00.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jan 2017 23:50:57 -0000 --94eb2c06f1b6771dee0545da450c Content-Type: multipart/alternative; boundary="Apple-Mail=_268FCCCE-B12C-40C4-B64D-1A9D1032AFE7" --Apple-Mail=_268FCCCE-B12C-40C4-B64D-1A9D1032AFE7 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 The application specific handling of rejected token bindings is probably = simplest if handled at the server.=20 The other option would be to add error codes about why it failed. This proposal would let the application layer do all of the token = binding processing without modifying TLS on the server. The other consumers of something like this would be a cloud Access = Security Broker, that is auditing (Snooping) on connections. =20 That might have TLS on both sides as it could be in the cloud. I = don=E2=80=99t think there would be any issue with re-wrappoing this in = another mutual TLS connection. John B. > On Jan 11, 2017, at 8:39 PM, Brian Campbell = wrote: >=20 > I wavered back and forth on it, to be honest. The change in = TBPROTO-11/HTTPSTB-07 to application specific handling of rejected Token = Bindings rather than terminating the connection tilted me in this = direction. My sense of the room in Seoul was also that there was some = preference for this approach (some said so explicitly but my general = feeling about the room seemed to be such). It lets the TLS terminator be = as dumb as possible with respect to token binding, which I suspect will = be desirable in many cases. It feels (to me anyway) like the more = logical separation of duties where the TLS terminator/reverse proxy does = the negotiation and connection and then provides just enough info from = the TLS layer to the upstream application that will do the message/token = processing and validation. That's some of my thinking on it anyway.=20 >=20 > On Wed, Jan 11, 2017 at 3:19 PM, John Bradley > wrote: > Thanks Brian, >=20 > Perhaps you can explain why you chose to pass along the EKM and = additional parameters to the server and have it validate the token = binding vs having the reverse proxy validate it and pass along the = validated token binding ID. >=20 > I would like to capture that to the list as it will be asked. >=20 > After some discussion we can decide if the WG wants to adopt this = draft as a WG document. >=20 > John B. >=20 >> On Jan 11, 2017, at 6:00 PM, Brian Campbell = > wrote: >>=20 >> Hi Unbearable Folks, >>=20 >> I've uploaded the below individual draft, which is an initial attempt = at describing how Token Binding would work with HTTP applications behind = TLS terminating reverse proxies. This is the document that at end of the = meeting in Seoul I said I was going to work on. But despite it taking me = a long time to write, it isn't very long so should be an easy and quick = read. Feedback is of course welcome.=20 >>=20 >> Thanks, >> Brian >>=20 >>=20 >>=20 >> ---------- Forwarded message ---------- >> From: > >> Date: Wed, Jan 11, 2017 at 1:26 PM >> Subject: New Version Notification for = draft-campbell-tokbind-tls-term-00.txt >>=20 >>=20 >>=20 >> A new version of I-D, draft-campbell-tokbind-tls-term-00.txt >> has been successfully submitted by Brian Campbell and posted to the >> IETF repository. >>=20 >> Name: draft-campbell-tokbind-tls-term >> Revision: 00 >> Title: HTTPS Token Binding and TLS Terminating Reverse = Proxies >> Document date: 2017-01-11 >> Group: Individual Submission >> Pages: 7 >> URL: = https://www.ietf.org/internet-drafts/draft-campbell-tokbind-tls-term-00.tx= t = >> Status: = https://datatracker.ietf.org/doc/draft-campbell-tokbind-tls-term/ = >> Htmlized: = https://tools.ietf.org/html/draft-campbell-tokbind-tls-term-00 = >>=20 >>=20 >> Abstract: >> This document defines an HTTP header field that enables a TLS >> terminating reverse proxy to convey the information a backend = server >> needs in order for it to process and validate a Token Binding = Message >> sent by the client. >>=20 >>=20 >>=20 >>=20 >> Please note that it may take a couple of minutes from the time of = submission >> until the htmlized version and diff are available at tools.ietf.org = . >>=20 >> The IETF Secretariat >>=20 >>=20 >>=20 >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable = >=20 >=20 --Apple-Mail=_268FCCCE-B12C-40C4-B64D-1A9D1032AFE7 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 The application specific handling of rejected token bindings = is probably simplest if handled at the server. 

The other option would be to add error = codes about why it failed.

This proposal would let the application layer do all of the = token binding processing without modifying TLS on the server.

The other consumers of = something like this would be a cloud Access Security Broker, that is = auditing (Snooping) on connections.  
That = might have TLS on both sides as it could be in the cloud.   I = don=E2=80=99t think there would be any issue with re-wrappoing this in = another mutual TLS connection.

John B.

On = Jan 11, 2017, at 8:39 PM, Brian Campbell <bcampbell@pingidentity.com> wrote:

I wavered back and forth on it, to be honest. The change in = TBPROTO-11/HTTPSTB-07 to application specific handling of rejected Token = Bindings rather than terminating the connection tilted me in this = direction. My sense of the room in Seoul was also that there was some = preference for this approach (some said so explicitly but my general = feeling about the room seemed to be such). It lets the TLS terminator be = as dumb as possible with respect to token binding, which I suspect will = be desirable in many cases. It feels (to me anyway) like the more = logical separation of duties where the TLS terminator/reverse proxy does = the negotiation and connection and then provides just enough info from = the TLS layer to the upstream application that will do the message/token = processing and validation. That's some of my thinking on it anyway.

On Wed, Jan 11, 2017 at 3:19 PM, John Bradley = <ve7jtb@ve7jtb.com> wrote:
Thanks Brian,
Perhaps you can explain why you chose = to pass along the EKM and additional parameters to the server and have = it validate the token binding vs having the reverse proxy validate it = and pass along the validated token binding ID.

I would like to capture that to the = list as it will be asked.

After some discussion we can decide if the WG wants to adopt = this draft as a WG document.

John B.

On = Jan 11, 2017, at 6:00 PM, Brian Campbell <bcampbell@pingidentity.com> wrote:

Hi Unbearable Folks,

I've uploaded the below individual draft, which is an initial = attempt at describing how Token Binding would work with HTTP = applications behind TLS terminating reverse proxies. This is the = document that at end of the meeting in Seoul I said I was going to work = on. But despite it taking me a long time to write, it isn't very long so = should be an easy and quick read. Feedback is of course welcome.

Thanks,
Brian



---------- Forwarded message ----------
From: <internet-drafts@ietf.org>
Date: Wed, Jan 11, 2017 at 1:26 PM
Subject: New = Version Notification for draft-campbell-tokbind-tls-term-00.txt



A new version of I-D, draft-campbell-tokbind-tls-term-00.txt
has been successfully submitted by Brian Campbell and posted to the
IETF repository.

Name:          =  draft-campbell-tokbind-tls-term
Revision:       00
Title:          HTTPS Token Binding and TLS = Terminating Reverse Proxies
Document date:  2017-01-11
Group:          Individual Submission
Pages:          7
URL:            https://www.ietf.org/internet-drafts/draft-campbell-tokbind-tls-term-00.txt
Status:         https://datatracker.ietf.org/doc/draft-campbell-tokbind-tls-term/
Htmlized:       https://tools.ietf.org/html/draft-campbell-tokbind-tls-term-00


Abstract:
   This document defines an HTTP header field that enables a = TLS
   terminating reverse proxy to convey the information a = backend server
   needs in order for it to process and validate a Token = Binding Message
   sent by the client.




Please note that it may take a couple of minutes from the time of = submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat



_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable



= --Apple-Mail=_268FCCCE-B12C-40C4-B64D-1A9D1032AFE7-- --94eb2c06f1b6771dee0545da450c Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIRGwYJKoZIhvcNAQcCoIIRDDCCEQgCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg gg4rMIIErzCCA5egAwIBAgIRAOAjyxUSg1OJrWFuelRnayEwDQYJKoZIhvcNAQELBQAwbzELMAkG A1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDAeFw0xNDEy MjIwMDAwMDBaFw0yMDA1MzAxMDQ4MzhaMIGbMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRl ciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRl ZDFBMD8GA1UEAxM4Q09NT0RPIFNIQS0yNTYgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1 cmUgRW1haWwgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCJsQ3aelMZTnBSHbxW pgYmt7hJ4JbnUavx8FoTSRWjtIwbYLx6UUKneYykIt8XYU6R1XYjChTTSgJ/th0JgG6lBD3ZursW /qGHqS5DUkMWfK8yUMimT1rpCNjPkyWce4joMGTmpPhWgP0qJBQzF5msROVpi6NGBkvCM9TpQJ8G sLGsk0C5tQiTOpwqU6MQ2z0gYTxVA47ZTnYlAiEp+qN8cXZP7uFfgen7VIDbw3s1UreE3iI9LDAt MX9ZvVI3sDNpLUPr+tal8Zd3Z1GM2e4n67ylBzh2jKSpOP/fjPUDrEm+yvdzmToPMquclToTPQ5G Old0YVC+xkA/y+Tin6IhAgMBAAGjggEXMIIBEzAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTvA73g JMtUGjAdBgNVHQ4EFgQUkmFrguGioKpP7GfxwqP3tIAAwewwDgYDVR0PAQH/BAQDAgGGMBIGA1Ud EwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBEGA1UdIAQKMAgw BgYEVR0gADBEBgNVHR8EPTA7MDmgN6A1hjNodHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vQWRkVHJ1 c3RFeHRlcm5hbENBUm9vdC5jcmwwNQYIKwYBBQUHAQEEKTAnMCUGCCsGAQUFBzABhhlodHRwOi8v b2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQAbKm6sVcE6q4jF2O3NVfOqa2Er wAkQI5kPxWZqb7H1tLV3Xg8CYQDffQX+ErOkgIAA/PsdW2pyAgpBvAW6wVjVJsLq1U2E+/6CmM9Y G+MiY5xS+LsFNqt9WKXeqztj5drVc+/s4Pt74qP/8EIjnMq2jU0+5EsYA7KoLdTYu0JLkGmFENum NzToe+ABEKWcyjrHn0+ING6KZdAairup3MrKNtH0/MJkKTWv1rGncRHSA0Oxjz6a7J4yU/R2ksqG NAe5LMrmHErYmQ3BhuKQkvtaQmojIRDpZcf11bt+6oyFIAJi6tE6ByxZxZkz8jiJ5bbpFnofeRT2 ShAaJvp8ivubMIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3 b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoX DTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYD VQQLEx1BZGRUcnVzdCBFeHRlcm5hbCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0 ZXJuYWwgQ0EgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTng TlvtH7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9uMq/Nzgt Hj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzXmk6vBbOmcZSccbNQYArH E504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LXa0Tkx63ubUFfclpxCDezeWWkWaCUN/cA Lw3CknLa0Dhy2xSoRcRdKn23tNbE7qzNE0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3Citl ttNCbxWyuHv77+ldU9U0WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTL VBowCwYDVR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0Jvf6 xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQG A1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0IEV4 dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcNAQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5 gdkeWxQHIzZlj7DYd7usQWxHYINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKW t9x+Tu5w/Rw56wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEXc4g/VhsxOBi0 cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5amnkPIAou1Z5jJh5VkpTYghda e9C8x49OhgQwggU6MIIEIqADAgECAhEA2TLMtWuXNcB2cbqZ/VgVujANBgkqhkiG9w0BAQsFADCB mzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2Fs Zm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxQTA/BgNVBAMTOENPTU9ETyBTSEEtMjU2 IENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMB4XDTE3MDEwOTAwMDAw MFoXDTE4MDEwOTIzNTk1OVowIjEgMB4GCSqGSIb3DQEJARYRdmU3anRiQHZlN2p0Yi5jb20wggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDW2rqobOFQ/XmzH3DG2UK1Dt6jtc+OFZ71KQoB o8IZa/V94Ey12BPjBcoj+cjHNVsLd2QiUpMcf5sZFMX1cmvpR7TiUISgVcHe8zgiUUvN5Jn5tPDM Kb4E34TtDEG2X5FyY35AwCl8NV/loj2D5KLid9BLdVTJjfqokjLQ/4qCQjWBjfTpIdAdr3lXfg5f a5UPyIkphEIplM8/yGfX0W/PBl804XAL0gesLrfEMdgG58UCN1wJMgH4uRKmKU/U2Ap4W9hTpioN M722U8x7N6P1v6MqTAWCUaskdOp+ktNxFGxOlCE7BEo/EIaWbEt5RHwDePctScDLsi56+VI3TysR AgMBAAGjggHvMIIB6zAfBgNVHSMEGDAWgBSSYWuC4aKgqk/sZ/HCo/e0gADB7DAdBgNVHQ4EFgQU Yg3SsFWhMro4Abonbn1IX4JKj5QwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwIAYDVR0l BBkwFwYIKwYBBQUHAwQGCysGAQQBsjEBAwUCMBEGCWCGSAGG+EIBAQQEAwIFIDBGBgNVHSAEPzA9 MDsGDCsGAQQBsjEBAgEBATArMCkGCCsGAQUFBwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8ubmV0 L0NQUzBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9TSEEy NTZDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3VyZUVtYWlsQ0EuY3JsMIGQBggrBgEFBQcBAQSB gzCBgDBYBggrBgEFBQcwAoZMaHR0cDovL2NydC5jb21vZG9jYS5jb20vQ09NT0RPU0hBMjU2Q2xp ZW50QXV0aGVudGljYXRpb25hbmRTZWN1cmVFbWFpbENBLmNydDAkBggrBgEFBQcwAYYYaHR0cDov L29jc3AuY29tb2RvY2EuY29tMBwGA1UdEQQVMBOBEXZlN2p0YkB2ZTdqdGIuY29tMA0GCSqGSIb3 DQEBCwUAA4IBAQCC26y+6/+SJoRQWepca+rB9eSSwaCAb8nNqA+00ZiOHb+6UbbV1xa7Z8wDIuEL 5UKbNtQ2NDArvzF9YI0xNafoV1AEmP/3+ljxQHSEI0U1p2h401sOx+nSjcwtTzACso1lw+I0oJYM JFITOIfZy8HgFpCipBrQAp9jMJ+KSKDX3xu/hzPosfdnXp7sV1KAjkFrAtR3AnQYfJ5W8QrsmC4N BbiAKoYWUSdklqn3v1neTG/+oOhcw7hcGZo+YmPyF9Cdy0gBtwSHPt8hluhg2TlzmqYfi0dVL/mU jCBNUY/BFH+MBqKF7sOIRMv8ALWceVaM/NEcBciKs4eR99A4cw9ZMYICtDCCArACAQEwgbEwgZsx CzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZv cmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMUEwPwYDVQQDEzhDT01PRE8gU0hBLTI1NiBD bGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRANkyzLVrlzXAdnG6mf1Y FbowDQYJYIZIAWUDBAIBBQCggdQwLwYJKoZIhvcNAQkEMSIEIK+/6hI/YOZnVr9MtVhr7FzfDUdv 1G/WbMzbRMyHRHgEMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE3 MDExMTIzNTA1NFowaQYJKoZIhvcNAQkPMVwwWjALBglghkgBZQMEASowCwYJYIZIAWUDBAEWMAsG CWCGSAFlAwQBAjAKBggqhkiG9w0DBzALBgkqhkiG9w0BAQowCwYJKoZIhvcNAQEHMAsGCWCGSAFl AwQCATANBgkqhkiG9w0BAQEFAASCAQC4KOSURKFYVrfnBibZ4tHEknttR09GkuyZI1sEvsuMvypn tH54/41zF1YiVSG7U4wadIDLGKsnnDKX4PMyCUmWzslQlpP7Q6+rEhHOF+aW20vgo3ESiukdiAdu 3RBBFOukEQ0pibbOxIjZr1T8RSKp6kaigS+WOpvHmK/G+COjV+3EL5fzvTPle18DjwhM+SYuERhX j/1ldjjMZAHhlAKY2u2Iy69EsMXmGKaRjuljcBQpg6AdTcF13jFxlBkVjaG7l1qsloawWMlXLf+5 8L9lBGaYwaUxshHiiMBnju0tOUTqeODI84zWj3KHtAJHCFQKnbFlK40XWTTGnO4BZU4v --94eb2c06f1b6771dee0545da450c-- From nobody Fri Jan 13 12:30:46 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77EAF129532 for ; Fri, 13 Jan 2017 12:30:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.899 X-Spam-Level: X-Spam-Status: No, score=-5.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s2Ce-KmTxpYB for ; Fri, 13 Jan 2017 12:30:43 -0800 (PST) Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9025B129511 for ; Fri, 13 Jan 2017 12:30:43 -0800 (PST) Received: by mail-yw0-x22d.google.com with SMTP id l75so38034706ywb.0 for ; Fri, 13 Jan 2017 12:30:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=nDm9JWEtg62AvskH49bAoP065NcBNFu/8L1XIKbozIg=; b=VHqdKiZvad2kgYmA0yU82bPdFQQKDQ8I0PzYEH8W5cCME8LaDH0Px6UxXsjxOlq3Pw KqNCmX5phP9oAAMtklt0Nyh6cKvxzYcmVAgp2O8KKmgAldJsjlmvy8nkuYilD5iS9zJn VTOBviYz9Cw/cRs7lWyAz+eRkdOQUD1rYanb20tGhiKY8jH/H+YEfnAfFuEYI71sqy4V sccOgpzn34v5xFElnsUc1LQlNcfnp/iIwQP/m3P6uG4gHRmddkEH1GDpVQaZ3qxhj5Ia QlpvO5vZ3OOsgXGoFik2ufd71YY7UOlwA+fKrUSZnggnsihQPz1RymdjSA32MU6vUPKk Eygg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=nDm9JWEtg62AvskH49bAoP065NcBNFu/8L1XIKbozIg=; b=djtyqBW0wDJzR6MXqeyjOYMQvl6+Nftw0YA2J3+1cROafu4Y6sOnSExiO54OlbifkA MFhaW7kju6kHQsWY33Sv3sMqvQHTdf6jXejEQgFo4SKE7Stj7t2x/IPjwuRwD9PAn+Qf QYJCev8cRhlcMzra8fV3A7ZxkB7a9QFAUQ9vz3X6TZLDkv/1aYazWvDjMNVs7hr+itYF YqG3wTmqmjkEhVdnjTFdoKxrRaBL1xa41CJA4tJdGjbAmAHrSlQEBXuGv7Q+P6DvlWsW IaD/OAVqSydRFWqPENyk1zkcDhnWM4sj/pafGNRso3ouaWjxGkR13fDK8yP845+B1ErS BcSA== X-Gm-Message-State: AIkVDXLrU/EETKRuAFcyjCrHjg5apYBmn2DOLKDhXGHAmHU2FzEsNcTH06u6oCJ3jz0Rh9S2kL2/HXjDzkjdgOra X-Received: by 10.13.226.141 with SMTP id l135mr18891919ywe.77.1484339442439; Fri, 13 Jan 2017 12:30:42 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.161.87 with HTTP; Fri, 13 Jan 2017 12:30:22 -0800 (PST) From: Nick Harper Date: Fri, 13 Jan 2017 12:30:22 -0800 Message-ID: To: IETF Tokbind WG Content-Type: multipart/alternative; boundary=001a114fbd5e31eaf20545ffb552 Archived-At: Subject: [Unbearable] 0-RTT Token Binding: When to switch exporters? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Jan 2017 20:30:45 -0000 --001a114fbd5e31eaf20545ffb552 Content-Type: text/plain; charset=UTF-8 The current tokbind 0-RTT draft has the TLS 1.3 early exporter value used in the TokenBinding.signature for the entirety of the connection. One point of discussion that came up in Seoul was that we shouldn't use the 0-RTT exporter for too long. I agree that we shouldn't use it for too long, but I can't remember (or figure out from the meeting notes) if the reason is just because we prefer the crypto properties of the normal exporter, or are we also trying to prevent an attacker from being able to use the 0-RTT exporter indefinitely? For the first case, the switch from the 0-RTT exporter to the normal exporter can be client-initiated. One possible design would be to have the client send an extension in the TokenBinding indicating that all future TokenBindings will use the normal exporter. This would function similar to the ratcheting idea (from section 4.1 of the I-D), but the ratchet doesn't take effect until this indicator extension is sent (before it's sent the server would accept both exporters). This would likely be done in combination with the idea of defining new key types to indicate that the 0-RTT exporter is in use so the server doesn't do trial verification. If we want to move the switch from 0-RTT exporter to normal exporter out of the client's control (so that an attacker can't keep using the 0-RTT exporter indefinitely), a different solution is needed. One possible idea is to have the server send a message that conceptually means "all future TokenBindings must not use the 0-RTT exporter". Right now, Token Binding doesn't have any server-to-client messages, so this would require defining application-specific messages. Another way to move the change in exporters out of the client's control would be to do it at a time that is implicit in the protocol. An obvious choice would be switch exporters when the client switches from sending early data to sending data post-handshake. --001a114fbd5e31eaf20545ffb552 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
The current tokbind 0-RTT draft has the TLS 1.3 early expo= rter value used in the TokenBinding.signature for the entirety of the conne= ction. One point of discussion that came up in Seoul was that we shouldn= 9;t use the 0-RTT exporter for too long. I agree that we shouldn't use = it for too long, but I can't remember (or figure out from the meeting n= otes) if the reason is just because we prefer the crypto properties of the = normal exporter, or are we also trying to prevent an attacker from being ab= le to use the 0-RTT exporter indefinitely?

For the first= case, the switch from the 0-RTT exporter to the normal exporter can be cli= ent-initiated. One possible design would be to have the client send an exte= nsion in the TokenBinding indicating that all future TokenBindings will use= the normal exporter. This would function similar to the ratcheting idea (f= rom section 4.1 of the I-D), but the ratchet doesn't take effect until = this indicator extension is sent (before it's sent the server would acc= ept both exporters). This would likely be done in combination with the idea= of defining new key types to indicate that the 0-RTT exporter is in use so= the server doesn't do trial verification.

If = we want to move the switch from 0-RTT exporter to normal exporter out of th= e client's control (so that an attacker can't keep using the 0-RTT = exporter indefinitely), a different solution is needed. One possible idea i= s to have the server send a message that conceptually means "all futur= e TokenBindings must not use the 0-RTT exporter". Right now, Token Bin= ding doesn't have any server-to-client messages, so this would require = defining application-specific messages. Another way to move the change in e= xporters out of the client's control would be to do it at a time that i= s implicit in the protocol. An obvious choice would be switch exporters whe= n the client switches from sending early data to sending data post-handshak= e.
--001a114fbd5e31eaf20545ffb552-- From nobody Fri Jan 13 14:18:41 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFBDC129EB9 for ; Fri, 13 Jan 2017 14:18:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.157 X-Spam-Level: X-Spam-Status: No, score=-3.157 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.156, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hbbNgzIQx0U4 for ; Fri, 13 Jan 2017 14:18:36 -0800 (PST) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0109.outbound.protection.outlook.com [104.47.38.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69AF2129499 for ; Fri, 13 Jan 2017 14:18:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wAtpeDjg1oKQh5/tSd2Mf+i9qJbgos/XDSPEVPm/H/I=; b=fTXMw0RSjR4BiQe1FNcs8un75UDj4Z46nN9bC9Gqxy+AhyVFDDbMf73Uz5TaVn9TtR3WPy1Ug0UTjuzR2CBRtx2yUChSc1Gor5V2nR02RB8hFkUOpc6DtT5Wz1p2z/6q7S1ocPUQa2PRHzUhdnD2yBZc0zGJh++dEhmPWMT+LXw= Received: from DM2PR0301MB0847.namprd03.prod.outlook.com (10.160.215.145) by DM2PR0301MB0846.namprd03.prod.outlook.com (10.160.215.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.817.10; Fri, 13 Jan 2017 22:18:34 +0000 Received: from DM2PR0301MB0847.namprd03.prod.outlook.com ([10.160.215.145]) by DM2PR0301MB0847.namprd03.prod.outlook.com ([10.160.215.145]) with mapi id 15.01.0817.020; Fri, 13 Jan 2017 22:18:35 +0000 From: Andrei Popov To: Nick Harper , IETF Tokbind WG Thread-Topic: [Unbearable] 0-RTT Token Binding: When to switch exporters? Thread-Index: AQHSbdvurWwJUrGAZkyxVvys5avGZKE28kcg Date: Fri, 13 Jan 2017 22:18:35 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:b::1d2] x-ms-office365-filtering-correlation-id: 1c57ff5a-bd4c-466a-570f-08d43c021db4 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:DM2PR0301MB0846; x-microsoft-exchange-diagnostics: 1; DM2PR0301MB0846; 7:D3KoVZiQsakNzAyEHx1I8WBsSO2HikDBpg8VU7X/g/7kEuEgo6lKB1T3n55jADoIxuHq9fdQPMHWNg+ESKFp/a/WWe8vcfWW8FKfvhIiT7fu5Nc/kYZOr++ZiZPPHWmDZ6ffQ6h264hza1fBYpehkrom/z9FUKqtJj7ZKVPMP8/em16wfRTbDFO4iXXvqiZ4FP5G1bNs2RjxSSJ5sUNQCtVxCqp6qeTIEOOtobwtQJQyvYY/8tscX5//ycDjoVaMlO+7Qmrj/GYHrFslC5+0M65C2RWklO656gzDoUOIwRekF72zXkWJGQ/kn1/RAY7JHAuzN6pNJlRKk824z/FMUUP4OA5wwdYyorrJgCQKb+Ov5PeQWgmOXDGfCHps8dJUz07XJcjoh/crxoEw0Vy+QGkNRjXU33S5oasbr2O4Ldm0tEJ7/SavZ1/ox6vweXYOURTnyWLkNcwRuQBec9kWmPlC+16kXbHjfbIXlXzA8yU= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123555025)(20161123560025)(20161123562025)(20161123558021)(6047074)(6072148); SRVR:DM2PR0301MB0846; BCL:0; PCL:0; RULEID:; SRVR:DM2PR0301MB0846; x-forefront-prvs: 018632C080 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39840400002)(39410400002)(39450400003)(39850400002)(39860400002)(199003)(189002)(377454003)(86362001)(97736004)(107886002)(5001770100001)(8676002)(38730400001)(77096006)(86612001)(2906002)(54896002)(7736002)(229853002)(2950100002)(6436002)(2900100001)(6306002)(6506006)(55016002)(99286003)(9686003)(5660300001)(7696004)(25786008)(122556002)(92566002)(106356001)(106116001)(105586002)(76176999)(790700001)(189998001)(8990500004)(6116002)(10290500002)(5005710100001)(101416001)(10090500001)(74316002)(50986999)(54356999)(102836003)(81156014)(81166006)(8936002)(33656002)(3660700001)(3280700002)(68736007)(27001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR0301MB0846; H:DM2PR0301MB0847.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR0301MB084793F58146F8574BF36EE18C780DM2PR0301MB0847_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jan 2017 22:18:35.0479 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0301MB0846 Archived-At: Subject: Re: [Unbearable] 0-RTT Token Binding: When to switch exporters? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Jan 2017 22:18:40 -0000 --_000_DM2PR0301MB084793F58146F8574BF36EE18C780DM2PR0301MB0847_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIEFub3RoZXIgd2F5IHRvIG1vdmUgdGhlIGNoYW5nZSBpbiBleHBvcnRlcnMgb3V0IG9mIHRo ZSBjbGllbnQncyBjb250cm9sIHdvdWxkIGJlIHRvIGRvIGl0IGF0IGEgdGltZSB0aGF0IGlzIGlt cGxpY2l0IGluIHRoZSBwcm90b2NvbC4gQW4gb2J2aW91cyBjaG9pY2Ugd291bGQgYmUgc3dpdGNo IGV4cG9ydGVycyB3aGVuIHRoZSBjbGllbnQgc3dpdGNoZXMgZnJvbSBzZW5kaW5nIGVhcmx5IGRh dGEgdG8gc2VuZGluZyBkYXRhIHBvc3QtaGFuZHNoYWtlLg0KSSB0aGluayB0aGlzIHR5cGUgb2Yg YXBwcm9hY2ggaXMgYmV0dGVyLg0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQpGcm9tOiBVbmJlYXJh YmxlIFttYWlsdG86dW5iZWFyYWJsZS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgTmlj ayBIYXJwZXINClNlbnQ6IEZyaWRheSwgSmFudWFyeSAxMywgMjAxNyAxMjozMCBQTQ0KVG86IElF VEYgVG9rYmluZCBXRyA8dW5iZWFyYWJsZUBpZXRmLm9yZz4NClN1YmplY3Q6IFtVbmJlYXJhYmxl XSAwLVJUVCBUb2tlbiBCaW5kaW5nOiBXaGVuIHRvIHN3aXRjaCBleHBvcnRlcnM/DQoNClRoZSBj dXJyZW50IHRva2JpbmQgMC1SVFQgZHJhZnQgaGFzIHRoZSBUTFMgMS4zIGVhcmx5IGV4cG9ydGVy IHZhbHVlIHVzZWQgaW4gdGhlIFRva2VuQmluZGluZy5zaWduYXR1cmUgZm9yIHRoZSBlbnRpcmV0 eSBvZiB0aGUgY29ubmVjdGlvbi4gT25lIHBvaW50IG9mIGRpc2N1c3Npb24gdGhhdCBjYW1lIHVw IGluIFNlb3VsIHdhcyB0aGF0IHdlIHNob3VsZG4ndCB1c2UgdGhlIDAtUlRUIGV4cG9ydGVyIGZv ciB0b28gbG9uZy4gSSBhZ3JlZSB0aGF0IHdlIHNob3VsZG4ndCB1c2UgaXQgZm9yIHRvbyBsb25n LCBidXQgSSBjYW4ndCByZW1lbWJlciAob3IgZmlndXJlIG91dCBmcm9tIHRoZSBtZWV0aW5nIG5v dGVzKSBpZiB0aGUgcmVhc29uIGlzIGp1c3QgYmVjYXVzZSB3ZSBwcmVmZXIgdGhlIGNyeXB0byBw cm9wZXJ0aWVzIG9mIHRoZSBub3JtYWwgZXhwb3J0ZXIsIG9yIGFyZSB3ZSBhbHNvIHRyeWluZyB0 byBwcmV2ZW50IGFuIGF0dGFja2VyIGZyb20gYmVpbmcgYWJsZSB0byB1c2UgdGhlIDAtUlRUIGV4 cG9ydGVyIGluZGVmaW5pdGVseT8NCg0KRm9yIHRoZSBmaXJzdCBjYXNlLCB0aGUgc3dpdGNoIGZy b20gdGhlIDAtUlRUIGV4cG9ydGVyIHRvIHRoZSBub3JtYWwgZXhwb3J0ZXIgY2FuIGJlIGNsaWVu dC1pbml0aWF0ZWQuIE9uZSBwb3NzaWJsZSBkZXNpZ24gd291bGQgYmUgdG8gaGF2ZSB0aGUgY2xp ZW50IHNlbmQgYW4gZXh0ZW5zaW9uIGluIHRoZSBUb2tlbkJpbmRpbmcgaW5kaWNhdGluZyB0aGF0 IGFsbCBmdXR1cmUgVG9rZW5CaW5kaW5ncyB3aWxsIHVzZSB0aGUgbm9ybWFsIGV4cG9ydGVyLiBU aGlzIHdvdWxkIGZ1bmN0aW9uIHNpbWlsYXIgdG8gdGhlIHJhdGNoZXRpbmcgaWRlYSAoZnJvbSBz ZWN0aW9uIDQuMSBvZiB0aGUgSS1EKSwgYnV0IHRoZSByYXRjaGV0IGRvZXNuJ3QgdGFrZSBlZmZl Y3QgdW50aWwgdGhpcyBpbmRpY2F0b3IgZXh0ZW5zaW9uIGlzIHNlbnQgKGJlZm9yZSBpdCdzIHNl bnQgdGhlIHNlcnZlciB3b3VsZCBhY2NlcHQgYm90aCBleHBvcnRlcnMpLiBUaGlzIHdvdWxkIGxp a2VseSBiZSBkb25lIGluIGNvbWJpbmF0aW9uIHdpdGggdGhlIGlkZWEgb2YgZGVmaW5pbmcgbmV3 IGtleSB0eXBlcyB0byBpbmRpY2F0ZSB0aGF0IHRoZSAwLVJUVCBleHBvcnRlciBpcyBpbiB1c2Ug c28gdGhlIHNlcnZlciBkb2Vzbid0IGRvIHRyaWFsIHZlcmlmaWNhdGlvbi4NCg0KSWYgd2Ugd2Fu dCB0byBtb3ZlIHRoZSBzd2l0Y2ggZnJvbSAwLVJUVCBleHBvcnRlciB0byBub3JtYWwgZXhwb3J0 ZXIgb3V0IG9mIHRoZSBjbGllbnQncyBjb250cm9sIChzbyB0aGF0IGFuIGF0dGFja2VyIGNhbid0 IGtlZXAgdXNpbmcgdGhlIDAtUlRUIGV4cG9ydGVyIGluZGVmaW5pdGVseSksIGEgZGlmZmVyZW50 IHNvbHV0aW9uIGlzIG5lZWRlZC4gT25lIHBvc3NpYmxlIGlkZWEgaXMgdG8gaGF2ZSB0aGUgc2Vy dmVyIHNlbmQgYSBtZXNzYWdlIHRoYXQgY29uY2VwdHVhbGx5IG1lYW5zICJhbGwgZnV0dXJlIFRv a2VuQmluZGluZ3MgbXVzdCBub3QgdXNlIHRoZSAwLVJUVCBleHBvcnRlciIuIFJpZ2h0IG5vdywg VG9rZW4gQmluZGluZyBkb2Vzbid0IGhhdmUgYW55IHNlcnZlci10by1jbGllbnQgbWVzc2FnZXMs IHNvIHRoaXMgd291bGQgcmVxdWlyZSBkZWZpbmluZyBhcHBsaWNhdGlvbi1zcGVjaWZpYyBtZXNz YWdlcy4gQW5vdGhlciB3YXkgdG8gbW92ZSB0aGUgY2hhbmdlIGluIGV4cG9ydGVycyBvdXQgb2Yg dGhlIGNsaWVudCdzIGNvbnRyb2wgd291bGQgYmUgdG8gZG8gaXQgYXQgYSB0aW1lIHRoYXQgaXMg aW1wbGljaXQgaW4gdGhlIHByb3RvY29sLiBBbiBvYnZpb3VzIGNob2ljZSB3b3VsZCBiZSBzd2l0 Y2ggZXhwb3J0ZXJzIHdoZW4gdGhlIGNsaWVudCBzd2l0Y2hlcyBmcm9tIHNlbmRpbmcgZWFybHkg ZGF0YSB0byBzZW5kaW5nIGRhdGEgcG9zdC1oYW5kc2hha2UuDQo= --_000_DM2PR0301MB084793F58146F8574BF36EE18C780DM2PR0301MB0847_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpw Lk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdy YXBoDQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltYXJnaW4tdG9wOjBpbjsNCgltYXJnaW4t cmlnaHQ6MGluOw0KCW1hcmdpbi1ib3R0b206MGluOw0KCW1hcmdpbi1sZWZ0Oi41aW47DQoJbWFy Z2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYu bXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3At YWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToi VGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsN Cgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdv cmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4w aW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBM aXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo1MDQyNDYzNzsNCglt c28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE3NTc0OTA1MDAg LTYyMTIyMTU5NiA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2 NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczsNCgltc28tZmFyZWFzdC1mb250 LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4i O30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlz dCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5Oldpbmdk aW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21hcmdpbi1i b3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4 PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8 bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0i MSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5 IGxhbmc9IkVOLVVTIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+DQo8ZGl2IGNsYXNz PSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0 LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjwhW2lmICFzdXBwb3J0TGlz dHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OldpbmdkaW5ncyI+ PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAm cXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+ PCFbZW5kaWZdPkFub3RoZXIgd2F5IHRvIG1vdmUgdGhlIGNoYW5nZSBpbiBleHBvcnRlcnMgb3V0 IG9mIHRoZSBjbGllbnQncyBjb250cm9sIHdvdWxkIGJlIHRvIGRvIGl0IGF0IGEgdGltZSB0aGF0 IGlzIGltcGxpY2l0IGluIHRoZSBwcm90b2NvbC4gQW4gb2J2aW91cyBjaG9pY2Ugd291bGQgYmUg c3dpdGNoIGV4cG9ydGVycyB3aGVuIHRoZSBjbGllbnQgc3dpdGNoZXMgZnJvbSBzZW5kaW5nIGVh cmx5IGRhdGENCiB0byBzZW5kaW5nIGRhdGEgcG9zdC1oYW5kc2hha2UuPHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPkkgdGhpbmsgdGhpcyB0eXBlIG9mIGFwcHJvYWNoIGlzIGJldHRlci48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Q2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5BbmRyZWk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJv bTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFVuYmVhcmFibGUgW21haWx0bzp1bmJlYXJh YmxlLWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPk5pY2sgSGFycGVyPGJy Pg0KPGI+U2VudDo8L2I+IEZyaWRheSwgSmFudWFyeSAxMywgMjAxNyAxMjozMCBQTTxicj4NCjxi PlRvOjwvYj4gSUVURiBUb2tiaW5kIFdHICZsdDt1bmJlYXJhYmxlQGlldGYub3JnJmd0Ozxicj4N CjxiPlN1YmplY3Q6PC9iPiBbVW5iZWFyYWJsZV0gMC1SVFQgVG9rZW4gQmluZGluZzogV2hlbiB0 byBzd2l0Y2ggZXhwb3J0ZXJzPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlRoZSBjdXJyZW50IHRva2JpbmQgMC1SVFQgZHJhZnQgaGFzIHRoZSBUTFMgMS4zIGVhcmx5IGV4 cG9ydGVyIHZhbHVlIHVzZWQgaW4gdGhlIFRva2VuQmluZGluZy5zaWduYXR1cmUgZm9yIHRoZSBl bnRpcmV0eSBvZiB0aGUgY29ubmVjdGlvbi4gT25lIHBvaW50IG9mIGRpc2N1c3Npb24gdGhhdCBj YW1lIHVwIGluIFNlb3VsIHdhcyB0aGF0IHdlIHNob3VsZG4ndCB1c2UgdGhlIDAtUlRUIGV4cG9y dGVyIGZvciB0b28NCiBsb25nLiBJIGFncmVlIHRoYXQgd2Ugc2hvdWxkbid0IHVzZSBpdCBmb3Ig dG9vIGxvbmcsIGJ1dCBJIGNhbid0IHJlbWVtYmVyIChvciBmaWd1cmUgb3V0IGZyb20gdGhlIG1l ZXRpbmcgbm90ZXMpIGlmIHRoZSByZWFzb24gaXMganVzdCBiZWNhdXNlIHdlIHByZWZlciB0aGUg Y3J5cHRvIHByb3BlcnRpZXMgb2YgdGhlIG5vcm1hbCBleHBvcnRlciwgb3IgYXJlIHdlIGFsc28g dHJ5aW5nIHRvIHByZXZlbnQgYW4gYXR0YWNrZXIgZnJvbSBiZWluZyBhYmxlDQogdG8gdXNlIHRo ZSAwLVJUVCBleHBvcnRlciBpbmRlZmluaXRlbHk/PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5Gb3IgdGhlIGZpcnN0IGNhc2UsIHRoZSBzd2l0Y2ggZnJvbSB0 aGUgMC1SVFQgZXhwb3J0ZXIgdG8gdGhlIG5vcm1hbCBleHBvcnRlciBjYW4gYmUgY2xpZW50LWlu aXRpYXRlZC4gT25lIHBvc3NpYmxlIGRlc2lnbiB3b3VsZCBiZSB0byBoYXZlIHRoZSBjbGllbnQg c2VuZCBhbiBleHRlbnNpb24gaW4gdGhlIFRva2VuQmluZGluZyBpbmRpY2F0aW5nIHRoYXQgYWxs IGZ1dHVyZSBUb2tlbkJpbmRpbmdzIHdpbGwgdXNlDQogdGhlIG5vcm1hbCBleHBvcnRlci4gVGhp cyB3b3VsZCBmdW5jdGlvbiBzaW1pbGFyIHRvIHRoZSByYXRjaGV0aW5nIGlkZWEgKGZyb20gc2Vj dGlvbiA0LjEgb2YgdGhlIEktRCksIGJ1dCB0aGUgcmF0Y2hldCBkb2Vzbid0IHRha2UgZWZmZWN0 IHVudGlsIHRoaXMgaW5kaWNhdG9yIGV4dGVuc2lvbiBpcyBzZW50IChiZWZvcmUgaXQncyBzZW50 IHRoZSBzZXJ2ZXIgd291bGQgYWNjZXB0IGJvdGggZXhwb3J0ZXJzKS4gVGhpcyB3b3VsZCBsaWtl bHkgYmUNCiBkb25lIGluIGNvbWJpbmF0aW9uIHdpdGggdGhlIGlkZWEgb2YgZGVmaW5pbmcgbmV3 IGtleSB0eXBlcyB0byBpbmRpY2F0ZSB0aGF0IHRoZSAwLVJUVCBleHBvcnRlciBpcyBpbiB1c2Ug c28gdGhlIHNlcnZlciBkb2Vzbid0IGRvIHRyaWFsIHZlcmlmaWNhdGlvbi48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SWYgd2Ugd2FudCB0byBt b3ZlIHRoZSBzd2l0Y2ggZnJvbSAwLVJUVCBleHBvcnRlciB0byBub3JtYWwgZXhwb3J0ZXIgb3V0 IG9mIHRoZSBjbGllbnQncyBjb250cm9sIChzbyB0aGF0IGFuIGF0dGFja2VyIGNhbid0IGtlZXAg dXNpbmcgdGhlIDAtUlRUIGV4cG9ydGVyIGluZGVmaW5pdGVseSksIGEgZGlmZmVyZW50IHNvbHV0 aW9uIGlzIG5lZWRlZC4gT25lIHBvc3NpYmxlIGlkZWEgaXMgdG8gaGF2ZSB0aGUgc2VydmVyDQog c2VuZCBhIG1lc3NhZ2UgdGhhdCBjb25jZXB0dWFsbHkgbWVhbnMgJnF1b3Q7YWxsIGZ1dHVyZSBU b2tlbkJpbmRpbmdzIG11c3Qgbm90IHVzZSB0aGUgMC1SVFQgZXhwb3J0ZXImcXVvdDsuIFJpZ2h0 IG5vdywgVG9rZW4gQmluZGluZyBkb2Vzbid0IGhhdmUgYW55IHNlcnZlci10by1jbGllbnQgbWVz c2FnZXMsIHNvIHRoaXMgd291bGQgcmVxdWlyZSBkZWZpbmluZyBhcHBsaWNhdGlvbi1zcGVjaWZp YyBtZXNzYWdlcy4gQW5vdGhlciB3YXkgdG8gbW92ZSB0aGUgY2hhbmdlDQogaW4gZXhwb3J0ZXJz IG91dCBvZiB0aGUgY2xpZW50J3MgY29udHJvbCB3b3VsZCBiZSB0byBkbyBpdCBhdCBhIHRpbWUg dGhhdCBpcyBpbXBsaWNpdCBpbiB0aGUgcHJvdG9jb2wuIEFuIG9idmlvdXMgY2hvaWNlIHdvdWxk IGJlIHN3aXRjaCBleHBvcnRlcnMgd2hlbiB0aGUgY2xpZW50IHN3aXRjaGVzIGZyb20gc2VuZGlu ZyBlYXJseSBkYXRhIHRvIHNlbmRpbmcgZGF0YSBwb3N0LWhhbmRzaGFrZS48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM2PR0301MB084793F58146F8574BF36EE18C780DM2PR0301MB0847_-- From nobody Thu Jan 19 23:15:18 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F62A129A23 for ; Thu, 19 Jan 2017 23:15:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnt-se.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zdQQCqc7_5Fn for ; Thu, 19 Jan 2017 23:15:15 -0800 (PST) Received: from mail-lf0-x236.google.com (mail-lf0-x236.google.com [IPv6:2a00:1450:4010:c07::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5FA12129A1D for ; Thu, 19 Jan 2017 23:15:15 -0800 (PST) Received: by mail-lf0-x236.google.com with SMTP id v186so51605961lfa.1 for ; Thu, 19 Jan 2017 23:15:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnt-se.20150623.gappssmtp.com; s=20150623; h=from:content-transfer-encoding:mime-version:date:subject:message-id :references:to; bh=MsfuICG6RgFuA20uReoE71bIEsIj4FsWZaLE57qYXxI=; b=XC4sl7ZBpFWUE6Mt7xUo6z/3a+XVA+HzR3qPvv7HYL1mueLkeBmYVFmz9ruHmlYR+v e9/3C+NEHtPWa1Sa0pLiU6WdxzRY90YWcqwY89SL/uE1GMSd4aPT7rgkDfsftK1EcBqU 4fU/UyWCzImLudkuUIZE445qYEor+gc5NoVuEzx3HfD1fkWZGu9iUfOUknSpQpMGSL5B cemgJeTjDvRK8QPN2AWXd+0i4fH7b0sZeGc8NntJAOYkA8f6KtfpxSzzMqsD4qre+vIm bG3Oh837cflPgmRKNu7AKWnKuOnUe6kx//nnuQCOf6CckWtQ0MoOv0ugC6+56XVoUsZN pKUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version:date :subject:message-id:references:to; bh=MsfuICG6RgFuA20uReoE71bIEsIj4FsWZaLE57qYXxI=; b=WL+I4jEg8yKhvFpIxhQDAuYoUCoA6Bcy7W0i5ZfS2l0GxE0ru25pgLW+d9zjireOPv ecyu+lMS0h6FlsuTaFdIGhUsgRROX1T3tsioQ+BmY0YlVhrHlod9/U0LKj8IA/zxl6qh Dxhj8TyKwqJnyaRHxvjSb1/L8kbJo063gsmQ6ZvYUMi/h8tQ382Pdf+qegC7LapvwUyz dgT46AkSbi5IEznlz+JrsOZ5iKzau/VAEJ7ACju3bUfzYOaLo7JghClszPC9QfSgopE1 nrT9Y+1mcEt113p5h16kTCXXn6a0FLmvTUQbWvf6Hf0ndCXqmIpmSaCzVr7UCku6ILkq sPbQ== X-Gm-Message-State: AIkVDXKFrqFsvCltKnR+ds2UqT1P6eCZPUUQ/91Zl90y4MD7MRterm9IAIj6PP4nH2Q0tA== X-Received: by 10.46.22.15 with SMTP id w15mr5763184ljd.35.1484896513233; Thu, 19 Jan 2017 23:15:13 -0800 (PST) Received: from [2.64.219.139] (2.64.219.139.mobile.tre.se. [2.64.219.139]) by smtp.gmail.com with ESMTPSA id j87sm2929105lfi.25.2017.01.19.23.15.12 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Jan 2017 23:15:12 -0800 (PST) From: Leif Johansson Content-Type: multipart/alternative; boundary=Apple-Mail-E029F563-CA14-43B2-894A-660AB91B5189 Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (1.0) Date: Fri, 20 Jan 2017 08:15:11 +0100 Message-Id: <5D7289F0-87EA-4A2D-BA8D-719AAE9C1B7F@mnt.se> References: <82314207-092F-4217-A51B-48E918722649@ietf.org> To: unbearable@ietf.org X-Mailer: iPhone Mail (14C92) Archived-At: Subject: [Unbearable] Fwd: IETF Hackathon in Chicago X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 07:15:17 -0000 --Apple-Mail-E029F563-CA14-43B2-894A-660AB91B5189 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Is there any interest in this group? On first glance we should be ready for s= ome serious interop testing ... Skickat fr=C3=A5n min iPhone Vidarebefordrat brev: > Fr=C3=A5n: IETF Chair > Datum: 12 januari 2017 12:22:40 CET > Till: IETF Announcement List > Kopia: IETF Discussion > =C3=84mne: IETF Hackathon in Chicago > Svara till: chair@ietf.org, IETF Discussion >=20 >=20 > The IETF motto is =E2=80=9CRunning Code and Rough Consensus=E2=80=9D. And w= e try to arrange opportunities for that code writing to happen. The IETF Hac= kathon focuses on open source projects and Internet technology, the CodeSpri= nt is about IETF=E2=80=99s own tools and web services, interoperability even= ts test specific pieces of technology, and so on. >=20 > I wanted to let everyone know what we will be hosting another IETF Hackath= on at IETF-98. The Chicago Hackathon will run from Saturday March 25 to Sund= ay March 26. >=20 > And remember that what you do at these events is up to YOU. Add your own t= opic to the wiki, and come to the Hackathon to work on it. >=20 > More information and signup page below: >=20 > https://www.ietf.org/blog/2017/01/ietf-hackathon-in-chicago/ > https://www.ietf.org/hackathon/98-hackathon.html > https://www.ietf.org/registration/ietf98/hackathonregistration.py >=20 > Jari Arkko, IETF Chair >=20 --Apple-Mail-E029F563-CA14-43B2-894A-660AB91B5189 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Is there any interest in this group? O= n first glance we should be ready for some serious interop testing ...
Skickat fr=C3=A5n min iPhone

Vidarebefordrat brev:

Fr=C3=A5n: IETF Chair <chair@ietf.org>
Datum: 12 januari 2= 017 12:22:40 CET
Till: IETF Announcement List <ietf-announce@ietf.org>
Kopia: IE= TF Discussion <ietf@ietf.org>
= =C3=84mne: IETF Hackathon in Chicago
Svara till: chair@ietf.org, IETF Discussion <ietf@ietf.org>

<= blockquote type=3D"cite">

The IETF motto is =E2=80= =9CRunning Code and Rough Consensus=E2=80=9D. And we try to arrange opportun= ities for that code writing to happen. The IETF Hackathon focuses on open so= urce projects and Internet technology, the CodeSprint is about IETF=E2=80=99= s own tools and web services, interoperability events test specific pieces o= f technology, and so on.

I wanted to let ev= eryone know what we will be hosting another IETF Hackathon at IETF-98. The C= hicago Hackathon will run from Saturday March 25 to Sunday March 26.<= br>
And remember that what you do at these events is u= p to YOU. Add your own topic to the wiki, and come to the Hackathon to work o= n it.

More information and signup page belo= w:

https://www.ietf.org/blog/2017/01/ietf-hack= athon-in-chicago/
https://www.ietf.org/hackathon/98-hackathon.html<= /span>
https://www.ietf.org/registration/ietf98/hackathonregistra= tion.py

Jari Arkko, IETF Chair
= --Apple-Mail-E029F563-CA14-43B2-894A-660AB91B5189-- From nobody Fri Jan 20 04:29:28 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A953D129B59 for ; Fri, 20 Jan 2017 04:29:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.899 X-Spam-Level: X-Spam-Status: No, score=-5.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TFVuUsknBviz for ; Fri, 20 Jan 2017 04:29:25 -0800 (PST) Received: from mail-it0-x230.google.com (mail-it0-x230.google.com [IPv6:2607:f8b0:4001:c0b::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57AA6129B1C for ; Fri, 20 Jan 2017 04:29:25 -0800 (PST) Received: by mail-it0-x230.google.com with SMTP id r185so18519001ita.0 for ; Fri, 20 Jan 2017 04:29:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=1YAitzJIpjnFFxfdflUIoe9FlvEukNVnCvXd8HgazN0=; b=KgU4xAjVlxVc0eSbecjLCgSrxlU50xAmA7lYbvjtZczUcfgOtJZZbXn4KGl0PqRM/U lZWU4me+V56qmGSFnLObcx+3SYxIqoxfOOvtAxqSK0qsKppMaxQUGvWfFlWPI63hGATJ ZiE9OnyXkdj6Q4LFPa5toX+v2IgxdmJa9IiJt9YXdk+5QTDvvEzq0Bj1fbC/8TXsfJIk 1mNBCKLgvtq7U0LQXzF+HvdI7FbwceaYuxD2QdrOxeBXwSBain4q+ViriIGgtZbd7PPF qHteSobnpB/MF57RxKlg9T/d23n2EUlAalcog7G02K5TaqsULO28Nu//CUSWFNXHgSi3 4Hww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=1YAitzJIpjnFFxfdflUIoe9FlvEukNVnCvXd8HgazN0=; b=nio8Mn4bvAwuR7AYXZNC/gaJxkulfuHzrSwsr017RnJHlgzt7xUA14RpKbNedMkglh wrfgICJE0B3KaFe+yRf+rEFOFK/yUE0gm2eSeWloCHhaZOryk5q3LqV3gdRLctkgaFtW o9MTXzUq7Fp/6eYVOow8S64qwf48WRieol7LeL+LAlJ5PkDaJkvSS0Mhe6ieWT5n6+it c6N+75sce5dnF+i+XqTXadb4ebVaLww6vVyWd6VlH8HwQbvt2E0SAbUXSOA637FDlcs4 IC0YrSuEQWWNIUE1kJ9TKv/ln5NC8DJhzkfKyrh1CqYuw3CCU5OKCX2HNGwEXWMai+1p 1i9w== X-Gm-Message-State: AIkVDXJ5KnUZb4lV7EXmRV8/ci7Xm+qjw6VjIVZPHjNoxYXxS7zLnzfcETpUF/Da/IB3QkWa4veVhr2bmg+n8W0Z X-Received: by 10.36.181.87 with SMTP id j23mr773283iti.68.1484915364472; Fri, 20 Jan 2017 04:29:24 -0800 (PST) MIME-Version: 1.0 Received: by 10.64.152.41 with HTTP; Fri, 20 Jan 2017 04:29:24 -0800 (PST) From: Bill Cox Date: Fri, 20 Jan 2017 04:29:24 -0800 Message-ID: To: token-binding-team , Tokbind WG Content-Type: multipart/alternative; boundary=f403045d8e16d2a1cd054685cc4b Archived-At: Subject: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 12:29:27 -0000 --f403045d8e16d2a1cd054685cc4b Content-Type: text/plain; charset=UTF-8 I'm seeing 5.7K token binding headers per second at the moment, about 5K/s sending both channel-ID and token binding (probably chrome), and about 700/s with just token binding (probably not chrome). Bill --f403045d8e16d2a1cd054685cc4b Content-Type: text/html; charset=UTF-8
I'm seeing 5.7K token binding headers per second at the moment, about 5K/s sending both channel-ID and token binding (probably chrome), and about 700/s with just token binding (probably not chrome).

Bill
--f403045d8e16d2a1cd054685cc4b-- From nobody Fri Jan 20 05:01:49 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B215129B41 for ; Fri, 20 Jan 2017 05:01:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z_jbGmNbRm0y for ; Fri, 20 Jan 2017 05:01:46 -0800 (PST) Received: from mail-yw0-x233.google.com (mail-yw0-x233.google.com [IPv6:2607:f8b0:4002:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 391F412947B for ; Fri, 20 Jan 2017 05:01:46 -0800 (PST) Received: by mail-yw0-x233.google.com with SMTP id v200so85363072ywc.3 for ; Fri, 20 Jan 2017 05:01:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=lQcMSUrzytNP6U21hDgf86bBDRykcs/BH94snphF9IY=; b=EGfw0KNiw8DGlJ3WFjK7Dxt7LJgqmHZfs7WhwpG0ADOSoW2vCqfYSLGzdcf+D/hDwx V1iVl3ODeFZNwj0egKOYpT7sFtlcowz4zyrzfNmCppdq3JE8APYZv6v2aFT0RRordyZL DL7ABZwkqBWDNFP93cffDOXQLaZKjN7IhpJrxwrTEtaVHHbmQ5t5Sp196Nebc6t/haJJ CHFWv+AE+E60+b83/Uc17GXkAeuymHEEQKWsjGVGjCQDyr0OMNcHJYOSSV5+XdJwDLx9 Yiv7L+2JtfZbr5+V9fHpiiehElsPHJDtWLeurqSr1YWCIzms8MuT4YWpc8oXNDTb/Xb3 em2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=lQcMSUrzytNP6U21hDgf86bBDRykcs/BH94snphF9IY=; b=jYSDbnJJGhuzdE4KfZKInXyX4QEWFJ9NyBAoCd+1xrerLRF0lCmBwQY19Guw45Q7XX iDq5NSo/sKDDN0JWnH0TT2m5101GVBPb13LvElt3o7AN9jGcazZICP6FKH4t7VtzJhtM bcC8mZVI4fuSphR42+3XAwyX5ueukqryRoNY+ueuhRFjoG/US8tY0vFwRZhGKWBkXpmM u0SwkMAhT1e1uszuv4pcrkrTbAq8af3Rqca4V5JNgDMfs/4qABnJ1ieij9zwQnT5ioQq QFIutMXCKbjVtP8CQCfG0tNyMs9x9X2vUdiiDJYoLTk0/T8Ka9Y6c2cKp2qlp0lrNQ9C X/mw== X-Gm-Message-State: AIkVDXKyPStPjF7TsfHICm7ggPUVYH5tl47a5/Vp4oKqrAJGnwmx+pRppxMNiVsH1e5ujojx X-Received: by 10.55.82.214 with SMTP id g205mr12966464qkb.78.1484917305160; Fri, 20 Jan 2017 05:01:45 -0800 (PST) Received: from [192.168.86.130] ([191.115.66.10]) by smtp.gmail.com with ESMTPSA id c41sm5877443qtd.3.2017.01.20.05.01.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 Jan 2017 05:01:44 -0800 (PST) From: John Bradley Message-Id: <8074E906-BC37-42BF-8DE3-C2C797D71577@ve7jtb.com> Content-Type: multipart/signed; boundary="Apple-Mail=_15F82FB7-84D0-4F37-B58F-234DFA995BF0"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Fri, 20 Jan 2017 10:01:30 -0300 In-Reply-To: To: Bill Cox References: X-Mailer: Apple Mail (2.3259) Archived-At: Cc: Tokbind WG , token-binding-team Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 13:01:48 -0000 --Apple-Mail=_15F82FB7-84D0-4F37-B58F-234DFA995BF0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Great news. Is token binding not behind a feature flag for some of the newer builds = of Chrome? We should check if it is on in the Edge preview rings. I think Andrei = mentioned that was about to happen in Korea. =20 Do you have any test page that would show if the cookies are = successfully token bound ? Thanks John B. > On Jan 20, 2017, at 9:29 AM, Bill Cox wrote: >=20 > I'm seeing 5.7K token binding headers per second at the moment, about = 5K/s sending both channel-ID and token binding (probably chrome), and = about 700/s with just token binding (probably not chrome). >=20 > Bill > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail=_15F82FB7-84D0-4F37-B58F-234DFA995BF0 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILMTCCBUcw ggQvoAMCAQICEEAfBHP+tuqufC4R+F+Tu54wDQYJKoZIhvcNAQELBQAwdTELMAkGA1UEBhMCSUwx FjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAyIENsaWVudCBDQTAeFw0xNjA4MTIy MTE5NDFaFw0xODA4MTIyMTE5NDFaMIGCMQswCQYDVQQGEwJDTDEiMCAGA1UECAwZTWV0cm9wb2xp dGFuYSBkZSBTYW50aWFnbzEWMBQGA1UEBwwNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAwwMSm9obiBC cmFkbGV5MSAwHgYJKoZIhvcNAQkBFhF2ZTdqdGJAdmU3anRiLmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBALhTcSiDGvVrm4hlJA8WyFcWWe0dqnuJzstQYTaF281JFOEPA/13kQYI JMXAEUcS7NvW7KdUI0tHU0N6RTo0Ilf1E1nm8No++eqHO8pFUZ/cidpv0r+1Qcl9EgrpbZ00Y7Xg pq06EZELzJAmds4QQcsTKdpLNFbVcFnM11i2Gj5VNsYgO+qPO2AS8rLHkgDWnNkc9/lA+ZK5wGiU zxPU9KnIrERoTif3Zk7KjLvFpBWYD60M/lNoHZ5zxYgmYLmvoM1TSLn4Ms57wwT5MieV2l0aqlGC 7CKNa6XyeL1B0y0wSxL3PJQS4vSLDnttZC7od2A6yjeUMyM3rQ41vqUIMc8CAwEAAaOCAcMwggG/ MA4GA1UdDwEB/wQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwCQYDVR0TBAIw ADAdBgNVHQ4EFgQUmA9bUmBmTYkCcZ3yYv8IRRP2nN4wHwYDVR0jBBgwFoAUmZerGDU6i1lFQ5iy cnHI9PsJzxYwbwYIKwYBBQUHAQEEYzBhMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNz bC5jb20wOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3NjYS5jbGll bnQyLmNydDA4BgNVHR8EMTAvMC2gK6AphidodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zY2EtY2xp ZW50Mi5jcmwwHAYDVR0RBBUwE4ERdmU3anRiQHZlN2p0Yi5jb20wIwYDVR0SBBwwGoYYaHR0cDov L3d3dy5zdGFydHNzbC5jb20vMFUGA1UdIAROMEwwDAYKKwYBBAGBtTcGATA8BgsrBgEEAYG1NwEC BTAtMCsGCCsGAQUFBwIBFh9odHRwczovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4IBAQBqcYJfFA/ITkX4L6JihqW168Wog1BOfkbPXO+wPn5G9P1NwruGfu41b70EPPwV vol+/j+qhSSrDjFyfNBsq4G45GRR6hwx0ei/bH0UW15Y63ASYPkNlj3ydCcvhw5ItWD5aYPphBx9 C7tLnQ7ow09cqt2CIgPd3W/IGri7p4hWPbdcX0oFIhJcDxmCwTcWyoVoIo4aas5gP44LPGneCoqI lXQMJinwneEnKd7rWXlzVWv7geaH3t79zARSw9ev9F4E61cDuHi+vgTFEpio7oxybqfj99yLibhX uZjReYnYbDMRiWDXduVIrIGYwmnUuD8a0b20kJgHm+FEgB6UMa9JMIIF4jCCA8qgAwIBAgIQXLZI bkcMmMZ/9oDbZErijTANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3Rh cnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEp MCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTUxMjE2MDEwMDA1 WhcNMzAxMjE2MDEwMDA1WjB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDIgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7g9Q jJUJI4Ss9VBqj9Y3ok4h/TIJZUc+rzj61Rv3hNB/yeEEC1fz3i/EU+MXOOGxM7KCbtCIcJxHIW/k 8RP6sPPMO4cTg7sNzfBWsYsemtY6fN/kVr2R2X+/PjvtxmAaXpGX0znvQPxaE123IMGXy0zEKHZ/ nJDZ199TP9TNn9v+1QO0AZb4oaJ7ch0DpSJa8kF5xiNFDAg9taKKSrVuPHJL9MFFYPIqwShjHg+u YEzjfxbMP2QWwamnaA9Y7fORSDNapduFlARAcDtXdMpAijiG4HKnrN323I0Ka7lDTAWyLtTDCETK sI8fzOyL0inEu1WEVpdPytm8s1rwQB4f9QIDAQABo4IBZDCCAWAwDgYDVR0PAQH/BAQDAgEGMB0G A1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQr MCkwJ6AloCOGIWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDBmBggrBgEFBQcBAQRa MFgwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTAwBggrBgEFBQcwAoYkaHR0 cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvY2EuY3J0MB0GA1UdDgQWBBSZl6sYNTqLWUVDmLJy ccj0+wnPFjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jA/BgNVHSAEODA2MDQGBFUd IAAwLDAqBggrBgEFBQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4ICAQCZQUEEzvYk9U4wNHhDu1f9QGwbzAH4m4wIKH8ZidNYwZhyoNKW041iJ002KMW9 ywYM95n4770tT45yH29vTMlZtBvz0h44KuxMLNXRCTDwvV07sT39nPjFi5MpwZaLVueNiaa1vok1 n2Wn8lLcyCltYZNGAEifM0ko/A/vvckftFIZG75RAiZHYtfnrdBGiOxyF+nHI9a33BRX5Vl/3z0+ uHZ/Y6YPbNJ7iboOFrFZBCtt+lp3WaDB62ZoBewiMmd09JrqmMJAEgw3EbfQNtaPzHPg/EOhlZik Rgd4BCrzrbIqB2RKib+gnQJt2uoJaKOaV90S9Xgs3PC837OE9CEmY6/MTTG0xpbLh2hR/rLQ3sCr H56aODeuDrQBq85lXxRbDCERDUR7FZUhHv+i1aQaY59NPu26hDd6nqksSDq2mCddpidPBuGJz9lN X2nRyGkudDuWV6gIr6AZfaYv+ggTXOcCDJZFzMhWdLC7CPvRKxQ7vTiYV+4lgqOvV9MnZc149PPt itTysq/oOv70zx7q+tyaLTa4cqFhCclhIwSwOEJiV3xqQebvmwsDX7BaXGAJZIhbdUbNr3poEgct 6uAxw2zyr69WCJmTUUhz/k1/TT/eCUZJqnMg/6mje7tiVdaUQJcBtJ6cq5+mUDNUB1fohW8EOFai zFpP/0FaP62ctTGCA04wggNKAgEBMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UE AxMaU3RhcnRDb20gQ2xhc3MgMiBDbGllbnQgQ0ECEEAfBHP+tuqufC4R+F+Tu54wCQYFKw4DAhoF AKCCAZkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwMTIwMTMw MTMxWjAjBgkqhkiG9w0BCQQxFgQUIAfbIc5gQTTRuh6kySpXgG3NfbowgZoGCSsGAQQBgjcQBDGB jDCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3Rh cnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIg Q2xpZW50IENBAhBAHwRz/rbqrnwuEfhfk7ueMIGcBgsqhkiG9w0BCRACCzGBjKCBiTB1MQswCQYD VQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIgQ2xpZW50IENBAhBA HwRz/rbqrnwuEfhfk7ueMA0GCSqGSIb3DQEBAQUABIIBAB+Vy1cAkdT0jyV4c8k2CEDwUFj/MyBq nmv0s55aDHGS/8XgVrZJThICSy2hkb+TXufdHwHHaLKimgv/eGs2lRof2prkLx7nt4I5PfyrTIdh MYGFNHEyVnVMlohBFIU4yuI7LhskcEyoWkmj1CPM89VBH4qCXbsK6j+rP8R7OtsnmAfBdqr2cn3D OM+eKnnJpEOXvoo40rW+VyT5Cvuh5RfWZ7guhkuZEEsf0Xsm1ESFcNvD3ZT/4Tf1+J3qJzACovWd u9yF8IR14GD+jfgsjvA6LyLTFquM9AT2QjhrNImoo5Z+wRYsWQkmxHGRJz6FUFA+7sbM1pbmCUq9 fT0HYtUAAAAAAAA= --Apple-Mail=_15F82FB7-84D0-4F37-B58F-234DFA995BF0-- From nobody Fri Jan 20 05:35:32 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC72E129BA6 for ; Fri, 20 Jan 2017 05:35:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.899 X-Spam-Level: X-Spam-Status: No, score=-5.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kmaZgpQpNryU for ; Fri, 20 Jan 2017 05:35:29 -0800 (PST) Received: from mail-it0-x22a.google.com (mail-it0-x22a.google.com [IPv6:2607:f8b0:4001:c0b::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E539129B9E for ; Fri, 20 Jan 2017 05:35:29 -0800 (PST) Received: by mail-it0-x22a.google.com with SMTP id r185so20717877ita.0 for ; Fri, 20 Jan 2017 05:35:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=41r77h81ILR6QuPPVrwUyJWHBlHv0HIenekPOEXFDG8=; b=kR4E3VVHodIkcATYh2BHZX+zNbuVKly62b5g1kTS0gkuD+6RCt495pQhtnOEaLdw/f a8hTyfExRY5nXWAX+sfgXjq2oUQflrxCr4azCqjlA5+Vztd1xeSmV4hP7FefJXN6muo0 ENEROUldqY24i70zOX9tmi9RwJxFKbHDV0yHF1pD0igrI6nvBq33wwc3laU1okvdMJeo TSkzYey2WF457jJynVlfS9cn/2Fi6kgM/TCHe4j+N++cRzN0yI5Mec8/xXz3TxLHBHub 6y1AiNECgrqdcafu0voUb+etH8Zjxi/oYu0blmuQ7Wy8k88aI6Upr0+yWaBr07EVxGmR cLiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=41r77h81ILR6QuPPVrwUyJWHBlHv0HIenekPOEXFDG8=; b=Cm3P08NRvR8Xdrv8DW/SPAszUPmPp+aF4eIOg9hvrGbVlB41dhsQpNVNazRQXn8zJa azjlwLK05AINWeb1NTFBPcvn/s2bcorqVJYWNVe9R0uqyss4gnqOyKSSRQpa2/xRTNdd 72NX3wY5hEtqrCcSxgcoroFNWjJyG0enh6ECvj5mEnzmYBm9yPmh4LL1FyKjcmzqlTQJ d8tCHKHtax44QvjHB6hdu7BMxx+LvvbgnElQN7j+fSyWCekMyZV28XwM4VClT3Jlkctv lx0qMYLjkkq0z70Sm/YCVTDVdKENBByDAGLS18rVpk8yshTt1ykLIGHpeznbgZ0RulZG ggHg== X-Gm-Message-State: AIkVDXL8D5HUmZ0ZzJCWiyjpoOwILakQAl16zuln5wY8Jdm8OMQ5NVAhCAmQvrRBTe9rAUSgL+TmXXDxiId2KZns X-Received: by 10.36.98.80 with SMTP id d77mr3115087itc.99.1484919328543; Fri, 20 Jan 2017 05:35:28 -0800 (PST) MIME-Version: 1.0 Received: by 10.64.152.41 with HTTP; Fri, 20 Jan 2017 05:35:28 -0800 (PST) In-Reply-To: <8074E906-BC37-42BF-8DE3-C2C797D71577@ve7jtb.com> References: <8074E906-BC37-42BF-8DE3-C2C797D71577@ve7jtb.com> From: Bill Cox Date: Fri, 20 Jan 2017 05:35:28 -0800 Message-ID: To: John Bradley Content-Type: multipart/alternative; boundary=001a113f7af6198585054686b915 Archived-At: Cc: Tokbind WG , token-binding-team Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 13:35:31 -0000 --001a113f7af6198585054686b915 Content-Type: text/plain; charset=UTF-8 On Fri, Jan 20, 2017 at 5:01 AM, John Bradley wrote: > Great news. > > Is token binding not behind a feature flag for some of the newer builds of > Chrome? > It still is behind a feature flag. Nick Harper is doing a launch to turn token binding on by default, IIUC. > We should check if it is on in the Edge preview rings. I think Andrei > mentioned that was about to happen in Korea. > > Do you have any test page that would show if the cookies are successfully > token bound ? > I don't think we've built such a page yet. Would it be useful? Bill --001a113f7af6198585054686b915 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On F= ri, Jan 20, 2017 at 5:01 AM, John Bradley <ve7jtb@ve7jtb.com> wrote:
Great news.

Is token binding not behind a feature flag for some of the newer builds of = Chrome?

It still is behind a feature fl= ag.=C2=A0 Nick Harper is doing a launch to turn token binding on by default= , IIUC.
=C2=A0
We should check if it is on in the Edge preview rings.=C2=A0 =C2=A0I think = Andrei mentioned that was about to happen in Korea.

Do you have any test page that would show if the cookies are successfully t= oken bound ?

I don't think we'v= e built such a page yet.=C2=A0 Would it be useful?

Bill
--001a113f7af6198585054686b915-- From nobody Fri Jan 20 05:45:29 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA9491294C3 for ; Fri, 20 Jan 2017 05:45:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id anIZudG3l_i1 for ; Fri, 20 Jan 2017 05:45:24 -0800 (PST) Received: from mail-yw0-x234.google.com (mail-yw0-x234.google.com [IPv6:2607:f8b0:4002:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9367129BA9 for ; Fri, 20 Jan 2017 05:45:24 -0800 (PST) Received: by mail-yw0-x234.google.com with SMTP id w75so87068831ywg.1 for ; Fri, 20 Jan 2017 05:45:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=6GM9ysUhgvqZX9Y/LKBqVtoifGmTWjJwHHXI0b7ZjlY=; b=jBYqL/kv9xwwKqxRXGVr7DbpdiiKTbsFmpRrRHdCBbGtYNgfO7YsORW+7idhsmp+DH GcuJm7+h1KLu8tF3hbnYh3h2myX230Yq6L+4Nlc9k8UbVmZgIKBCMQOQKZ8ffqcUDLWy gFKIBhvV0F0qncypnREPUP48KldBG7e2Z8unRBcVhR3W3lnVHLjZ3zhMS4YFyoHkgtO6 HJ1hP555Nvjs4dBr65nlKznVC8rgYOfUxJYGjBEzPXf0MKP6dJYrpzYZEDCbFBPc7x6h qVzTpwMCoEJk8qnmgWi19Uf5Ih2yEnDtxJTuqdLAgOioU/hwH7dwUnFyfTpgTNNc6V4A onSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=6GM9ysUhgvqZX9Y/LKBqVtoifGmTWjJwHHXI0b7ZjlY=; b=afuDkthfhRmzR2a6cYyKvUzzJ+3dxTkS8Yh56YYRjIz0VGrwDCj2of1ON5GlgoDPj2 15kdwTStVPApLSzlJ8wR5AOp4/xfIl7ED4ZGpGA2jUddwg6zfk0iLFt21W722Iz8DMWj mXcGnoge7hTQPm41dkGqMCIkOA9OXsbTqIDjRuUdwma1kSR0eP9Je6Dgo9oSEFZhHm8m 9NZyhNaa4Qju2IKYkMOxA2L+cXop/MKZkHV2sLkmVUMJ3t9M+CrQlRFDR7JjcXx9fbuO EB5i3RRZYF4Il+jAYtyC522NzKZkpxdU1pm94LeCGxeIPc+QYfsXfa1sDPtWEpywaOtF zC7Q== X-Gm-Message-State: AIkVDXKRO5M6bFIR1mVwPCq1DSwOBW0ShQQEmWA/dqMRny11CHqqht59GePneC/o1DsG9so6 X-Received: by 10.55.139.5 with SMTP id n5mr11790028qkd.225.1484919923861; Fri, 20 Jan 2017 05:45:23 -0800 (PST) Received: from [192.168.86.130] ([191.115.66.10]) by smtp.gmail.com with ESMTPSA id 7sm5939419qkx.49.2017.01.20.05.45.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 Jan 2017 05:45:23 -0800 (PST) From: John Bradley Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_0BDB4D97-B875-4C44-90EA-C514F9511896"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Fri, 20 Jan 2017 10:45:19 -0300 In-Reply-To: To: Bill Cox References: <8074E906-BC37-42BF-8DE3-C2C797D71577@ve7jtb.com> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: Tokbind WG , token-binding-team Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 13:45:27 -0000 --Apple-Mail=_0BDB4D97-B875-4C44-90EA-C514F9511896 Content-Type: multipart/alternative; boundary="Apple-Mail=_6FAC8332-BE57-4B80-A7C9-3DFB4DF1E9EB" --Apple-Mail=_6FAC8332-BE57-4B80-A7C9-3DFB4DF1E9EB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Can you remind people in the WG what the flag is. I think a test page is useful for PR. The browserauth.net page run my Dirk should be updated to point to it. I know that there is a test in the Chromium source but having some = public page will encourage testing. Thanks=20 John B. > On Jan 20, 2017, at 10:35 AM, Bill Cox wrote: >=20 > On Fri, Jan 20, 2017 at 5:01 AM, John Bradley > wrote: > Great news. >=20 > Is token binding not behind a feature flag for some of the newer = builds of Chrome? >=20 > It still is behind a feature flag. Nick Harper is doing a launch to = turn token binding on by default, IIUC. > =20 > We should check if it is on in the Edge preview rings. I think = Andrei mentioned that was about to happen in Korea. >=20 > Do you have any test page that would show if the cookies are = successfully token bound ? >=20 > I don't think we've built such a page yet. Would it be useful? >=20 > Bill --Apple-Mail=_6FAC8332-BE57-4B80-A7C9-3DFB4DF1E9EB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Can you remind people in the WG what the flag is.

I think a test page is = useful for PR.

The browserauth.net page run my Dirk should be updated to = point to it.

I = know that there is a test in the Chromium source but having some public = page will encourage testing.

Thanks 
John = B.

On Jan 20, 2017, at 10:35 AM, Bill Cox <waywardgeek@google.com> wrote:

On Fri, = Jan 20, 2017 at 5:01 AM, John Bradley <ve7jtb@ve7jtb.com> wrote:
Great news.

Is token binding not behind a feature flag for some of the newer builds = of Chrome?

It still is behind a feature = flag.  Nick Harper is doing a launch to turn token binding on by = default, IIUC.
 
We should check if it is on in the Edge preview rings.   I = think Andrei mentioned that was about to happen in Korea.

Do you have any test page that would show if the cookies are = successfully token bound ?

I don't think we've built such a page = yet.  Would it be useful?

Bill

= --Apple-Mail=_6FAC8332-BE57-4B80-A7C9-3DFB4DF1E9EB-- --Apple-Mail=_0BDB4D97-B875-4C44-90EA-C514F9511896 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILMTCCBUcw ggQvoAMCAQICEEAfBHP+tuqufC4R+F+Tu54wDQYJKoZIhvcNAQELBQAwdTELMAkGA1UEBhMCSUwx FjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAyIENsaWVudCBDQTAeFw0xNjA4MTIy MTE5NDFaFw0xODA4MTIyMTE5NDFaMIGCMQswCQYDVQQGEwJDTDEiMCAGA1UECAwZTWV0cm9wb2xp dGFuYSBkZSBTYW50aWFnbzEWMBQGA1UEBwwNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAwwMSm9obiBC cmFkbGV5MSAwHgYJKoZIhvcNAQkBFhF2ZTdqdGJAdmU3anRiLmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBALhTcSiDGvVrm4hlJA8WyFcWWe0dqnuJzstQYTaF281JFOEPA/13kQYI JMXAEUcS7NvW7KdUI0tHU0N6RTo0Ilf1E1nm8No++eqHO8pFUZ/cidpv0r+1Qcl9EgrpbZ00Y7Xg pq06EZELzJAmds4QQcsTKdpLNFbVcFnM11i2Gj5VNsYgO+qPO2AS8rLHkgDWnNkc9/lA+ZK5wGiU zxPU9KnIrERoTif3Zk7KjLvFpBWYD60M/lNoHZ5zxYgmYLmvoM1TSLn4Ms57wwT5MieV2l0aqlGC 7CKNa6XyeL1B0y0wSxL3PJQS4vSLDnttZC7od2A6yjeUMyM3rQ41vqUIMc8CAwEAAaOCAcMwggG/ MA4GA1UdDwEB/wQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwCQYDVR0TBAIw ADAdBgNVHQ4EFgQUmA9bUmBmTYkCcZ3yYv8IRRP2nN4wHwYDVR0jBBgwFoAUmZerGDU6i1lFQ5iy cnHI9PsJzxYwbwYIKwYBBQUHAQEEYzBhMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNz bC5jb20wOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3NjYS5jbGll bnQyLmNydDA4BgNVHR8EMTAvMC2gK6AphidodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zY2EtY2xp ZW50Mi5jcmwwHAYDVR0RBBUwE4ERdmU3anRiQHZlN2p0Yi5jb20wIwYDVR0SBBwwGoYYaHR0cDov L3d3dy5zdGFydHNzbC5jb20vMFUGA1UdIAROMEwwDAYKKwYBBAGBtTcGATA8BgsrBgEEAYG1NwEC BTAtMCsGCCsGAQUFBwIBFh9odHRwczovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4IBAQBqcYJfFA/ITkX4L6JihqW168Wog1BOfkbPXO+wPn5G9P1NwruGfu41b70EPPwV vol+/j+qhSSrDjFyfNBsq4G45GRR6hwx0ei/bH0UW15Y63ASYPkNlj3ydCcvhw5ItWD5aYPphBx9 C7tLnQ7ow09cqt2CIgPd3W/IGri7p4hWPbdcX0oFIhJcDxmCwTcWyoVoIo4aas5gP44LPGneCoqI lXQMJinwneEnKd7rWXlzVWv7geaH3t79zARSw9ev9F4E61cDuHi+vgTFEpio7oxybqfj99yLibhX uZjReYnYbDMRiWDXduVIrIGYwmnUuD8a0b20kJgHm+FEgB6UMa9JMIIF4jCCA8qgAwIBAgIQXLZI bkcMmMZ/9oDbZErijTANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3Rh cnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEp MCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTUxMjE2MDEwMDA1 WhcNMzAxMjE2MDEwMDA1WjB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDIgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7g9Q jJUJI4Ss9VBqj9Y3ok4h/TIJZUc+rzj61Rv3hNB/yeEEC1fz3i/EU+MXOOGxM7KCbtCIcJxHIW/k 8RP6sPPMO4cTg7sNzfBWsYsemtY6fN/kVr2R2X+/PjvtxmAaXpGX0znvQPxaE123IMGXy0zEKHZ/ nJDZ199TP9TNn9v+1QO0AZb4oaJ7ch0DpSJa8kF5xiNFDAg9taKKSrVuPHJL9MFFYPIqwShjHg+u YEzjfxbMP2QWwamnaA9Y7fORSDNapduFlARAcDtXdMpAijiG4HKnrN323I0Ka7lDTAWyLtTDCETK sI8fzOyL0inEu1WEVpdPytm8s1rwQB4f9QIDAQABo4IBZDCCAWAwDgYDVR0PAQH/BAQDAgEGMB0G A1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQr MCkwJ6AloCOGIWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDBmBggrBgEFBQcBAQRa MFgwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTAwBggrBgEFBQcwAoYkaHR0 cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvY2EuY3J0MB0GA1UdDgQWBBSZl6sYNTqLWUVDmLJy ccj0+wnPFjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jA/BgNVHSAEODA2MDQGBFUd IAAwLDAqBggrBgEFBQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4ICAQCZQUEEzvYk9U4wNHhDu1f9QGwbzAH4m4wIKH8ZidNYwZhyoNKW041iJ002KMW9 ywYM95n4770tT45yH29vTMlZtBvz0h44KuxMLNXRCTDwvV07sT39nPjFi5MpwZaLVueNiaa1vok1 n2Wn8lLcyCltYZNGAEifM0ko/A/vvckftFIZG75RAiZHYtfnrdBGiOxyF+nHI9a33BRX5Vl/3z0+ uHZ/Y6YPbNJ7iboOFrFZBCtt+lp3WaDB62ZoBewiMmd09JrqmMJAEgw3EbfQNtaPzHPg/EOhlZik Rgd4BCrzrbIqB2RKib+gnQJt2uoJaKOaV90S9Xgs3PC837OE9CEmY6/MTTG0xpbLh2hR/rLQ3sCr H56aODeuDrQBq85lXxRbDCERDUR7FZUhHv+i1aQaY59NPu26hDd6nqksSDq2mCddpidPBuGJz9lN X2nRyGkudDuWV6gIr6AZfaYv+ggTXOcCDJZFzMhWdLC7CPvRKxQ7vTiYV+4lgqOvV9MnZc149PPt itTysq/oOv70zx7q+tyaLTa4cqFhCclhIwSwOEJiV3xqQebvmwsDX7BaXGAJZIhbdUbNr3poEgct 6uAxw2zyr69WCJmTUUhz/k1/TT/eCUZJqnMg/6mje7tiVdaUQJcBtJ6cq5+mUDNUB1fohW8EOFai zFpP/0FaP62ctTGCA04wggNKAgEBMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UE AxMaU3RhcnRDb20gQ2xhc3MgMiBDbGllbnQgQ0ECEEAfBHP+tuqufC4R+F+Tu54wCQYFKw4DAhoF AKCCAZkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwMTIwMTM0 NTIwWjAjBgkqhkiG9w0BCQQxFgQU6LdU50BqEZl42t4vlcZFjyPKlN0wgZoGCSsGAQQBgjcQBDGB jDCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3Rh cnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIg Q2xpZW50IENBAhBAHwRz/rbqrnwuEfhfk7ueMIGcBgsqhkiG9w0BCRACCzGBjKCBiTB1MQswCQYD VQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIgQ2xpZW50IENBAhBA HwRz/rbqrnwuEfhfk7ueMA0GCSqGSIb3DQEBAQUABIIBAIA8Ad72DiHLb7zKq7UBxNMIvqxfSJc7 bKR54eDVAKhjhYoAH5Zn2svnJuE5P5NTqUN9XP6A5kspWPz2Gx0zZxvADEYxcIZB5W0yhArDFltO ZI7JpZlM/OhOi646vbj2drT8m2mvYoXAY1yODSIGoxhPNkix699GOK8pPK+Di73eStc/U/ld8cRB tmj+m+tcaS0Ue0afYVvaPeABICq7n8uvPmjVZ0b0kVeWcPKktUi3PQQu/cvvjapf9uOBr+UlCnTo 3yHv6u5FEbx0+jpllsvskR4CuCfrVY2l9i1LP2QX0vpiaarWjez/rS8q109icprULuLGs3r2PxFI 6SX5lGUAAAAAAAA= --Apple-Mail=_0BDB4D97-B875-4C44-90EA-C514F9511896-- From nobody Fri Jan 20 07:23:29 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75C67129BDA for ; Fri, 20 Jan 2017 07:23:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uxSsP9fJarV2 for ; Fri, 20 Jan 2017 07:23:25 -0800 (PST) Received: from mail-yw0-x236.google.com (mail-yw0-x236.google.com [IPv6:2607:f8b0:4002:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BFDD129608 for ; Fri, 20 Jan 2017 07:23:25 -0800 (PST) Received: by mail-yw0-x236.google.com with SMTP id w75so90707011ywg.1 for ; Fri, 20 Jan 2017 07:23:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=L/rSwXfLiGHWjIjbimJopSg7DnRLnMunnQhRSJy/wKA=; b=JOVhV28aNtLsEcfdtrY2daHxK0ZLjLQsxVXqHxSrDIV7bLexyZJSGEgrSEn65b36k0 OEaS7Xzko3LpFIeiSAol7f0Qsj9vtYOfTlbwyJXkF2ZMS7GICZ4djsye26RKPDIoRET3 vBGh2UodhauHSWPr6G7qhCyAVjttFQpo6U/qc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=L/rSwXfLiGHWjIjbimJopSg7DnRLnMunnQhRSJy/wKA=; b=Ufd8y49hc/XKRFbNdr99f+EDZZlaSutYL+hcENZipwHkI36M8Yt4BwygzUurr12gvw iBzneWkRSGU6NLVyJwfy8mpsEAS1Pj7iZcGu0fuPkbmoomrvMq6den8EZq9r4GgbYrtV SkYB8TCqzLbNDrLdSfP4rYwq1BxW8p5rKFZJZ2jvtrbsFxJAQRL1Q8yGfTpz3NhLeqxG ylIQ4oO+MqlNWt93+6sv6vMiZqtiNmvFLGnnolH4DBQ20MZiVSUvtXnCPTRPZKwdycl0 AvAyqefsqdNbnSnG1PNGMUqA1crLpQvxLTylq1Xtvi9SZ3WBialcft20x9m3dW9JW/3p Mqxg== X-Gm-Message-State: AIkVDXKDco/VG4GZGRBWPvKbQLqjsqbDh/OJUmAqHkqkedeoSaIfh8ZphwVZA/GGdviziRLL1UXErVj4wR44CNLd X-Received: by 10.129.98.70 with SMTP id w67mr11544594ywb.184.1484925804732; Fri, 20 Jan 2017 07:23:24 -0800 (PST) MIME-Version: 1.0 Received: by 10.37.90.133 with HTTP; Fri, 20 Jan 2017 07:22:54 -0800 (PST) In-Reply-To: References: <8074E906-BC37-42BF-8DE3-C2C797D71577@ve7jtb.com> From: Brian Campbell Date: Fri, 20 Jan 2017 08:22:54 -0700 Message-ID: To: John Bradley Content-Type: multipart/alternative; boundary=001a11471bae1c16470546883b75 Archived-At: Cc: Tokbind WG , token-binding-team , Bill Cox Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 15:23:27 -0000 --001a11471bae1c16470546883b75 Content-Type: text/plain; charset=UTF-8 chrome://flags/#enable-token-binding AFAIK is where one can flip the flag On Fri, Jan 20, 2017 at 6:45 AM, John Bradley wrote: > Can you remind people in the WG what the flag is. > > I think a test page is useful for PR. > > The browserauth.net page run my Dirk should be updated to point to it. > > I know that there is a test in the Chromium source but having some public > page will encourage testing. > > Thanks > John B. > > On Jan 20, 2017, at 10:35 AM, Bill Cox wrote: > > On Fri, Jan 20, 2017 at 5:01 AM, John Bradley wrote: > >> Great news. >> >> Is token binding not behind a feature flag for some of the newer builds >> of Chrome? >> > > It still is behind a feature flag. Nick Harper is doing a launch to turn > token binding on by default, IIUC. > > >> We should check if it is on in the Edge preview rings. I think Andrei >> mentioned that was about to happen in Korea. >> >> Do you have any test page that would show if the cookies are successfully >> token bound ? >> > > I don't think we've built such a page yet. Would it be useful? > > Bill > > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --001a11471bae1c16470546883b75 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
chrome://flags/#enable-token-binding AFAIK is where one ca= n flip the flag

On Fri, Jan 20, 2017 at 6:45 AM, John Bradley &l= t;ve7jtb@ve7jtb.com<= /a>> wrote:
Can you remind people in the WG what the flag is.

=
I think a test page is useful for PR.

T= he browserauth.net= page run my Dirk should be updated to point to it.

I know that there is a test in the Chromium source but having some public= page will encourage testing.

Thanks=C2=A0
John B.

On Jan 20, 2017, at 10:35 AM, Bill Cox <waywardgeek@google.com> wrote:<= /div>
On Fri, = Jan 20, 2017 at 5:01 AM, John Bradley <ve7jtb@ve7jtb.com> wr= ote:
Great news.

Is token binding not behind a feature flag for some of the newer builds of = Chrome?

It still is behind a feature fl= ag.=C2=A0 Nick Harper is doing a launch to turn token binding on by default= , IIUC.
=C2=A0
We should check if it is on in the Edge preview rings.=C2=A0 =C2=A0I think = Andrei mentioned that was about to happen in Korea.

Do you have any test page that would show if the cookies are successfully t= oken bound ?

I don't think we'v= e built such a page yet.=C2=A0 Would it be useful?

Bill


__________________= _____________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e


--001a11471bae1c16470546883b75-- From nobody Fri Jan 20 09:36:59 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA2A41293E0 for ; Fri, 20 Jan 2017 09:36:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.157 X-Spam-Level: X-Spam-Status: No, score=-3.157 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.156, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Hvysw4Q21Wb for ; Fri, 20 Jan 2017 09:36:56 -0800 (PST) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0129.outbound.protection.outlook.com [104.47.34.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B088B12943D for ; Fri, 20 Jan 2017 09:36:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=OfQ719lblmJ7Yxgex7T6jq1nOj7OMiEfZQZwX2mZH9A=; b=JhG/myQweHsoG/QnXWs3MYmu8GQyop4G6va/c5vMg910XVYSft5V5zlGmLBvv1YrGjVs2ciBfWja7zRiASlLOTjxp4BcALONDybXFiqJE8rzFQYmbt60FvPxZjoH02/H0LvLshlhoML/lQZSP1Uq+l7iaIYbIxULNqiEx/AYgGM= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.845.12; Fri, 20 Jan 2017 17:36:54 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0845.021; Fri, 20 Jan 2017 17:36:54 +0000 From: Andrei Popov To: Brian Campbell , John Bradley Thread-Topic: [Unbearable] Token binding version (0, 10) support is global on google servers Thread-Index: AQHScx1jG803qeLKKkijf4Ce8+12zaFBXeUAgAACwICAABtEAIAAI9vQ Date: Fri, 20 Jan 2017 17:36:53 +0000 Message-ID: References: <8074E906-BC37-42BF-8DE3-C2C797D71577@ve7jtb.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:a::1d2] x-ms-office365-filtering-correlation-id: cbd50cc2-ecd6-4bfe-8768-08d4415aecbf x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0842; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0842; 7:O6BqePgxRDn/iEe5UGu4D2JTxX0s66i0QbmfN5QRsgRvvMZ7zHtXiiRxPJTXMp0fNjdEu+qCRTQDIM59jivYdA3Oq6O+EAVCTk9Cvbreg8jCUQZVlzVSjoj860nayl6z+ny0+AUVTMtoMVuvdTKFgOm3K8BLdAVmuUz3DKqpqmAk1766aNj3u+Jk1a5qClwNyrLpnCOYGTYftw+oFKHog9bmQs3DDestWu5cwQPCXGo/rvlNFgLhxTHYdLkBd9v2leJGh831sbR03PlAl72l0A/XzdUJluH/BbPpAdo+TxJp3jd1iaUN7u4AHJ8iJPNq68D4QG/dq8FNl4QzTeIrNA/80ziEQ8gOyoY2CvHQZE5IWYiC8vl8yicOah8FW1eWsSfvQwuZoAiVGS8l1qGs9eXpzpGfjza82/yNuBEw+LPoCKxUfSBa5KROtcZV632vg79kpdO5Ajy7wmTQXm7HiWA+vvCFqVgB4RYtwq9qkTU= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(211936372134217)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123564025)(20161123562025)(20161123560025)(6072148)(6047074); SRVR:CY1PR0301MB0842; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0842; x-forefront-prvs: 01930B2BA8 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39840400002)(39860400002)(39410400002)(39450400003)(39850400002)(189002)(377454003)(199003)(24454002)(6436002)(106116001)(54896002)(189998001)(8990500004)(236005)(2900100001)(92566002)(68736007)(54906002)(101416001)(33656002)(38730400001)(790700001)(99286003)(2906002)(9686003)(55016002)(6506006)(6116002)(102836003)(54356999)(4326007)(5005710100001)(50986999)(76176999)(77096006)(53936002)(10290500002)(16601075003)(229853002)(5001770100001)(606005)(25786008)(3660700001)(2950100002)(6306002)(8676002)(10090500001)(5660300001)(93886004)(97736004)(8936002)(86362001)(7906003)(86612001)(122556002)(3280700002)(74316002)(81166006)(7696004)(81156014)(7736002)(105586002)(106356001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0842; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB08428BF819199AE377CF352A8C710CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jan 2017 17:36:53.8265 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0842 Archived-At: Cc: Tokbind WG , token-binding-team , Bill Cox Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 17:36:59 -0000 --_000_CY1PR0301MB08428BF819199AE377CF352A8C710CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIFdlIHNob3VsZCBjaGVjayBpZiBpdCBpcyBvbiBpbiB0aGUgRWRnZSBwcmV2aWV3IHJpbmdz LiAgIEkgdGhpbmsgQW5kcmVpIG1lbnRpb25lZCB0aGF0IHdhcyBhYm91dCB0byBoYXBwZW4gaW4g S29yZWEuDQpUQiB2MC4xMCBpcyBlbmFibGVkIGJ5IGRlZmF1bHQgaW4gSUUgJiBFZGdlIG9uIHRo ZSBsYXRlc3QgV2luZG93cyAxMCBpbnNpZGVyIHByZXZpZXcgYnVpbGQuDQoNCkNoZWVycywNCg0K QW5kcmVpDQoNCkZyb206IFVuYmVhcmFibGUgW21haWx0bzp1bmJlYXJhYmxlLWJvdW5jZXNAaWV0 Zi5vcmddIE9uIEJlaGFsZiBPZiBCcmlhbiBDYW1wYmVsbA0KU2VudDogRnJpZGF5LCBKYW51YXJ5 IDIwLCAyMDE3IDc6MjMgQU0NClRvOiBKb2huIEJyYWRsZXkgPHZlN2p0YkB2ZTdqdGIuY29tPg0K Q2M6IFRva2JpbmQgV0cgPHVuYmVhcmFibGVAaWV0Zi5vcmc+OyB0b2tlbi1iaW5kaW5nLXRlYW0g PHRva2VuLWJpbmRpbmctdGVhbUBnb29nbGUuY29tPjsgQmlsbCBDb3ggPHdheXdhcmRnZWVrQGdv b2dsZS5jb20+DQpTdWJqZWN0OiBSZTogW1VuYmVhcmFibGVdIFRva2VuIGJpbmRpbmcgdmVyc2lv biAoMCwgMTApIHN1cHBvcnQgaXMgZ2xvYmFsIG9uIGdvb2dsZSBzZXJ2ZXJzDQoNCmNocm9tZTov L2ZsYWdzLyNlbmFibGUtdG9rZW4tYmluZGluZyBBRkFJSyBpcyB3aGVyZSBvbmUgY2FuIGZsaXAg dGhlIGZsYWcNCg0KT24gRnJpLCBKYW4gMjAsIDIwMTcgYXQgNjo0NSBBTSwgSm9obiBCcmFkbGV5 IDx2ZTdqdGJAdmU3anRiLmNvbTxtYWlsdG86dmU3anRiQHZlN2p0Yi5jb20+PiB3cm90ZToNCkNh biB5b3UgcmVtaW5kIHBlb3BsZSBpbiB0aGUgV0cgd2hhdCB0aGUgZmxhZyBpcy4NCg0KSSB0aGlu ayBhIHRlc3QgcGFnZSBpcyB1c2VmdWwgZm9yIFBSLg0KDQpUaGUgYnJvd3NlcmF1dGgubmV0PGh0 dHA6Ly9icm93c2VyYXV0aC5uZXQ+IHBhZ2UgcnVuIG15IERpcmsgc2hvdWxkIGJlIHVwZGF0ZWQg dG8gcG9pbnQgdG8gaXQuDQoNCkkga25vdyB0aGF0IHRoZXJlIGlzIGEgdGVzdCBpbiB0aGUgQ2hy b21pdW0gc291cmNlIGJ1dCBoYXZpbmcgc29tZSBwdWJsaWMgcGFnZSB3aWxsIGVuY291cmFnZSB0 ZXN0aW5nLg0KDQpUaGFua3MNCkpvaG4gQi4NCg0KT24gSmFuIDIwLCAyMDE3LCBhdCAxMDozNSBB TSwgQmlsbCBDb3ggPHdheXdhcmRnZWVrQGdvb2dsZS5jb208bWFpbHRvOndheXdhcmRnZWVrQGdv b2dsZS5jb20+PiB3cm90ZToNCg0KT24gRnJpLCBKYW4gMjAsIDIwMTcgYXQgNTowMSBBTSwgSm9o biBCcmFkbGV5IDx2ZTdqdGJAdmU3anRiLmNvbTxtYWlsdG86dmU3anRiQHZlN2p0Yi5jb20+PiB3 cm90ZToNCkdyZWF0IG5ld3MuDQoNCklzIHRva2VuIGJpbmRpbmcgbm90IGJlaGluZCBhIGZlYXR1 cmUgZmxhZyBmb3Igc29tZSBvZiB0aGUgbmV3ZXIgYnVpbGRzIG9mIENocm9tZT8NCg0KSXQgc3Rp bGwgaXMgYmVoaW5kIGEgZmVhdHVyZSBmbGFnLiAgTmljayBIYXJwZXIgaXMgZG9pbmcgYSBsYXVu Y2ggdG8gdHVybiB0b2tlbiBiaW5kaW5nIG9uIGJ5IGRlZmF1bHQsIElJVUMuDQoNCldlIHNob3Vs ZCBjaGVjayBpZiBpdCBpcyBvbiBpbiB0aGUgRWRnZSBwcmV2aWV3IHJpbmdzLiAgIEkgdGhpbmsg QW5kcmVpIG1lbnRpb25lZCB0aGF0IHdhcyBhYm91dCB0byBoYXBwZW4gaW4gS29yZWEuDQoNCkRv IHlvdSBoYXZlIGFueSB0ZXN0IHBhZ2UgdGhhdCB3b3VsZCBzaG93IGlmIHRoZSBjb29raWVzIGFy ZSBzdWNjZXNzZnVsbHkgdG9rZW4gYm91bmQgPw0KDQpJIGRvbid0IHRoaW5rIHdlJ3ZlIGJ1aWx0 IHN1Y2ggYSBwYWdlIHlldC4gIFdvdWxkIGl0IGJlIHVzZWZ1bD8NCg0KQmlsbA0KDQoNCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpVbmJlYXJhYmxlIG1h aWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86VW5iZWFyYWJsZUBpZXRmLm9y Zz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZQ0KDQo= --_000_CY1PR0301MB08428BF819199AE377CF352A8C710CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBl OnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNl Y3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAx LjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3Qg RGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjc2ODc1MjU2Ow0KCW1zby1s aXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxNjI0NTIxOTU4IDY1ODQz NzczNCA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4 OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0 LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczsN Cgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6 bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K QGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNv dXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGww OmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30N Ci0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6 ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2 OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0t LT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxl Ij4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+PCFb aWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6V2luZ2RpbmdzIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7DmDxzcGFuIHN0eWxl PSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7DQo8L3NwYW4+ PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+V2Ugc2hvdWxkIGNoZWNrIGlmIGl0IGlzIG9uIGluIHRo ZSBFZGdlIHByZXZpZXcgcmluZ3MuJm5ic3A7ICZuYnNwO0kgdGhpbmsgQW5kcmVpIG1lbnRpb25l ZCB0aGF0IHdhcyBhYm91dCB0byBoYXBwZW4gaW4gS29yZWEuPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PlRCIHYwLjEwIGlzIGVuYWJsZWQgYnkgZGVmYXVsdCBpbiBJRSAmYW1wOyBFZGdlIG9uIHRoZSBs YXRlc3QgV2luZG93cyAxMCBpbnNpZGVyIHByZXZpZXcgYnVpbGQuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkNo ZWVycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+QW5kcmVpPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFu PjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBVbmJlYXJhYmxlIFttYWlsdG86dW5iZWFyYWJsZS1ib3Vu Y2VzQGlldGYub3JnXQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5CcmlhbiBDYW1wYmVsbDxicj4NCjxi PlNlbnQ6PC9iPiBGcmlkYXksIEphbnVhcnkgMjAsIDIwMTcgNzoyMyBBTTxicj4NCjxiPlRvOjwv Yj4gSm9obiBCcmFkbGV5ICZsdDt2ZTdqdGJAdmU3anRiLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+ IFRva2JpbmQgV0cgJmx0O3VuYmVhcmFibGVAaWV0Zi5vcmcmZ3Q7OyB0b2tlbi1iaW5kaW5nLXRl YW0gJmx0O3Rva2VuLWJpbmRpbmctdGVhbUBnb29nbGUuY29tJmd0OzsgQmlsbCBDb3ggJmx0O3dh eXdhcmRnZWVrQGdvb2dsZS5jb20mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVW5iZWFy YWJsZV0gVG9rZW4gYmluZGluZyB2ZXJzaW9uICgwLCAxMCkgc3VwcG9ydCBpcyBnbG9iYWwgb24g Z29vZ2xlIHNlcnZlcnM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5jaHJv bWU6Ly9mbGFncy8jZW5hYmxlLXRva2VuLWJpbmRpbmcgQUZBSUsgaXMgd2hlcmUgb25lIGNhbiBm bGlwIHRoZSBmbGFnDQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIEZyaSwgSmFuIDIwLCAyMDE3IGF0IDY6NDUgQU0sIEpvaG4gQnJhZGxleSAmbHQ7PGEg aHJlZj0ibWFpbHRvOnZlN2p0YkB2ZTdqdGIuY29tIiB0YXJnZXQ9Il9ibGFuayI+dmU3anRiQHZl N2p0Yi5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q2FuIHlvdSByZW1pbmQgcGVvcGxlIGluIHRoZSBXRyB3 aGF0IHRoZSBmbGFnIGlzLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SSB0aGluayBhIHRlc3QgcGFnZSBpcyB1c2VmdWwgZm9yIFBSLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgPGEgaHJlZj0iaHR0 cDovL2Jyb3dzZXJhdXRoLm5ldCIgdGFyZ2V0PSJfYmxhbmsiPmJyb3dzZXJhdXRoLm5ldDwvYT4g cGFnZSBydW4gbXkgRGlyayBzaG91bGQgYmUgdXBkYXRlZCB0byBwb2ludCB0byBpdC48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBrbm93IHRo YXQgdGhlcmUgaXMgYSB0ZXN0IGluIHRoZSBDaHJvbWl1bSBzb3VyY2UgYnV0IGhhdmluZyBzb21l IHB1YmxpYyBwYWdlIHdpbGwgZW5jb3VyYWdlIHRlc3RpbmcuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcyZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Sm9obiBCLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5PbiBKYW4gMjAsIDIwMTcsIGF0IDEwOjM1IEFNLCBCaWxsIENveCAmbHQ7PGEgaHJlZj0i bWFpbHRvOndheXdhcmRnZWVrQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj53YXl3YXJkZ2Vl a0Bnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEZyaSwgSmFuIDIwLCAyMDE3IGF0IDU6 MDEgQU0sIEpvaG4gQnJhZGxleSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnZlN2p0YkB2ZTdqdGIuY29t IiB0YXJnZXQ9Il9ibGFuayI+dmU3anRiQHZlN2p0Yi5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xp ZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44 cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5HcmVhdCBuZXdzLjxi cj4NCjxicj4NCklzIHRva2VuIGJpbmRpbmcgbm90IGJlaGluZCBhIGZlYXR1cmUgZmxhZyBmb3Ig c29tZSBvZiB0aGUgbmV3ZXIgYnVpbGRzIG9mIENocm9tZT88bzpwPjwvbzpwPjwvcD4NCjwvYmxv Y2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl0IHN0aWxsIGlzIGJlaGlu ZCBhIGZlYXR1cmUgZmxhZy4mbmJzcDsgTmljayBIYXJwZXIgaXMgZG9pbmcgYSBsYXVuY2ggdG8g dHVybiB0b2tlbiBiaW5kaW5nIG9uIGJ5IGRlZmF1bHQsIElJVUMuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk ICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldlIHNob3VsZCBjaGVj ayBpZiBpdCBpcyBvbiBpbiB0aGUgRWRnZSBwcmV2aWV3IHJpbmdzLiZuYnNwOyAmbmJzcDtJIHRo aW5rIEFuZHJlaSBtZW50aW9uZWQgdGhhdCB3YXMgYWJvdXQgdG8gaGFwcGVuIGluIEtvcmVhLjxi cj4NCjxicj4NCkRvIHlvdSBoYXZlIGFueSB0ZXN0IHBhZ2UgdGhhdCB3b3VsZCBzaG93IGlmIHRo ZSBjb29raWVzIGFyZSBzdWNjZXNzZnVsbHkgdG9rZW4gYm91bmQgPzxvOnA+PC9vOnA+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBkb24ndCB0aGlu ayB3ZSd2ZSBidWlsdCBzdWNoIGEgcGFnZSB5ZXQuJm5ic3A7IFdvdWxkIGl0IGJlIHVzZWZ1bD88 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Qmls bDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpVbmJlYXJhYmxlIG1haWxpbmcg bGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpVbmJlYXJhYmxlQGlldGYub3JnIj5VbmJlYXJhYmxl QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vdW5iZWFyYWJsZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2tx dW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CY1PR0301MB08428BF819199AE377CF352A8C710CY1PR0301MB0842_-- From nobody Fri Jan 20 09:50:41 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A49912966C for ; Fri, 20 Jan 2017 09:50:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mau2Ni-kp9ji for ; Fri, 20 Jan 2017 09:50:37 -0800 (PST) Received: from mail-yb0-x235.google.com (mail-yb0-x235.google.com [IPv6:2607:f8b0:4002:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ECB48127076 for ; Fri, 20 Jan 2017 09:50:36 -0800 (PST) Received: by mail-yb0-x235.google.com with SMTP id l23so63981969ybj.2 for ; Fri, 20 Jan 2017 09:50:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=2y4mi7wmpvl13BPiJZ0WzddVmhgV7WmuUnEOcW5NqKU=; b=0CwUWmBHne3c5Cnh/L+NGnMW5f5fz3ofq+xXUg9JmNMHiN5db0B6YssO6itTrU903U TNDEnszGDyrh+4wp2So4ACgQvI2l3jpQB//oWjsR6jC6FM5JTJ0/ttPuBs18747HBBsQ JaaYUvf5Mpp/qmdyy2NWHYfrHlIqmJJTRy2q+lkVjL+8EIxnNS5Fp/DFFbvAHH5B6IaB 4qPZqAg+aiuMjH/JkjcKYn61aj08i9hMEyMKRqsorwJySuHkDK0hFGO+T2+EJNEJ7TVW LW+pWGKozpRwkcQojVBhgOubUnYxv+Lk1pwwzjnIzbyuVJa6rueN/1XkEUjOGodr5aV8 8n3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=2y4mi7wmpvl13BPiJZ0WzddVmhgV7WmuUnEOcW5NqKU=; b=aTKmSG7UDQDJ/N0I1Pgj34U57dpDAIZ942ieyMDbJs2RiBqW/qSxqFbFYkYaktdNlL mhQXOFMu3Um6/4EuL0ElliEsuXZWmM/tNieoScco02KvFbZFJKcLCZcpEx7LLvcwTQoq vXP4mU4TZ5oHdGnUiySo0LmJ09dTtVfgPGALBYLhBJG70Lodjmgziv3BDSbN6GJHzYh6 jHANBBB7mOjh64/yuKM3MqB0spahUZQwdmpGxhkHHkRGrT7UxMgZRwfvYh9ls8UbDT2O qJ/EL/MEXVtT7T2Sezitd2rFv59Cou1SusQpRV1r/iViQ5/VsuPgj/fdcpOQf6DmGrbd J3xw== X-Gm-Message-State: AIkVDXLv6QnoeOljWqxkVgCM2Dd49f9rrf95RgQPq4PFGBj93Adz6RunFsa0TShFno8TSkth X-Received: by 10.200.51.199 with SMTP id d7mr13724157qtb.67.1484934636085; Fri, 20 Jan 2017 09:50:36 -0800 (PST) Received: from [192.168.8.101] ([181.201.155.114]) by smtp.gmail.com with ESMTPSA id c41sm6467703qtd.3.2017.01.20.09.50.33 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 Jan 2017 09:50:35 -0800 (PST) From: John Bradley Message-Id: <2EC97DF3-04DB-4B6C-869F-F47A257501B6@ve7jtb.com> Content-Type: multipart/signed; boundary="Apple-Mail=_411E73D1-4DE5-4A61-9F44-0BE3461FDDD2"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Fri, 20 Jan 2017 14:50:31 -0300 In-Reply-To: To: Andrei Popov References: <8074E906-BC37-42BF-8DE3-C2C797D71577@ve7jtb.com> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: Tokbind WG , Brian Campbell , token-binding-team , Bill Cox Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 17:50:39 -0000 --Apple-Mail=_411E73D1-4DE5-4A61-9F44-0BE3461FDDD2 Content-Type: multipart/alternative; boundary="Apple-Mail=_604F5F4E-0FDE-482C-B5D4-C96E2BC231C9" --Apple-Mail=_604F5F4E-0FDE-482C-B5D4-C96E2BC231C9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Fast and Slow or just Fast? That explains the 700/s without channel-ID. Thanks John B. > On Jan 20, 2017, at 2:36 PM, Andrei Popov = wrote: >=20 > =C3=98 We should check if it is on in the Edge preview rings. I = think Andrei mentioned that was about to happen in Korea. > TB v0.10 is enabled by default in IE & Edge on the latest Windows 10 = insider preview build. > =20 > Cheers, > =20 > Andrei > =20 > From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of = Brian Campbell > Sent: Friday, January 20, 2017 7:23 AM > To: John Bradley > Cc: Tokbind WG ; token-binding-team = ; Bill Cox > Subject: Re: [Unbearable] Token binding version (0, 10) support is = global on google servers > =20 > chrome://flags/#enable-token-binding AFAIK is where one can flip the = flag > =20 > On Fri, Jan 20, 2017 at 6:45 AM, John Bradley > wrote: > Can you remind people in the WG what the flag is. > =20 > I think a test page is useful for PR. > =20 > The browserauth.net page run my Dirk should = be updated to point to it. > =20 > I know that there is a test in the Chromium source but having some = public page will encourage testing. > =20 > Thanks=20 > John B. > =20 > On Jan 20, 2017, at 10:35 AM, Bill Cox > wrote: > =20 > On Fri, Jan 20, 2017 at 5:01 AM, John Bradley > wrote: > Great news. >=20 > Is token binding not behind a feature flag for some of the newer = builds of Chrome? > =20 > It still is behind a feature flag. Nick Harper is doing a launch to = turn token binding on by default, IIUC. > =20 > We should check if it is on in the Edge preview rings. I think = Andrei mentioned that was about to happen in Korea. >=20 > Do you have any test page that would show if the cookies are = successfully token bound ? > =20 > I don't think we've built such a page yet. Would it be useful? > =20 > Bill > =20 >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable = --Apple-Mail=_604F5F4E-0FDE-482C-B5D4-C96E2BC231C9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Fast and Slow or just Fast?

That explains the 700/s without = channel-ID.

Thanks
John B.


On Jan 20, 2017, at 2:36 PM, = Andrei Popov <Andrei.Popov@microsoft.com> wrote:

=C3=98  We = should check if it is on in the Edge preview rings.   I think = Andrei mentioned that was about to happen in Korea.
TB v0.10 is enabled by default in IE & Edge = on the latest Windows 10 insider preview build.
 
Cheers,
 
Andrei
 
From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf = Of Brian = Campbell
Sent: Friday, January 20, 2017 = 7:23 AM
To: John Bradley <ve7jtb@ve7jtb.com>
Cc: Tokbind WG <unbearable@ietf.org>; token-binding-team <token-binding-team@google.com>; Bill Cox <waywardgeek@google.com>
Subject: Re: [Unbearable] Token = binding version (0, 10) support is global on google servers
 
chrome://flags/#enable-token-binding AFAIK is where one = can flip the flag
 
On Fri, Jan 20, 2017 = at 6:45 AM, John Bradley <ve7jtb@ve7jtb.com> wrote:
Can = you remind people in the WG what the flag is.
 
I think a test page is useful for PR.
 
The browserauth.net page run my Dirk should be = updated to point to it.
 
I know that there is a test in the Chromium source = but having some public page will encourage testing.
 
Thanks 
John B.
 
On Jan 20, 2017, at = 10:35 AM, Bill Cox <waywardgeek@google.com> wrote:
 
On = Fri, Jan 20, 2017 at 5:01 AM, John Bradley <ve7jtb@ve7jtb.com> = wrote:
Great = news.

Is token binding not behind a feature = flag for some of the newer builds of Chrome?
 
It still is behind a = feature flag.  Nick Harper is doing a launch to turn token binding = on by default, IIUC.
 
We = should check if it is on in the Edge preview rings.   I think = Andrei mentioned that was about to happen in Korea.

Do you have any test page that would show if the cookies are = successfully token bound ?
 
I don't think we've built such a page yet.  = Would it be useful?
 
Bill
 


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable


= --Apple-Mail=_604F5F4E-0FDE-482C-B5D4-C96E2BC231C9-- --Apple-Mail=_411E73D1-4DE5-4A61-9F44-0BE3461FDDD2 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILMTCCBUcw ggQvoAMCAQICEEAfBHP+tuqufC4R+F+Tu54wDQYJKoZIhvcNAQELBQAwdTELMAkGA1UEBhMCSUwx FjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAyIENsaWVudCBDQTAeFw0xNjA4MTIy MTE5NDFaFw0xODA4MTIyMTE5NDFaMIGCMQswCQYDVQQGEwJDTDEiMCAGA1UECAwZTWV0cm9wb2xp dGFuYSBkZSBTYW50aWFnbzEWMBQGA1UEBwwNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAwwMSm9obiBC cmFkbGV5MSAwHgYJKoZIhvcNAQkBFhF2ZTdqdGJAdmU3anRiLmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBALhTcSiDGvVrm4hlJA8WyFcWWe0dqnuJzstQYTaF281JFOEPA/13kQYI JMXAEUcS7NvW7KdUI0tHU0N6RTo0Ilf1E1nm8No++eqHO8pFUZ/cidpv0r+1Qcl9EgrpbZ00Y7Xg pq06EZELzJAmds4QQcsTKdpLNFbVcFnM11i2Gj5VNsYgO+qPO2AS8rLHkgDWnNkc9/lA+ZK5wGiU zxPU9KnIrERoTif3Zk7KjLvFpBWYD60M/lNoHZ5zxYgmYLmvoM1TSLn4Ms57wwT5MieV2l0aqlGC 7CKNa6XyeL1B0y0wSxL3PJQS4vSLDnttZC7od2A6yjeUMyM3rQ41vqUIMc8CAwEAAaOCAcMwggG/ MA4GA1UdDwEB/wQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwCQYDVR0TBAIw ADAdBgNVHQ4EFgQUmA9bUmBmTYkCcZ3yYv8IRRP2nN4wHwYDVR0jBBgwFoAUmZerGDU6i1lFQ5iy cnHI9PsJzxYwbwYIKwYBBQUHAQEEYzBhMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNz bC5jb20wOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3NjYS5jbGll bnQyLmNydDA4BgNVHR8EMTAvMC2gK6AphidodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zY2EtY2xp ZW50Mi5jcmwwHAYDVR0RBBUwE4ERdmU3anRiQHZlN2p0Yi5jb20wIwYDVR0SBBwwGoYYaHR0cDov L3d3dy5zdGFydHNzbC5jb20vMFUGA1UdIAROMEwwDAYKKwYBBAGBtTcGATA8BgsrBgEEAYG1NwEC BTAtMCsGCCsGAQUFBwIBFh9odHRwczovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4IBAQBqcYJfFA/ITkX4L6JihqW168Wog1BOfkbPXO+wPn5G9P1NwruGfu41b70EPPwV vol+/j+qhSSrDjFyfNBsq4G45GRR6hwx0ei/bH0UW15Y63ASYPkNlj3ydCcvhw5ItWD5aYPphBx9 C7tLnQ7ow09cqt2CIgPd3W/IGri7p4hWPbdcX0oFIhJcDxmCwTcWyoVoIo4aas5gP44LPGneCoqI lXQMJinwneEnKd7rWXlzVWv7geaH3t79zARSw9ev9F4E61cDuHi+vgTFEpio7oxybqfj99yLibhX uZjReYnYbDMRiWDXduVIrIGYwmnUuD8a0b20kJgHm+FEgB6UMa9JMIIF4jCCA8qgAwIBAgIQXLZI bkcMmMZ/9oDbZErijTANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3Rh cnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEp MCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTUxMjE2MDEwMDA1 WhcNMzAxMjE2MDEwMDA1WjB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDIgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7g9Q jJUJI4Ss9VBqj9Y3ok4h/TIJZUc+rzj61Rv3hNB/yeEEC1fz3i/EU+MXOOGxM7KCbtCIcJxHIW/k 8RP6sPPMO4cTg7sNzfBWsYsemtY6fN/kVr2R2X+/PjvtxmAaXpGX0znvQPxaE123IMGXy0zEKHZ/ nJDZ199TP9TNn9v+1QO0AZb4oaJ7ch0DpSJa8kF5xiNFDAg9taKKSrVuPHJL9MFFYPIqwShjHg+u YEzjfxbMP2QWwamnaA9Y7fORSDNapduFlARAcDtXdMpAijiG4HKnrN323I0Ka7lDTAWyLtTDCETK sI8fzOyL0inEu1WEVpdPytm8s1rwQB4f9QIDAQABo4IBZDCCAWAwDgYDVR0PAQH/BAQDAgEGMB0G A1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQr MCkwJ6AloCOGIWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDBmBggrBgEFBQcBAQRa MFgwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTAwBggrBgEFBQcwAoYkaHR0 cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvY2EuY3J0MB0GA1UdDgQWBBSZl6sYNTqLWUVDmLJy ccj0+wnPFjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jA/BgNVHSAEODA2MDQGBFUd IAAwLDAqBggrBgEFBQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4ICAQCZQUEEzvYk9U4wNHhDu1f9QGwbzAH4m4wIKH8ZidNYwZhyoNKW041iJ002KMW9 ywYM95n4770tT45yH29vTMlZtBvz0h44KuxMLNXRCTDwvV07sT39nPjFi5MpwZaLVueNiaa1vok1 n2Wn8lLcyCltYZNGAEifM0ko/A/vvckftFIZG75RAiZHYtfnrdBGiOxyF+nHI9a33BRX5Vl/3z0+ uHZ/Y6YPbNJ7iboOFrFZBCtt+lp3WaDB62ZoBewiMmd09JrqmMJAEgw3EbfQNtaPzHPg/EOhlZik Rgd4BCrzrbIqB2RKib+gnQJt2uoJaKOaV90S9Xgs3PC837OE9CEmY6/MTTG0xpbLh2hR/rLQ3sCr H56aODeuDrQBq85lXxRbDCERDUR7FZUhHv+i1aQaY59NPu26hDd6nqksSDq2mCddpidPBuGJz9lN X2nRyGkudDuWV6gIr6AZfaYv+ggTXOcCDJZFzMhWdLC7CPvRKxQ7vTiYV+4lgqOvV9MnZc149PPt itTysq/oOv70zx7q+tyaLTa4cqFhCclhIwSwOEJiV3xqQebvmwsDX7BaXGAJZIhbdUbNr3poEgct 6uAxw2zyr69WCJmTUUhz/k1/TT/eCUZJqnMg/6mje7tiVdaUQJcBtJ6cq5+mUDNUB1fohW8EOFai zFpP/0FaP62ctTGCA04wggNKAgEBMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UE AxMaU3RhcnRDb20gQ2xhc3MgMiBDbGllbnQgQ0ECEEAfBHP+tuqufC4R+F+Tu54wCQYFKw4DAhoF AKCCAZkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwMTIwMTc1 MDMyWjAjBgkqhkiG9w0BCQQxFgQUaN0Q/uhaDx58TvdEP7GcrEdBNjcwgZoGCSsGAQQBgjcQBDGB jDCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3Rh cnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIg Q2xpZW50IENBAhBAHwRz/rbqrnwuEfhfk7ueMIGcBgsqhkiG9w0BCRACCzGBjKCBiTB1MQswCQYD VQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIgQ2xpZW50IENBAhBA HwRz/rbqrnwuEfhfk7ueMA0GCSqGSIb3DQEBAQUABIIBAA6eHL1NeqzzuKEj1f3NoT8B0TGZHf1p TE1s6oJ+Wzz73LW10OLQ2GERzU7Ql1F1H9AzJ3hvqcpKlpDfDaj7PluOdV+XD+s7B7Rd95kV0i1d +Oo4zwVzPEUCH+K4K9cNKmVtMhPTvKE/8Ohwr8Hnwc2Qb1J6hFK93JLrU4pVaLfQo873W/IDySaz BPLMcpPduscWJYerZ1sdz2RgOpuE10D1XGozIhfvQpQPM0u7tMRASmvyg9vFiIUAdqvuKCFz5LUc g09JoN2II5rrzExgM1VEZD7oxoUf/WJaVWrSz8e3yCyKMx6KVEDtdq+fd76mcvC1cDK+ON364Mgj 4aSO87cAAAAAAAA= --Apple-Mail=_411E73D1-4DE5-4A61-9F44-0BE3461FDDD2-- From nobody Fri Jan 20 10:02:22 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C69D1296F4 for ; Fri, 20 Jan 2017 10:02:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.899 X-Spam-Level: X-Spam-Status: No, score=-5.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WEgYsBOyPDRS for ; Fri, 20 Jan 2017 10:02:18 -0800 (PST) Received: from mail-it0-x233.google.com (mail-it0-x233.google.com [IPv6:2607:f8b0:4001:c0b::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03314129536 for ; Fri, 20 Jan 2017 10:02:17 -0800 (PST) Received: by mail-it0-x233.google.com with SMTP id 203so25318658ith.0 for ; Fri, 20 Jan 2017 10:02:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=4mjxvz0VYFdZ7XrYGHimgPqi2+12Dnr8ctD5kiccvjE=; b=ISr53nlte+HLwWOTZAAFMmCkT0fB1GxRldwQ3+P80V01ji2fdR6ujixFYTod0vgQg6 sp41py8F9dH2wjz5cy5Z8RjmrB2OuCsiwkfRXsVmtY73UNcgx7jli/oxAMRvXKxsRV7f ANTiL08+HDPNIsJpN7wakLyENObsdHn9a76LOXjeVb4zSD33AXeokrZcMw4UDrbVTztL P6l+WIIrcC+1Eh5fL/kfq0d4Pgv8V0ICYodm4FaRFh4KccS3pvUyjiGQbHXiHrmJAgja pCH2WsEJZx0rxYIk21wceGerNNb3E9LDyYRzLpzyBbixGoJ7HDtqW68MCiX9ow7pabYc TvkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=4mjxvz0VYFdZ7XrYGHimgPqi2+12Dnr8ctD5kiccvjE=; b=afO9hJRsEoCfa+Us4ytygrw9AqkGoEWHNbzhxrbOeUeUckq2V8RfjS1DLpYIuebzik ik6w4EMsckyyJ2CmbbO0oftlNG1r7/Q/gR417EuJdiji7kHqF0CbfWwDWuaalVLlMfTF +kLD1BUvwliBs1hG18ju545Y74Ax1gzfbEAATFB5HsjOJJVLerG7GD8DfVDr30VH85XY UqybQGoh8wIybyTQWelEe6EMrXf1uZ3zUxdGlOfMhHkaHBP5uQhk3YRoxfpiOXcGIgLC C6D5/ydcRcy44tG7mhSwGjAb0yfjExgx01WCnALJx7maciOGncQxz7HBmWy8gI3Fkeo9 UyGg== X-Gm-Message-State: AIkVDXKPHr2pHpRYM5gnDKOmyaRosRxPZD/+E+YorFQbfWlzQwqomzrlRQwP0iQ37eW+Vm31SZIK12jU4c0Y7q4h X-Received: by 10.36.130.66 with SMTP id t63mr4840193itd.90.1484935337021; Fri, 20 Jan 2017 10:02:17 -0800 (PST) MIME-Version: 1.0 Received: by 10.64.24.204 with HTTP; Fri, 20 Jan 2017 10:02:16 -0800 (PST) In-Reply-To: References: From: Vinod Anupam Date: Fri, 20 Jan 2017 10:02:16 -0800 Message-ID: To: Bill Cox Content-Type: multipart/alternative; boundary=94eb2c088ee247aeba05468a73ef Archived-At: Cc: Tokbind WG , token-binding-team Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 18:02:20 -0000 --94eb2c088ee247aeba05468a73ef Content-Type: text/plain; charset=UTF-8 On Fri, Jan 20, 2017 at 4:29 AM, Bill Cox wrote: > I'm seeing 5.7K token binding headers per second at the moment, about 5K/s > sending both channel-ID and token binding (probably chrome), and about > 700/s with just token binding (probably not chrome). > Based on information in our logs, the requests with just token binding headers are primarily from Edge. cheers, -Anupam > Bill > > -- > You received this message because you are subscribed to the Google Groups > "token-binding-team" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to token-binding-team+unsubscribe@google.com. > To post to this group, send email to token-binding-team@google.com. > To view this discussion on the web visit https://groups.google.com/a/ > google.com/d/msgid/token-binding-team/CAH9QtQHiMNKTWkExDduH%3DhuCzs% > 3DyVW%2BE7YM3Wnoh0DoeYUe08A%40mail.gmail.com > > . > --94eb2c088ee247aeba05468a73ef Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Jan 20, 2017 at 4:29 AM, Bill Cox <waywardgeek@google.com= > wrote:
I'm seeing 5.7K token binding headers per second at t= he moment, about 5K/s sending both channel-ID and token binding (probably c= hrome), and about 700/s with just token binding (probably not chrome).

Based on information in our logs, the req= uests with just token binding headers are primarily from Edge.
cheers,
-Anupam


Bill

--
You received this message because you are subscribed to the Google Groups &= quot;token-binding-team" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to token-binding-team+unsubscribe@google.com.
To post to this group, send email to token-binding-team@google.com.
To view this discussion on the web visit https://groups.google.com/a/google.com/d= /msgid/token-binding-team/CAH9QtQHiMNKTWkExDduH%3DhuCzs%3DyV= W%2BE7YM3Wnoh0DoeYUe08A%40mail.gmail.com.

--94eb2c088ee247aeba05468a73ef-- From nobody Fri Jan 20 10:11:15 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FD5812942F for ; Fri, 20 Jan 2017 10:11:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yGNGF5pXmTkb for ; Fri, 20 Jan 2017 10:11:11 -0800 (PST) Received: from mail-yb0-x22c.google.com (mail-yb0-x22c.google.com [IPv6:2607:f8b0:4002:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F84E129466 for ; Fri, 20 Jan 2017 10:11:11 -0800 (PST) Received: by mail-yb0-x22c.google.com with SMTP id w194so64880758ybe.0 for ; Fri, 20 Jan 2017 10:11:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=MQ9qaQJ3ZprXoMoPXojfbl15y2NYvRNY05hSr0HDDEs=; b=yfOZCPtHzOAoOsyjEQ3CjYk83edHCPcteEYuRkPRA8nit01dwZmVRHKqHbnW60hmsh 68xOmECmSFP08kbO64G8STQB7GNenQ5HxEzmUj+w4+kFbrktTgW6J3oIWabEU1DSksRe UTQfUDStMzDevRZDUzU8GOQroK1yNk07a6SIIQHTkgsLDhSdooUS5jrF8HYNW5gfVsTw vB47eJNNs5bK43D7lsszdRlCXGnSWHQhbnOtMUW0Beqsw8jHSqAIkGEsVPjV4hMcSsXP LiY6KkEfkClmBuerK2qCnC0N0WM2qpFaVI09oGkLWi08BdSLbfLctzSljXcAk6DwkkZo /PbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=MQ9qaQJ3ZprXoMoPXojfbl15y2NYvRNY05hSr0HDDEs=; b=QXnddRAbsHwdPOYhavCV9Mz+X9twxiFrHJRLJbjy6pYDj8spypVWJr6vuySOGVb1bN pshk6CTYUjFMpisfkNLuTlCg0yxVJWZeri0Hdgp4m17nTX5A2OUpjlHKYDnTHfgNq4S/ vf8cYJWn9+hYz+fJJJ7iv6A31r7PHoOaNn114fQeqBT3RemDETPTg1rg9KKyHlTjZz44 2LPiUOnaxzq6RpabWyur8LdWUbCDtEqp1fyqUKUvqpeEa1afPHnzVP6Ud7gH0y2YKz/D m9aLGByLQ82HLrBwUkHgdYOJ8IljBxL0PerIMyhoIm3fb7VIZVo9aSwdkW6VjB0zOyrK GCPQ== X-Gm-Message-State: AIkVDXIriWIXt8pxwJzLTeSHsf7egVJx+uZC7PRJ9gb3sgizaJ3zNIDCW1OJlvqVlb1vOONd X-Received: by 10.200.53.71 with SMTP id z7mr13199862qtb.203.1484935870797; Fri, 20 Jan 2017 10:11:10 -0800 (PST) Received: from [192.168.8.101] ([181.201.155.114]) by smtp.gmail.com with ESMTPSA id j129sm5673291qkd.47.2017.01.20.10.11.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 Jan 2017 10:11:10 -0800 (PST) From: John Bradley Message-Id: <8DDAAF0F-DB81-44E4-AC77-D2AC03E8496A@ve7jtb.com> Content-Type: multipart/signed; boundary="Apple-Mail=_221BAF76-D826-4702-8153-BCAA735948D3"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Fri, 20 Jan 2017 15:11:06 -0300 In-Reply-To: To: Vinod Anupam References: X-Mailer: Apple Mail (2.3259) Archived-At: Cc: Tokbind WG , token-binding-team , Bill Cox Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 18:11:13 -0000 --Apple-Mail=_221BAF76-D826-4702-8153-BCAA735948D3 Content-Type: multipart/alternative; boundary="Apple-Mail=_08D211AA-C09E-428E-83C2-8636AC56EFCB" --Apple-Mail=_08D211AA-C09E-428E-83C2-8636AC56EFCB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii That is good news assuming everything is working.=20 You now have support in IE and Edge in the latest Windows 10 preview. John B. > On Jan 20, 2017, at 3:02 PM, Vinod Anupam wrote: >=20 >=20 >=20 > On Fri, Jan 20, 2017 at 4:29 AM, Bill Cox > wrote: > I'm seeing 5.7K token binding headers per second at the moment, about = 5K/s sending both channel-ID and token binding (probably chrome), and = about 700/s with just token binding (probably not chrome). >=20 > Based on information in our logs, the requests with just token binding = headers are primarily from Edge. >=20 > cheers, > -Anupam >=20 >=20 > Bill >=20 > --=20 > You received this message because you are subscribed to the Google = Groups "token-binding-team" group. > To unsubscribe from this group and stop receiving emails from it, send = an email to token-binding-team+unsubscribe@google.com = . > To post to this group, send email to token-binding-team@google.com = . > To view this discussion on the web visit = https://groups.google.com/a/google.com/d/msgid/token-binding-team/CAH9QtQH= iMNKTWkExDduH%3DhuCzs%3DyVW%2BE7YM3Wnoh0DoeYUe08A%40mail.gmail.com = . >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail=_08D211AA-C09E-428E-83C2-8636AC56EFCB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii That is good news assuming everything is working. 

You now have support in = IE and Edge in the latest Windows 10 preview.

John B.
On Jan 20, 2017, at 3:02 PM, = Vinod Anupam <vanupam@google.com> wrote:



On Fri, Jan 20, 2017 at 4:29 AM, Bill Cox <waywardgeek@google.com> = wrote:
I'm = seeing 5.7K token binding headers per second at the moment, about 5K/s = sending both channel-ID and token binding (probably chrome), and about = 700/s with just token binding (probably not = chrome).

Based on information in our logs, the requests with just = token binding headers are primarily from Edge.

cheers,
-Anupam


Bill

--
You received this message because you are subscribed to the Google = Groups "token-binding-team" group.
To unsubscribe from this group and stop receiving emails from it, send = an email to token-binding-team+unsubscribe@google.com.
To post to this group, send email to token-binding-team@google.com.
To view this discussion on the web visit https://groups.google.com/a/google.com/d/msgid/token-binding-team/CAH9QtQHiMNKTWkExDduH%3DhuCzs%3DyVW%2BE7YM3Wnoh0DoeYUe08A%40mail.gmail.com.

_______________________________________________
Unbearable = mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

= --Apple-Mail=_08D211AA-C09E-428E-83C2-8636AC56EFCB-- --Apple-Mail=_221BAF76-D826-4702-8153-BCAA735948D3 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILMTCCBUcw ggQvoAMCAQICEEAfBHP+tuqufC4R+F+Tu54wDQYJKoZIhvcNAQELBQAwdTELMAkGA1UEBhMCSUwx FjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAyIENsaWVudCBDQTAeFw0xNjA4MTIy MTE5NDFaFw0xODA4MTIyMTE5NDFaMIGCMQswCQYDVQQGEwJDTDEiMCAGA1UECAwZTWV0cm9wb2xp dGFuYSBkZSBTYW50aWFnbzEWMBQGA1UEBwwNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAwwMSm9obiBC cmFkbGV5MSAwHgYJKoZIhvcNAQkBFhF2ZTdqdGJAdmU3anRiLmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBALhTcSiDGvVrm4hlJA8WyFcWWe0dqnuJzstQYTaF281JFOEPA/13kQYI JMXAEUcS7NvW7KdUI0tHU0N6RTo0Ilf1E1nm8No++eqHO8pFUZ/cidpv0r+1Qcl9EgrpbZ00Y7Xg pq06EZELzJAmds4QQcsTKdpLNFbVcFnM11i2Gj5VNsYgO+qPO2AS8rLHkgDWnNkc9/lA+ZK5wGiU zxPU9KnIrERoTif3Zk7KjLvFpBWYD60M/lNoHZ5zxYgmYLmvoM1TSLn4Ms57wwT5MieV2l0aqlGC 7CKNa6XyeL1B0y0wSxL3PJQS4vSLDnttZC7od2A6yjeUMyM3rQ41vqUIMc8CAwEAAaOCAcMwggG/ MA4GA1UdDwEB/wQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwCQYDVR0TBAIw ADAdBgNVHQ4EFgQUmA9bUmBmTYkCcZ3yYv8IRRP2nN4wHwYDVR0jBBgwFoAUmZerGDU6i1lFQ5iy cnHI9PsJzxYwbwYIKwYBBQUHAQEEYzBhMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNz bC5jb20wOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3NjYS5jbGll bnQyLmNydDA4BgNVHR8EMTAvMC2gK6AphidodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zY2EtY2xp ZW50Mi5jcmwwHAYDVR0RBBUwE4ERdmU3anRiQHZlN2p0Yi5jb20wIwYDVR0SBBwwGoYYaHR0cDov L3d3dy5zdGFydHNzbC5jb20vMFUGA1UdIAROMEwwDAYKKwYBBAGBtTcGATA8BgsrBgEEAYG1NwEC BTAtMCsGCCsGAQUFBwIBFh9odHRwczovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4IBAQBqcYJfFA/ITkX4L6JihqW168Wog1BOfkbPXO+wPn5G9P1NwruGfu41b70EPPwV vol+/j+qhSSrDjFyfNBsq4G45GRR6hwx0ei/bH0UW15Y63ASYPkNlj3ydCcvhw5ItWD5aYPphBx9 C7tLnQ7ow09cqt2CIgPd3W/IGri7p4hWPbdcX0oFIhJcDxmCwTcWyoVoIo4aas5gP44LPGneCoqI lXQMJinwneEnKd7rWXlzVWv7geaH3t79zARSw9ev9F4E61cDuHi+vgTFEpio7oxybqfj99yLibhX uZjReYnYbDMRiWDXduVIrIGYwmnUuD8a0b20kJgHm+FEgB6UMa9JMIIF4jCCA8qgAwIBAgIQXLZI bkcMmMZ/9oDbZErijTANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3Rh cnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEp MCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTUxMjE2MDEwMDA1 WhcNMzAxMjE2MDEwMDA1WjB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDIgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7g9Q jJUJI4Ss9VBqj9Y3ok4h/TIJZUc+rzj61Rv3hNB/yeEEC1fz3i/EU+MXOOGxM7KCbtCIcJxHIW/k 8RP6sPPMO4cTg7sNzfBWsYsemtY6fN/kVr2R2X+/PjvtxmAaXpGX0znvQPxaE123IMGXy0zEKHZ/ nJDZ199TP9TNn9v+1QO0AZb4oaJ7ch0DpSJa8kF5xiNFDAg9taKKSrVuPHJL9MFFYPIqwShjHg+u YEzjfxbMP2QWwamnaA9Y7fORSDNapduFlARAcDtXdMpAijiG4HKnrN323I0Ka7lDTAWyLtTDCETK sI8fzOyL0inEu1WEVpdPytm8s1rwQB4f9QIDAQABo4IBZDCCAWAwDgYDVR0PAQH/BAQDAgEGMB0G A1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQr MCkwJ6AloCOGIWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDBmBggrBgEFBQcBAQRa MFgwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTAwBggrBgEFBQcwAoYkaHR0 cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvY2EuY3J0MB0GA1UdDgQWBBSZl6sYNTqLWUVDmLJy ccj0+wnPFjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jA/BgNVHSAEODA2MDQGBFUd IAAwLDAqBggrBgEFBQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4ICAQCZQUEEzvYk9U4wNHhDu1f9QGwbzAH4m4wIKH8ZidNYwZhyoNKW041iJ002KMW9 ywYM95n4770tT45yH29vTMlZtBvz0h44KuxMLNXRCTDwvV07sT39nPjFi5MpwZaLVueNiaa1vok1 n2Wn8lLcyCltYZNGAEifM0ko/A/vvckftFIZG75RAiZHYtfnrdBGiOxyF+nHI9a33BRX5Vl/3z0+ uHZ/Y6YPbNJ7iboOFrFZBCtt+lp3WaDB62ZoBewiMmd09JrqmMJAEgw3EbfQNtaPzHPg/EOhlZik Rgd4BCrzrbIqB2RKib+gnQJt2uoJaKOaV90S9Xgs3PC837OE9CEmY6/MTTG0xpbLh2hR/rLQ3sCr H56aODeuDrQBq85lXxRbDCERDUR7FZUhHv+i1aQaY59NPu26hDd6nqksSDq2mCddpidPBuGJz9lN X2nRyGkudDuWV6gIr6AZfaYv+ggTXOcCDJZFzMhWdLC7CPvRKxQ7vTiYV+4lgqOvV9MnZc149PPt itTysq/oOv70zx7q+tyaLTa4cqFhCclhIwSwOEJiV3xqQebvmwsDX7BaXGAJZIhbdUbNr3poEgct 6uAxw2zyr69WCJmTUUhz/k1/TT/eCUZJqnMg/6mje7tiVdaUQJcBtJ6cq5+mUDNUB1fohW8EOFai zFpP/0FaP62ctTGCA04wggNKAgEBMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UE AxMaU3RhcnRDb20gQ2xhc3MgMiBDbGllbnQgQ0ECEEAfBHP+tuqufC4R+F+Tu54wCQYFKw4DAhoF AKCCAZkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwMTIwMTgx MTA3WjAjBgkqhkiG9w0BCQQxFgQUu/Ywe+ifnbOxFD8zU8/b8yuo/jIwgZoGCSsGAQQBgjcQBDGB jDCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3Rh cnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIg Q2xpZW50IENBAhBAHwRz/rbqrnwuEfhfk7ueMIGcBgsqhkiG9w0BCRACCzGBjKCBiTB1MQswCQYD VQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIgQ2xpZW50IENBAhBA HwRz/rbqrnwuEfhfk7ueMA0GCSqGSIb3DQEBAQUABIIBAAfdJyd47kysSq/t4wo7bqQN67aF/RmW RbzORnNWc3USEHNICMChJvTtTSAx1pv1GxzZdDpa0WFcHfXk7VFI0mwAxLE0puHZWaJi6UjHN5+V r5s1X1rVN152O5GR7keoowN2CPIJMbYdLzM8lBowkYm7EB54zarxQXXOzoNx8bCj7RQsMMQnAK30 lCreB+LBy+/PWXheYikvtpqMQSpSqn6PM6xgy5hgTpFTTwarFVDD8UVMvPaJWAAGIfMyR8TFe3yc h/nk5U4Pcl+Ak6Kpc9Cq0jtJopSji7q4G1KVEGZ0vx+J/qWGjxnOUK+k3tZdiZPRC0TUrx8AhMYa hRhGXZEAAAAAAAA= --Apple-Mail=_221BAF76-D826-4702-8153-BCAA735948D3-- From nobody Fri Jan 20 10:15:28 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B4961299BD for ; Fri, 20 Jan 2017 10:15:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.199 X-Spam-Level: X-Spam-Status: No, score=-5.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pQESz_fWUxyW for ; Fri, 20 Jan 2017 10:15:24 -0800 (PST) Received: from mail-yb0-x230.google.com (mail-yb0-x230.google.com [IPv6:2607:f8b0:4002:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B0481295F0 for ; Fri, 20 Jan 2017 10:15:24 -0800 (PST) Received: by mail-yb0-x230.google.com with SMTP id 123so64714952ybe.3 for ; Fri, 20 Jan 2017 10:15:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=zYwCEMbbqgKHgdLzqvOHyLLWFGxRbf2b9yEFHwAAjQk=; b=ckfx9aB/Rl7hnqP+Nof+8NowXV4QYtt9FmuM+xyQ/6aEbORfCtuh5dWxquXGR7N9ag opN/H64eEzNIXlv46wRVhO1fKYZhdOoGSXO1Oc3g4tbCspl/+NQArdwqK9z01a3RvVpR VGg6UOAGq+8HevsjdD2iFjV5doLvxZQw1ViMuNLRjoKozHmpTr85r6ppoRdHelIrcWpG cZE6k1WDxR43XnZ0ssslBG/0I63EzaFDreBRmVlMJR0OX9UXZJWaWXMiC+IwD+lz/9XU joAWpOO8m8epZW4zNFhPl1MD+bzO9GTjsZaNhHD8o2PfLmIbHj1gwiRwpPuoNf+KTQiC 6iOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=zYwCEMbbqgKHgdLzqvOHyLLWFGxRbf2b9yEFHwAAjQk=; b=OA2t2NO3c60P9C8c0b6bOU3MMkvH0rCkTfiPpEZU95quX+W8sEaxbGcXpTF4/3+JtE habmOKReEeed2IftgkE5QeCP/ZcywbZ5BhhHEAF+57NZplFylTBsugIcJlTjyx2LBVZi sN+HFR4eFZj42EN3+sAx7nvoMZcF+QBCRqKgEP7Ngss9AhRcwvApceTWn/fBxTw5MA2m 6Hhsns9ccZ37Uu9UlgQdTSTiCj6O0ThWWWEwXPEqoXfhCuGtaXvd9gIksfN47PEh//lt EEwd2ljZBdn/DPOVln1SwUBiDipnSpcOpciM9yhXDLknD2r/kyDJM7Wy6OTYDPylMyjA GrpA== X-Gm-Message-State: AIkVDXJIYYpGEeKAi6ErKF9nhF1VoRYxEtab5DFGG8RKN5deQX7rpdPDz3mYLUupvWc8nEH2W54m/Xf0r3fp5W0Z X-Received: by 10.37.42.80 with SMTP id q77mr11619844ybq.102.1484936123758; Fri, 20 Jan 2017 10:15:23 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.161.87 with HTTP; Fri, 20 Jan 2017 10:15:01 -0800 (PST) In-Reply-To: References: <8074E906-BC37-42BF-8DE3-C2C797D71577@ve7jtb.com> From: Nick Harper Date: Fri, 20 Jan 2017 10:15:01 -0800 Message-ID: To: Brian Campbell Content-Type: multipart/alternative; boundary=001a1144047e2c2abd05468aa2e1 Archived-At: Cc: John Bradley , Tokbind WG , token-binding-team , Bill Cox Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 18:15:26 -0000 --001a1144047e2c2abd05468aa2e1 Content-Type: text/plain; charset=UTF-8 Yes, that's the correct place to flip the flag to enable Token Binding in Chrome. On Fri, Jan 20, 2017 at 7:22 AM, Brian Campbell wrote: > chrome://flags/#enable-token-binding AFAIK is where one can flip the flag > > On Fri, Jan 20, 2017 at 6:45 AM, John Bradley wrote: > >> Can you remind people in the WG what the flag is. >> >> I think a test page is useful for PR. >> >> The browserauth.net page run my Dirk should be updated to point to it. >> >> I know that there is a test in the Chromium source but having some public >> page will encourage testing. >> >> Thanks >> John B. >> >> On Jan 20, 2017, at 10:35 AM, Bill Cox wrote: >> >> On Fri, Jan 20, 2017 at 5:01 AM, John Bradley wrote: >> >>> Great news. >>> >>> Is token binding not behind a feature flag for some of the newer builds >>> of Chrome? >>> >> >> It still is behind a feature flag. Nick Harper is doing a launch to turn >> token binding on by default, IIUC. >> >> >>> We should check if it is on in the Edge preview rings. I think Andrei >>> mentioned that was about to happen in Korea. >>> >>> Do you have any test page that would show if the cookies are >>> successfully token bound ? >>> >> >> I don't think we've built such a page yet. Would it be useful? >> >> Bill >> >> >> >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable >> >> > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --001a1144047e2c2abd05468aa2e1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Yes, that's the correct place to flip the flag to enab= le Token Binding in Chrome.

On Fri, Jan 20, 2017 at 7:22 AM, Brian Campbell <bcampbell@pingidentity.com> wrote:
chrome://flags/#enable-token-binding AFAIK = is where one can flip the flag

On Fri, Jan 20, 2017 at 6:45= AM, John Bradley <ve7jtb@ve7jtb.com> wrote:
=
Can you remind people in the WG what the flag is.

I think a test page is useful for PR.

The= browserauth.net p= age run my Dirk should be updated to point to it.

= I know that there is a test in the Chromium source but having some public p= age will encourage testing.

Thanks=C2=A0
John B.

On Jan 20, 2017, at 10:35 AM, Bill Cox <waywardgeek@google= .com> wrote:

On Fri, Jan 20, 2017 at 5:01 AM, John Bra= dley <ve7jtb@ve7jtb.com> wrote:
Great news.

Is token binding not behind a feature flag for some of the newer builds of = Chrome?

It still is behind a feature fl= ag.=C2=A0 Nick Harper is doing a launch to turn token binding on by default= , IIUC.
=C2=A0
We should check if it is on in the Edge preview rings.=C2=A0 =C2=A0I think = Andrei mentioned that was about to happen in Korea.

Do you have any test page that would show if the cookies are successfully t= oken bound ?

I don't think we'v= e built such a page yet.=C2=A0 Would it be useful?

Bill


_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearabl= e



_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e


--001a1144047e2c2abd05468aa2e1-- From nobody Fri Jan 20 10:19:20 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75C251295C0 for ; Fri, 20 Jan 2017 10:19:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.157 X-Spam-Level: X-Spam-Status: No, score=-3.157 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.156, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B0gfjciLoDoM for ; Fri, 20 Jan 2017 10:19:16 -0800 (PST) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0094.outbound.protection.outlook.com [104.47.32.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D559127076 for ; Fri, 20 Jan 2017 10:19:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=llYsR0t7zfiYML2iJSerPD+R1J8rYrvjMrTSLJ/7RCM=; b=e1kUjpAJlGIsVN96WT0GFlMDENG+Go4Uz0+kQc2hprfhemutl2RdmWam7Z4AoqKTKZ8EmHKnsVz2llRr7UBuSaI7YzbIQvfx4O171qzgMTq4vpAqzYT0DGN3E5moJr5/Ip7GpWP2yCV/eSDT374j9Rb+3SteAYUoNZ52Js9diM4= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0843.namprd03.prod.outlook.com (10.160.163.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.845.12; Fri, 20 Jan 2017 18:19:11 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0845.021; Fri, 20 Jan 2017 18:19:11 +0000 From: Andrei Popov To: John Bradley , Vinod Anupam Thread-Topic: [Unbearable] Token binding version (0, 10) support is global on google servers Thread-Index: AQHSc0ifoBYoNkTIW0+5V5Zznh9nSKFBrEfA Date: Fri, 20 Jan 2017 18:19:11 +0000 Message-ID: References: <8DDAAF0F-DB81-44E4-AC77-D2AC03E8496A@ve7jtb.com> In-Reply-To: <8DDAAF0F-DB81-44E4-AC77-D2AC03E8496A@ve7jtb.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:a::1d2] x-ms-office365-filtering-correlation-id: 3c26683c-2f09-4c76-41b7-08d44160d52a x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0843; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0843; 7:2kIrvR/L4xA54bxtRj8Dg4P8+TiKaDdzQJD3X2nCEE1Lm9ELd7xnlj3bxj5aGmC7dmTD6epQvcZZo/TuQSyjEkOQI1P1+xV7Xv8h6XRWlSAaMLXuDyJ63fq+4aCWz6Ekrud96cwHrpl55bzVdIKy3hxER5zyq7wPVp2aarIT4WhSK3L7WFftXmAMtRDFaJyqh3qhcaRvkei503V1GfwRVTsKE0gI9N7Q/p3VSI7H6zrjfTGjVpBvnk43A9rRwXT0NNXnrnotu15eYE4igKXTrYTQkUG/TS20C2GvdPEPVGTRe5kFbt+q6okz9SmRyKDuvQ3yZunyZCp49+/wOeXK+5BKx9QTvK9kltPd+k3ZLP90SNHnhQprfzNXJu+xdVos+5c10E56TaGztYphNgL9uUoTuQLArX1IBp4d1YuOM0to0MmTXxma5mDhZQ21XoqRBSdT2zk6IvJ1xDYfDZXoMCHgTGhLklDKpH7uBsn6EZo= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(20558992708506)(228788266533470)(211936372134217)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123562025)(20161123560025)(20161123555025)(6072148)(6047074); SRVR:CY1PR0301MB0843; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0843; x-forefront-prvs: 01930B2BA8 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39410400002)(39850400002)(39450400003)(39840400002)(39860400002)(189002)(199003)(377454003)(24454002)(6306002)(6506006)(54906002)(53936002)(54896002)(8990500004)(105586002)(189998001)(25786008)(99286003)(55016002)(5660300001)(68736007)(77096006)(8936002)(606005)(6436002)(9686003)(236005)(76176999)(5005710100001)(6116002)(106356001)(229853002)(122556002)(101416001)(38730400001)(7696004)(50986999)(54356999)(2950100002)(3660700001)(10290500002)(102836003)(790700001)(106116001)(10090500001)(2900100001)(86612001)(3280700002)(92566002)(8676002)(33656002)(2906002)(97736004)(575784001)(4326007)(86362001)(5001770100001)(7906003)(81156014)(74316002)(7736002)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0843; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB08422994A1E2EE2210F584328C710CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jan 2017 18:19:11.3502 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0843 Archived-At: Cc: Tokbind WG , token-binding-team , Bill Cox Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 18:19:19 -0000 --_000_CY1PR0301MB08422994A1E2EE2210F584328C710CY1PR0301MB0842_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable ? That is good news assuming everything is working. We have reports of some interop failures; they're under investigation. ? Fast and Slow or just Fast? Fast for sure; I'm not certain about Slow. From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of John Bra= dley Sent: Friday, January 20, 2017 10:11 AM To: Vinod Anupam Cc: Tokbind WG ; token-binding-team ; Bill Cox Subject: Re: [Unbearable] Token binding version (0, 10) support is global o= n google servers That is good news assuming everything is working. You now have support in IE and Edge in the latest Windows 10 preview. John B. On Jan 20, 2017, at 3:02 PM, Vinod Anupam > wrote: On Fri, Jan 20, 2017 at 4:29 AM, Bill Cox > wrote: I'm seeing 5.7K token binding headers per second at the moment, about 5K/s = sending both channel-ID and token binding (probably chrome), and about 700/= s with just token binding (probably not chrome). Based on information in our logs, the requests with just token binding head= ers are primarily from Edge. cheers, -Anupam Bill -- You received this message because you are subscribed to the Google Groups "= token-binding-team" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to token-binding-team+unsubscribe@google.com. To post to this group, send email to token-binding-team@google.com. To view this discussion on the web visit https://groups.google.com/a/google= .com/d/msgid/token-binding-team/CAH9QtQHiMNKTWkExDduH%3DhuCzs%3DyVW%2BE7YM3= Wnoh0DoeYUe08A%40mail.gmail.com. _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable --_000_CY1PR0301MB08422994A1E2EE2210F584328C710CY1PR0301MB0842_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Ø  That is good news assuming everything is wor= king. 

We have reports of some interop failures; they̵= 7;re under investigation.

 

Ø  Fast and Slow or just Fast?

Fast for sure; I’m not certain about Slow.

 

From: Unbearable [mailto:unbearable-= bounces@ietf.org] On Behalf Of John Bradley
Sent: Friday, January 20, 2017 10:11 AM
To: Vinod Anupam <vanupam@google.com>
Cc: Tokbind WG <unbearable@ietf.org>; token-binding-team <t= oken-binding-team@google.com>; Bill Cox <waywardgeek@google.com> Subject: Re: [Unbearable] Token binding version (0, 10) support is g= lobal on google servers

 

That is good news assuming everything is working.&nb= sp;

 

You now have support in IE and Edge in the latest Wi= ndows 10 preview.

 

John B.

On Jan 20, 2017, at 3:02 PM, Vinod Anupam <vanupam@google.com> wrote:

 

 

 

On Fri, Jan 20, 2017 at 4:29 AM, Bill Cox <waywardgeek@google.co= m> wrote:

I'm seeing 5.7K token binding headers per second at = the moment, about 5K/s sending both channel-ID and token binding (probably = chrome), and about 700/s with just token binding (probably not chrome).

 

Based on information in our logs, the requests with = just token binding headers are primarily from Edge.

 

cheers,

-Anupam

 

 

Bill=

 

--
You received this message because you are subs= cribed to the Google Groups "token-binding-team" group. To unsubscribe from this group and stop receiv= ing emails from it, send an email to token-binding-team+unsubscribe@google.com.
To post to this group, send email to token-binding-team@google.com.
To view this discussion on the web visit https://groups.google.com/a/google.com/d/msgid/token-binding-team/CAH9QtQHi= MNKTWkExDduH%3DhuCzs%3DyVW%2BE7YM3Wnoh0DoeYUe08A%40mail.gmail.com.

 

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ie= tf.org/mailman/listinfo/unbearable

 

--_000_CY1PR0301MB08422994A1E2EE2210F584328C710CY1PR0301MB0842_-- From nobody Fri Jan 20 11:46:46 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D053127A91 for ; Fri, 20 Jan 2017 11:46:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.011 X-Spam-Level: X-Spam-Status: No, score=-3.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wURtrb6wnDtQ for ; Fri, 20 Jan 2017 11:46:42 -0800 (PST) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0097.outbound.protection.outlook.com [104.47.37.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 626B0127A90 for ; Fri, 20 Jan 2017 11:46:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Ai2NmdteRnSD7pEo+dT+ogAROM/kKkZ5BMgcmCJcaa0=; b=gibk4SVixb7dq7SeP+D7qC8ugqGyl86BzlH4FX5mpaU+qg08HJPFDoBnXpqqCufLPfyZtU5ZWlIJmSDK+KvcQUkM/5kj9n/uQrIVzT/B+jwxGgzUtSc2Lr71Bta/jUuDw1tkq7R7C69fHFWX8JE1MEL43a5dcrBHyYD/KclezNQ= Received: from BN3PR03MB2323.namprd03.prod.outlook.com (10.166.74.142) by BN3PR03MB2322.namprd03.prod.outlook.com (10.166.74.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.860.13; Fri, 20 Jan 2017 19:46:36 +0000 Received: from BN3PR03MB2323.namprd03.prod.outlook.com ([10.166.74.142]) by BN3PR03MB2323.namprd03.prod.outlook.com ([10.166.74.142]) with mapi id 15.01.0860.012; Fri, 20 Jan 2017 19:46:36 +0000 From: Pranav Kukreja To: Vinod Anupam , Bill Cox Thread-Topic: [Unbearable] Token binding version (0, 10) support is global on google servers Thread-Index: AQHScxjcawMVX0v9KEyHxNSNM2qW+aFBqHkAgAAcdfA= Date: Fri, 20 Jan 2017 19:46:35 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pranavk@microsoft.com; x-originating-ip: [2001:4898:80e8:a::2d3] x-ms-office365-filtering-correlation-id: 6afe56f1-063d-477d-1b58-08d4416d0b35 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:BN3PR03MB2322; x-microsoft-exchange-diagnostics: 1; BN3PR03MB2322; 7:uIA6rmJ4b78g05cK9djH7+K0WoaFr4qPXXzIFVNyhBbM4eVIMYzoUtAf0p2GmUQA/1iN0cGIf0q6V4Tkg+eNIMhOlp/xH5LUYaH4arquwLHyucQlFapiiQaaMr4rMgtDQNrE/tzoOKHDhFueEZ9v8LpkmstvAZOyDLpu8bD7mtlj2W+BO2W6eiWjAP8x8TcxE1HTsGymCkrTMqG4Sons39t/qd08yH/1SmxccQUYfMkTfUfkJygWTv623fmRaAT66qWKi14zlQGpzqFAgS2mYu0o+5tF3rynKt7g09w0Tq6PwShxioq0YFSBik/bm/9WytsyTOfXkQpIi33zXa+rsUai1DBQ4LouIH+LGL6YbnmqrmPQ755yx88rrZF7ve3gwA5ht6OJ5UGzI2VhUIHItaBEo/7r+iTMXbrD4lVof09kjfD4cSAoAOywPclynFomCg6ngJXkDdGCgnA0Dc5DOkcXZG5LYt6y1rVqbqPipUw= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(228788266533470)(211936372134217)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123562025)(20161123560025)(20161123564025)(6072148)(6047074); SRVR:BN3PR03MB2322; BCL:0; PCL:0; RULEID:; SRVR:BN3PR03MB2322; x-forefront-prvs: 01930B2BA8 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39850400002)(39860400002)(39450400003)(39840400002)(39410400002)(199003)(24454002)(377454003)(189002)(5005710100001)(99286003)(575784001)(86362001)(55016002)(54906002)(33656002)(189998001)(122556002)(81166006)(9686003)(74316002)(6306002)(3660700001)(19609705001)(7906003)(97736004)(81156014)(7736002)(76176999)(50986999)(106356001)(54356999)(10090500001)(92566002)(77096006)(25786008)(86612001)(5001770100001)(3280700002)(68736007)(54896002)(790700001)(53936002)(8936002)(101416001)(6116002)(236005)(102836003)(2950100002)(6436002)(8990500004)(6506006)(105586002)(2900100001)(2906002)(7696004)(10290500002)(4326007)(606005)(229853002)(5660300001)(38730400001)(106116001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR03MB2322; H:BN3PR03MB2323.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN3PR03MB232370AF08B306BBE51DA920B0710BN3PR03MB2323namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jan 2017 19:46:35.9201 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR03MB2322 Cc: Tokbind WG , token-binding-team Subject: Re: [Unbearable] Token binding version (0, 10) support is global on google servers X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Jan 2017 19:46:45 -0000 --_000_BN3PR03MB232370AF08B306BBE51DA920B0710BN3PR03MB2323namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QW51cGFtLCBhcmUgdGhvc2UgY29ubmVjdGlvbnMgZnJvbSBFZGdlIHJlc3VsdGluZyBpbiBhbnkg Y29ubmVjdGlvbiBlcnJvcnMgcG9zdCB0aGUgVExTIGhhbmRzaGFrZSwgZXNwZWNpYWxseSBkdXJp bmcgZmFsc2Ugc3RhcnQuIEkgYW0gY2hhc2luZyBkb3duIHNvbWUgaW50ZXJvcCBpc3N1ZXMgd2l0 aCBFZGdlIHRhbGtpbmcgdG8gZ29vZ2xlIHNlcnZlcnMgd2l0aCBUQiBlbmFibGVkIGF0IHRoZSBt b21lbnQuIElmIHlvdSBub3RpY2UgYW55dGhpbmcgcGxlYXNlIGxldCB1cyBrbm93Lg0KDQpUaGFu a3MhDQpQcmFuYXYNCg0KRnJvbTogVW5iZWFyYWJsZSBbbWFpbHRvOnVuYmVhcmFibGUtYm91bmNl c0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIFZpbm9kIEFudXBhbQ0KU2VudDogRnJpZGF5LCBKYW51 YXJ5IDIwLCAyMDE3IDEwOjAyIEFNDQpUbzogQmlsbCBDb3ggPHdheXdhcmRnZWVrQGdvb2dsZS5j b20+DQpDYzogVG9rYmluZCBXRyA8dW5iZWFyYWJsZUBpZXRmLm9yZz47IHRva2VuLWJpbmRpbmct dGVhbSA8dG9rZW4tYmluZGluZy10ZWFtQGdvb2dsZS5jb20+DQpTdWJqZWN0OiBSZTogW1VuYmVh cmFibGVdIFRva2VuIGJpbmRpbmcgdmVyc2lvbiAoMCwgMTApIHN1cHBvcnQgaXMgZ2xvYmFsIG9u IGdvb2dsZSBzZXJ2ZXJzDQoNCg0KDQpPbiBGcmksIEphbiAyMCwgMjAxNyBhdCA0OjI5IEFNLCBC aWxsIENveCA8d2F5d2FyZGdlZWtAZ29vZ2xlLmNvbTxtYWlsdG86d2F5d2FyZGdlZWtAZ29vZ2xl LmNvbT4+IHdyb3RlOg0KSSdtIHNlZWluZyA1LjdLIHRva2VuIGJpbmRpbmcgaGVhZGVycyBwZXIg c2Vjb25kIGF0IHRoZSBtb21lbnQsIGFib3V0IDVLL3Mgc2VuZGluZyBib3RoIGNoYW5uZWwtSUQg YW5kIHRva2VuIGJpbmRpbmcgKHByb2JhYmx5IGNocm9tZSksIGFuZCBhYm91dCA3MDAvcyB3aXRo IGp1c3QgdG9rZW4gYmluZGluZyAocHJvYmFibHkgbm90IGNocm9tZSkuDQoNCkJhc2VkIG9uIGlu Zm9ybWF0aW9uIGluIG91ciBsb2dzLCB0aGUgcmVxdWVzdHMgd2l0aCBqdXN0IHRva2VuIGJpbmRp bmcgaGVhZGVycyBhcmUgcHJpbWFyaWx5IGZyb20gRWRnZS4NCg0KY2hlZXJzLA0KLUFudXBhbQ0K DQoNCkJpbGwNCi0tDQpZb3UgcmVjZWl2ZWQgdGhpcyBtZXNzYWdlIGJlY2F1c2UgeW91IGFyZSBz dWJzY3JpYmVkIHRvIHRoZSBHb29nbGUgR3JvdXBzICJ0b2tlbi1iaW5kaW5nLXRlYW0iIGdyb3Vw Lg0KVG8gdW5zdWJzY3JpYmUgZnJvbSB0aGlzIGdyb3VwIGFuZCBzdG9wIHJlY2VpdmluZyBlbWFp bHMgZnJvbSBpdCwgc2VuZCBhbiBlbWFpbCB0byB0b2tlbi1iaW5kaW5nLXRlYW0rdW5zdWJzY3Jp YmVAZ29vZ2xlLmNvbTxtYWlsdG86dG9rZW4tYmluZGluZy10ZWFtK3Vuc3Vic2NyaWJlQGdvb2ds ZS5jb20+Lg0KVG8gcG9zdCB0byB0aGlzIGdyb3VwLCBzZW5kIGVtYWlsIHRvIHRva2VuLWJpbmRp bmctdGVhbUBnb29nbGUuY29tPG1haWx0bzp0b2tlbi1iaW5kaW5nLXRlYW1AZ29vZ2xlLmNvbT4u DQpUbyB2aWV3IHRoaXMgZGlzY3Vzc2lvbiBvbiB0aGUgd2ViIHZpc2l0IGh0dHBzOi8vZ3JvdXBz Lmdvb2dsZS5jb20vYS9nb29nbGUuY29tL2QvbXNnaWQvdG9rZW4tYmluZGluZy10ZWFtL0NBSDlR dFFIaU1OS1RXa0V4RGR1SCUzRGh1Q3pzJTNEeVZXJTJCRTdZTTNXbm9oMERvZVlVZTA4QSU0MG1h aWwuZ21haWwuY29tPGh0dHBzOi8vZ3JvdXBzLmdvb2dsZS5jb20vYS9nb29nbGUuY29tL2QvbXNn aWQvdG9rZW4tYmluZGluZy10ZWFtL0NBSDlRdFFIaU1OS1RXa0V4RGR1SCUzRGh1Q3pzJTNEeVZX JTJCRTdZTTNXbm9oMERvZVlVZTA4QSU0MG1haWwuZ21haWwuY29tP3V0bV9tZWRpdW09ZW1haWwm dXRtX3NvdXJjZT1mb290ZXI+Lg0KDQo= --_000_BN3PR03MB232370AF08B306BBE51DA920B0710BN3PR03MB2323namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uZ21haWwtaG9lbnpiDQoJe21z by1zdHlsZS1uYW1lOmdtYWlsLWhvZW56Yjt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4g MS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQot LT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4 dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3Rl IG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpl eHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+ DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+ DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW51cGFt LCBhcmUgdGhvc2UgY29ubmVjdGlvbnMgZnJvbSBFZGdlIHJlc3VsdGluZyBpbiBhbnkgY29ubmVj dGlvbiBlcnJvcnMgcG9zdCB0aGUgVExTIGhhbmRzaGFrZSwgZXNwZWNpYWxseSBkdXJpbmcgZmFs c2Ugc3RhcnQuIEkgYW0gY2hhc2luZyBkb3duIHNvbWUgaW50ZXJvcCBpc3N1ZXMgd2l0aCBFZGdl IHRhbGtpbmcgdG8gZ29vZ2xlIHNlcnZlcnMgd2l0aCBUQiBlbmFibGVkIGF0IHRoZSBtb21lbnQu IElmDQogeW91IG5vdGljZSBhbnl0aGluZyBwbGVhc2UgbGV0IHVzIGtub3cuPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPlRoYW5rcyE8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlByYW5hdjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gVW5iZWFyYWJsZSBb bWFpbHRvOnVuYmVhcmFibGUtYm91bmNlc0BpZXRmLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+ Vmlub2QgQW51cGFtPGJyPg0KPGI+U2VudDo8L2I+IEZyaWRheSwgSmFudWFyeSAyMCwgMjAxNyAx MDowMiBBTTxicj4NCjxiPlRvOjwvYj4gQmlsbCBDb3ggJmx0O3dheXdhcmRnZWVrQGdvb2dsZS5j b20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBUb2tiaW5kIFdHICZsdDt1bmJlYXJhYmxlQGlldGYub3Jn Jmd0OzsgdG9rZW4tYmluZGluZy10ZWFtICZsdDt0b2tlbi1iaW5kaW5nLXRlYW1AZ29vZ2xlLmNv bSZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtVbmJlYXJhYmxlXSBUb2tlbiBiaW5kaW5n IHZlcnNpb24gKDAsIDEwKSBzdXBwb3J0IGlzIGdsb2JhbCBvbiBnb29nbGUgc2VydmVyczxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+T24gRnJpLCBKYW4gMjAsIDIwMTcgYXQgNDoyOSBBTSwgQmlsbCBDb3gg Jmx0OzxhIGhyZWY9Im1haWx0bzp3YXl3YXJkZ2Vla0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFu ayI+d2F5d2FyZGdlZWtAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t cmlnaHQ6MGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JJ20gc2VlaW5nIDUuN0sg dG9rZW4gYmluZGluZyBoZWFkZXJzIHBlciBzZWNvbmQgYXQgdGhlIG1vbWVudCwgYWJvdXQgNUsv cyBzZW5kaW5nIGJvdGggY2hhbm5lbC1JRCBhbmQgdG9rZW4gYmluZGluZyAocHJvYmFibHkgY2hy b21lKSwgYW5kIGFib3V0IDcwMC9zIHdpdGgganVzdCB0b2tlbiBiaW5kaW5nIChwcm9iYWJseSBu b3QgY2hyb21lKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmFzZWQgb24gaW5mb3JtYXRpb24gaW4gb3VyIGxvZ3Ms IHRoZSByZXF1ZXN0cyB3aXRoIGp1c3QgdG9rZW4gYmluZGluZyBoZWFkZXJzIGFyZSBwcmltYXJp bHkgZnJvbSBFZGdlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5jaGVlcnMsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4tQW51cGFtPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGlu Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OiM4ODg4ODgiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij5CaWxsPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGNsYXNzPSJnbWFpbC1ob2VuemIiPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij4tLSA8 L3NwYW4+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiM4ODg4ODgiPjxicj4NCjxzcGFuIGNs YXNzPSJnbWFpbC1ob2VuemIiPllvdSByZWNlaXZlZCB0aGlzIG1lc3NhZ2UgYmVjYXVzZSB5b3Ug YXJlIHN1YnNjcmliZWQgdG8gdGhlIEdvb2dsZSBHcm91cHMgJnF1b3Q7dG9rZW4tYmluZGluZy10 ZWFtJnF1b3Q7IGdyb3VwLjwvc3Bhbj48YnI+DQo8c3BhbiBjbGFzcz0iZ21haWwtaG9lbnpiIj5U byB1bnN1YnNjcmliZSBmcm9tIHRoaXMgZ3JvdXAgYW5kIHN0b3AgcmVjZWl2aW5nIGVtYWlscyBm cm9tIGl0LCBzZW5kIGFuIGVtYWlsIHRvDQo8YSBocmVmPSJtYWlsdG86dG9rZW4tYmluZGluZy10 ZWFtJiM0Mzt1bnN1YnNjcmliZUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+dG9rZW4tYmlu ZGluZy10ZWFtJiM0Mzt1bnN1YnNjcmliZUBnb29nbGUuY29tPC9hPi48L3NwYW4+PGJyPg0KPHNw YW4gY2xhc3M9ImdtYWlsLWhvZW56YiI+VG8gcG9zdCB0byB0aGlzIGdyb3VwLCBzZW5kIGVtYWls IHRvIDxhIGhyZWY9Im1haWx0bzp0b2tlbi1iaW5kaW5nLXRlYW1AZ29vZ2xlLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPg0KdG9rZW4tYmluZGluZy10ZWFtQGdvb2dsZS5jb208L2E+Ljwvc3Bhbj48YnI+ DQo8c3BhbiBjbGFzcz0iZ21haWwtaG9lbnpiIj5UbyB2aWV3IHRoaXMgZGlzY3Vzc2lvbiBvbiB0 aGUgd2ViIHZpc2l0IDxhIGhyZWY9Imh0dHBzOi8vZ3JvdXBzLmdvb2dsZS5jb20vYS9nb29nbGUu Y29tL2QvbXNnaWQvdG9rZW4tYmluZGluZy10ZWFtL0NBSDlRdFFIaU1OS1RXa0V4RGR1SCUzRGh1 Q3pzJTNEeVZXJTJCRTdZTTNXbm9oMERvZVlVZTA4QSU0MG1haWwuZ21haWwuY29tP3V0bV9tZWRp dW09ZW1haWwmYW1wO3V0bV9zb3VyY2U9Zm9vdGVyIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczov L2dyb3Vwcy5nb29nbGUuY29tL2EvZ29vZ2xlLmNvbS9kL21zZ2lkL3Rva2VuLWJpbmRpbmctdGVh bS9DQUg5UXRRSGlNTktUV2tFeERkdUglM0RodUN6cyUzRHlWVyUyQkU3WU0zV25vaDBEb2VZVWUw OEElNDBtYWlsLmdtYWlsLmNvbTwvYT4uPC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv YmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_BN3PR03MB232370AF08B306BBE51DA920B0710BN3PR03MB2323namp_-- From nobody Thu Jan 26 11:04:44 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8479512999E for ; Thu, 26 Jan 2017 11:04:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.998 X-Spam-Level: X-Spam-Status: No, score=-0.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=balfanz=google.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z4YwdcgeYaA2 for ; Thu, 26 Jan 2017 11:04:42 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8449612999C for ; Thu, 26 Jan 2017 11:04:42 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1485457481; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=SSuvo4KmycfOdHX42sylVx9jab+AFa3DYAkLHKnIgwI=; b=hv2F8DrlktmgbtTRtCzEtcVF9Smc8YA9tYVixgEFBFPFQANSvg5vEqj5Zi5FY+dnOGlHbT7K 6Bklwq3j1MVLGwNFY6tEYdaori5ma8nfdEhp5ICFpWQE5XMrGAu8Lf6tWFArpu6kMEyvh2c0 nRurbvHP/WPJLx+7chGD1hHJCAU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=Voo7ReR8WQ2OW9X3geoTXYfPyXErEUtfSRA72D13R2c0rYLvepZURekTubRKR6dGy/Wr7u blHUlDJaizHdm0Rhtg1aHox9y2rMNl+5BwhuN2YkcYLmR8RvF6zZy/eMBWMS8EOpoaF3YBi2 SPVJw5cluFENwj8PcQY430kWHHXIE= Sender: balfanz=google.com@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.42]) by mxa.mailgun.org with ESMTP id 588a4849.7fe9d81e1e70-smtp-out-n03; Thu, 26 Jan 2017 19:04:41 -0000 (UTC) Date: Thu, 26 Jan 2017 11:04:40 -0800 From: Dirk Balfanz To: unbearable@ietf.org Message-ID: <588a484844761_4aae3fac47aa5130873a0@hookshot-fe1-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_588a484844286_4aae3fac47aa51308722b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 47be69: slight tightening of language re/ authentication/a... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Dirk Balfanz List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 19:04:43 -0000 ----==_mimepart_588a484844286_4aae3fac47aa51308722b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 47be6979a81628ce3fd403b280e8d5d3a57b1c56 https://github.com/TokenBinding/Internet-Drafts/commit/47be6979a81628ce3fd403b280e8d5d3a57b1c56 Author: Dirk Balfanz Date: 2017-01-26 (Thu, 26 Jan 2017) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- slight tightening of language re/ authentication/authorization tokens. They're now consistently "security tokens" ----==_mimepart_588a484844286_4aae3fac47aa51308722b-- From nobody Thu Jan 26 11:16:12 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9E3312998E for ; Thu, 26 Jan 2017 10:55:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.037 X-Spam-Level: X-Spam-Status: No, score=-6.037 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-1.156, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IR5ZlQqVg8DV for ; Thu, 26 Jan 2017 10:55:41 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext2.iad.github.net [192.30.252.193]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C472712996D for ; Thu, 26 Jan 2017 10:55:41 -0800 (PST) Date: Thu, 26 Jan 2017 10:55:40 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1485456940; bh=RE5PNpc0PRpJk9X6g3Dg69u3J4OLJh3Z/vcS+Jr/REY=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=0vJ7UtxCZ4oL9HHBukBHNvHU1MfPdScCpJBGtHrvnOAmjnvLHUOOOm/RwQE/0nYsv GaoEn1DnBBTVM7qShQgv9Hct3ryyyPf7UgIsIubodw9GqMldg8AGV8bXLO4VKC4h+y P6vHuf1hwRDXll9NB7BKTUAUtG3hckBprEH5wY88= From: balfanz To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_588a462c1d88c_18f93fb762891134228572"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: balfanz X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 26 Jan 2017 11:16:03 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: WGLC: web origin -> server or eTLD+1 (#85) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 18:55:44 -0000 ----==_mimepart_588a462c1d88c_18f93fb762891134228572 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #85 via 39ab776bfa87bde83a05e0feaf83eefb7fbf21d4. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/85#event-938258667 ----==_mimepart_588a462c1d88c_18f93fb762891134228572 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #85 via 39ab776.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_588a462c1d88c_18f93fb762891134228572-- From nobody Thu Jan 26 11:16:17 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3761612998F for ; Thu, 26 Jan 2017 10:55:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=dirk=balfanz.net@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W7s-5mwItnTY for ; Thu, 26 Jan 2017 10:55:43 -0800 (PST) Received: from m71-131.mailgun.net (m71-131.mailgun.net [166.78.71.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 51B2D129974 for ; Thu, 26 Jan 2017 10:55:42 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1485456941; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=vnzYTztR7BKcxe0xEO8ZTAoImg+/W5p2AMa02codefY=; b=YEITM2p0wDMw6873eSbpbwWQy+Mz6p787ucXCILBX+oN3oQUAEpR+YVL4Hp4TKR6BGJZ55xF x5uTFZVmcxEAi1Xt1LBoj6UGSa4PyPd1CSv8i3nzMpZ4pDcJYGRmk7Ye4Sr3xoeUyLppOCQD 8jNIBXDaTqes3fKxHDNmbei3Mac= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=CdrQRK5JymDOLrTjofw3isHLg6JwQQsLQAOeXCB60Ii+Ut9INxpfAaUlNbaElBZwPZeIpo gHGaaYoiK5iUJpD7xYOmKfkNve2EfswJAm0/+L4LFDfkZFOZPcaPzlvE6aNAXKpPKFtnTCoE yAzNM4Pj48OakvNN/nInlWUf+SK8k= Sender: dirk=balfanz.net@github.com X-Mailgun-Sending-Ip: 166.78.71.131 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.45]) by mxa.mailgun.org with ESMTP id 588a462c.7f7fbc2f2f90-smtp-out-n03; Thu, 26 Jan 2017 18:55:40 -0000 (UTC) Date: Thu, 26 Jan 2017 10:55:39 -0800 From: balfanz To: unbearable@ietf.org Message-ID: <588a462be5f94_21653fa4b59cb14033423@hookshot-fe3-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_588a462be5ae0_21653fa4b59cb14033363"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: X-Mailman-Approved-At: Thu, 26 Jan 2017 11:16:03 -0800 Subject: [Unbearable] [TokenBinding/Internet-Drafts] 45c086: HTTPSTB: init -08 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: balfanz List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 18:55:45 -0000 ----==_mimepart_588a462be5ae0_21653fa4b59cb14033363 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 45c0866107ef64b428f408b082bc196b335fd234 https://github.com/TokenBinding/Internet-Drafts/commit/45c0866107ef64b428f408b082bc196b335fd234 Author: JeffH Date: 2016-12-08 (Thu, 08 Dec 2016) Changed paths: R draft-ietf-tokbind-https-07.xml A draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: init -08 Commit: 141b203fe6e13b1121fd90abbb6bbeff766bf15d https://github.com/TokenBinding/Internet-Drafts/commit/141b203fe6e13b1121fd90abbb6bbeff766bf15d Author: JeffH Date: 2016-12-09 (Fri, 09 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: spelling fixups Commit: 25653615a5c43d1e9e27031e6a7680a80d6b66a8 https://github.com/TokenBinding/Internet-Drafts/commit/25653615a5c43d1e9e27031e6a7680a80d6b66a8 Author: JeffH Date: 2016-12-09 (Fri, 09 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: may->MAY in section 2. The Sec-Token-Binding Header Field Commit: c79388e234b7508d6fcce1c0cf88daab24286fb8 https://github.com/TokenBinding/Internet-Drafts/commit/c79388e234b7508d6fcce1c0cf88daab24286fb8 Author: JeffH Date: 2016-12-09 (Fri, 09 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: fix minor grammar Commit: c13966b8395a76f7ecdd000d522511ad9e8dbc3e https://github.com/TokenBinding/Internet-Drafts/commit/c13966b8395a76f7ecdd000d522511ad9e8dbc3e Author: JeffH Date: 2016-12-09 (Fri, 09 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: polish 'Security Token Replay' section Commit: 4560edafb723cfe741d42184343a48d82640d65f https://github.com/TokenBinding/Internet-Drafts/commit/4560edafb723cfe741d42184343a48d82640d65f Author: JeffH Date: 2016-12-09 (Fri, 09 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: minor clarifying edit Commit: 39ab776bfa87bde83a05e0feaf83eefb7fbf21d4 https://github.com/TokenBinding/Internet-Drafts/commit/39ab776bfa87bde83a05e0feaf83eefb7fbf21d4 Author: JeffH Date: 2016-12-13 (Tue, 13 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: origin->{eTLD+1,server}, as appropriate, fixes #85 Commit: 5515d24533d43498e825831033f98d9ccbf59dd4 https://github.com/TokenBinding/Internet-Drafts/commit/5515d24533d43498e825831033f98d9ccbf59dd4 Author: JeffH Date: 2016-12-14 (Wed, 14 Dec 2016) Changed paths: M README.md M draft-ietf-tokbind-https-08.xml R draft-ietf-tokbind-protocol-11.xml A draft-ietf-tokbind-protocol-12.xml Log Message: ----------- Merge branch 'master' into HTTPSTB-cleanup1 Commit: 77006e22b38f5c58e36dc91319c6492dd8e12b2d https://github.com/TokenBinding/Internet-Drafts/commit/77006e22b38f5c58e36dc91319c6492dd8e12b2d Author: JeffH Date: 2016-12-14 (Wed, 14 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: TB msg -> TB structure in sensitivity of TB hdr section Commit: 0763313e165847941d358259dab23e2a01f096f8 https://github.com/TokenBinding/Internet-Drafts/commit/0763313e165847941d358259dab23e2a01f096f8 Author: JeffH Date: 2016-12-14 (Wed, 14 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: key -> key pairs in privacy-cons Commit: afe11ab03944865f802b76ea728fe2c0bb8670ee https://github.com/TokenBinding/Internet-Drafts/commit/afe11ab03944865f802b76ea728fe2c0bb8670ee Author: JeffH Date: 2016-12-14 (Wed, 14 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: equate 'first-party' to 'same-site' in 1st-party use cases Commit: e5d37ae47198a326a0153052154c60acfd57074d https://github.com/TokenBinding/Internet-Drafts/commit/e5d37ae47198a326a0153052154c60acfd57074d Author: JeffH Date: 2016-12-14 (Wed, 14 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: update change log Commit: 1be576f9b1198ae8dce3a3c9b2f3dd3266b79a10 https://github.com/TokenBinding/Internet-Drafts/commit/1be576f9b1198ae8dce3a3c9b2f3dd3266b79a10 Author: JeffH Date: 2016-12-15 (Thu, 15 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- Merge branch 'master' into HTTPSTB-cleanup1 Commit: 178104c70e2f7e329cd7e6633277f082e2a9cf5e https://github.com/TokenBinding/Internet-Drafts/commit/178104c70e2f7e329cd7e6633277f082e2a9cf5e Author: JeffH Date: 2016-12-15 (Thu, 15 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- HTTPSTB: delete dangling Commit: 7070626e339a5ac35754562ef82af7e236fde095 https://github.com/TokenBinding/Internet-Drafts/commit/7070626e339a5ac35754562ef82af7e236fde095 Author: balfanz Date: 2017-01-26 (Thu, 26 Jan 2017) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- Merge pull request #86 from equalsJeffH/HTTPSTB-cleanup1 HTTPSTB WGLC editorial cleanup 1 Compare: https://github.com/TokenBinding/Internet-Drafts/compare/5fd553bd306e...7070626e339a ----==_mimepart_588a462be5ae0_21653fa4b59cb14033363-- From nobody Thu Jan 26 11:16:20 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 154EB12996C for ; Thu, 26 Jan 2017 10:55:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XlUtRvyL_z4V for ; Thu, 26 Jan 2017 10:55:45 -0800 (PST) Received: from o1.sgmail.github.com (o1.sgmail.github.com [192.254.114.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F93B129985 for ; Thu, 26 Jan 2017 10:55:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=6FO2j2UmDXCykYSDypA+SGJ9Kac=; b=HCLgpAzG2/H2LkIh ZlRFRSz+l23d9Zqs2y/7QntFm8QkfmCQqqA5Cw0MYjA9eGt8W67bqSyOTJHNFKVR bSlilWQWlzoDhlL2YrpxXxMdmvf30G1+4FHPIu8vMB4C/dZT8Z7Lc1GLRELfB9vu 4pMuMmQyPc2OE8nVnfafKxXtKDg= Received: by filter0599p1mdw1.sendgrid.net with SMTP id filter0599p1mdw1-32483-588A462B-2B 2017-01-26 18:55:39.603182477 +0000 UTC Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2a-ext-cp1-prd.iad.github.net [192.30.253.16]) by ismtpd0001p1iad1.sendgrid.net (SG) with ESMTP id mkR55iuoSZy60hfkB3xMEQ for ; Thu, 26 Jan 2017 18:55:39.341 +0000 (UTC) Date: Thu, 26 Jan 2017 10:55:39 -0800 From: balfanz To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_588a462b3d20f_b7a33f909be751383516a5"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: balfanz X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYriwXyW4zd9ytJBQr/838Bj52bLAhcI5dqYMU WHZejQ6Ak1bREjGwVL1NEpZfBVIN/kDtZDhZMCLLlJ/XPLYbVGivBraPf9DY/omdZIhF6TcDjKwW9s d/fTV745RAhry+DjxVGO/XVyuGm0FMIYMQ+VeNqvommdcGdZcA6SaBM9K95zFmhY9RVHzPa6KqK4Zh g= Archived-At: X-Mailman-Approved-At: Thu, 26 Jan 2017 11:16:03 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB WGLC editorial cleanup 1 (#86) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 18:55:47 -0000 ----==_mimepart_588a462b3d20f_b7a33f909be751383516a5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #86. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/86#event-938258635 ----==_mimepart_588a462b3d20f_b7a33f909be751383516a5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #86.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_588a462b3d20f_b7a33f909be751383516a5-- From nobody Thu Jan 26 11:16:24 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF493129994 for ; Thu, 26 Jan 2017 10:59:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.6 X-Spam-Level: X-Spam-Status: No, score=-3.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1_DmqPEFskwr for ; Thu, 26 Jan 2017 10:58:57 -0800 (PST) Received: from o11.sgmail.github.com (o11.sgmail.github.com [167.89.101.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B415A129974 for ; Thu, 26 Jan 2017 10:58:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=4dBaBoPQ2Vrz5lmmFQ3gEEFBOcU=; b=FlV4ejSOFLEaCTr0 VaHs+lqSp5rOnXNm/6pO/Fn5uoYtImI02xie5+t7A4/38cKUY8GEMG03QD1O981r 4aTRqUHW7iIKh0KjQuMTwdCORFoKCEwJI1LeM5aiGORwkTDt5YdGueYZiIQbrPC5 IZY+xYciSVqrPLGQt23jKQaEK1g= Received: by filter0580p1mdw1.sendgrid.net with SMTP id filter0580p1mdw1-3279-588A46CE-75 2017-01-26 18:58:22.924364102 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0003p1iad1.sendgrid.net (SG) with ESMTP id phS7X9J9TWW_6V4XUlzlzg for ; Thu, 26 Jan 2017 18:58:22.674 +0000 (UTC) Date: Thu, 26 Jan 2017 10:58:22 -0800 From: balfanz To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_588a46ce8b6b6_445a3fb0c77051404424ea"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: balfanz X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: push X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYq8+aQYqIDR1XRLbs93Pgd/5Ek8NsO/yNBclJ 5w5zN3uqlxgpBpRdlD0snjOz/FMQtkmwJNFD0i2lT/B4HA11C2gjcmEDtVdSQgKqwTVybZf5xQBFlF rAL5AzexW9TsY1fEle3J4s8TQJ6zSx07D3uhNYoPSft6iJ/VxpmHfW+6Pg== Archived-At: X-Mailman-Approved-At: Thu, 26 Jan 2017 11:16:03 -0800 Cc: Push Subject: Re: [Unbearable] =?utf-8?q?=5BTokenBinding/Internet-Drafts=5D_WGLC_Je?= =?utf-8?q?ff_H_had_previously_proposed_this_minor_=E2=80=A6_=28=2390=29?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 18:59:02 -0000 ----==_mimepart_588a46ce8b6b6_445a3fb0c77051404424ea Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @balfanz pushed 1 commit. 5828473 Merge branch 'master' into other-signaling -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/90/files/6b81e241395f8529d8a1452b131f6b83568e58b4..582847348cc7317b0c53fa389f9c6cdc672e4886 ----==_mimepart_588a46ce8b6b6_445a3fb0c77051404424ea Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@balfanz pushed 1 commit.

  • 5828473 Merge branch 'master' into other-signaling

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_588a46ce8b6b6_445a3fb0c77051404424ea-- From nobody Thu Jan 26 11:16:29 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8161129974 for ; Thu, 26 Jan 2017 10:59:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=dirk=balfanz.net@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mm-Z6-uIp-Sn for ; Thu, 26 Jan 2017 10:59:05 -0800 (PST) Received: from m69-170.mailgun.net (m69-170.mailgun.net [166.78.69.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6925129998 for ; Thu, 26 Jan 2017 10:59:04 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1485457143; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=qxWC+QO/iMcwCP9DPops8dQ4dVSTiwCyWKj4Z8dtuQ4=; b=kUVgFzYYK8rgkXOiA1zLWoM1+VsFM8l2TpvDvIaBku9HzIr43/twBHhssX5wtzYzZG0zZ6Lm Uy+1sFaX/psmGNYDywoIEb7yKbQp+5d03S2PQd2Zg6+XxFSH/NJeKINBrAMX7tugyTCLqCOH oMFljon5UQSh2Ld0yuCHmNVMPRg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=DeuGWiUVangrtyVkXDIx9W+X9XEp/q4zF2Tu8UWDSqwSCcQZaJgrYxTi9vFKfSeag7ob6A Hd9KaFA00qpvZHcm5CzlASdLOl4k7i1blLrOPnElueCxqNpAGJHb+k43q4xTzAEMQwaire/Z 2sJlTNbdd8LyVBrpAeWd1EzxK5YR4= Sender: dirk=balfanz.net@github.com X-Mailgun-Sending-Ip: 166.78.69.170 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.42]) by mxa.mailgun.org with ESMTP id 588a46f7.7fc2703a7540-smtp-out-n01; Thu, 26 Jan 2017 18:59:03 -0000 (UTC) Date: Thu, 26 Jan 2017 10:59:02 -0800 From: balfanz To: unbearable@ietf.org Message-ID: <588a46f652835_2a7f43f90c71511387016b@hookshot-fe-6dbb0c4.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_588a46f652098_2a7f43f90c715113870020"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: X-Mailman-Approved-At: Thu, 26 Jan 2017 11:16:03 -0800 Subject: [Unbearable] [TokenBinding/Internet-Drafts] 6b81e2: Jeff H had previously proposed this minor wording ... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: balfanz List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 18:59:11 -0000 ----==_mimepart_588a46f652098_2a7f43f90c715113870020 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 6b81e241395f8529d8a1452b131f6b83568e58b4 https://github.com/TokenBinding/Internet-Drafts/commit/6b81e241395f= 8529d8a1452b131f6b83568e58b4 Author: Brian Campbell Date: 2016-12-19 (Mon, 19 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- Jeff H had previously proposed this minor wording addition to https://g= ithub.com/TokenBinding/Internet-Drafts/commit/96526be5fc14dc9dddf846b6709= 426ca23fe195b that I thought was worthwhile so am reproposing here. Commit: 582847348cc7317b0c53fa389f9c6cdc672e4886 https://github.com/TokenBinding/Internet-Drafts/commit/582847348cc7= 317b0c53fa389f9c6cdc672e4886 Author: balfanz Date: 2017-01-26 (Thu, 26 Jan 2017) Changed paths: M README.md M draft-ietf-tokbind-https-08.xml R draft-ietf-tokbind-negotiation-06.xml A draft-ietf-tokbind-negotiation-07.xml M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- Merge branch 'master' into other-signaling Commit: 22851cd52266c76e205e57dddd9989e601f41427 https://github.com/TokenBinding/Internet-Drafts/commit/22851cd52266= c76e205e57dddd9989e601f41427 Author: balfanz Date: 2017-01-26 (Thu, 26 Jan 2017) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- Merge pull request #90 from b---c/other-signaling WGLC Jeff H had previously proposed this minor =E2=80=A6 Compare: https://github.com/TokenBinding/Internet-Drafts/compare/7070626e= 339a...22851cd52266= ----==_mimepart_588a46f652098_2a7f43f90c715113870020-- From nobody Thu Jan 26 11:16:34 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 950EA129994 for ; Thu, 26 Jan 2017 10:59:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.6 X-Spam-Level: X-Spam-Status: No, score=-3.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VVlejSCoDlwL for ; Thu, 26 Jan 2017 10:59:17 -0800 (PST) Received: from o11.sgmail.github.com (o11.sgmail.github.com [167.89.101.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 145CA129974 for ; Thu, 26 Jan 2017 10:59:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=VynjnlGjuTZevl8fMVOh4y6fSYc=; b=XJCq7XkECydnVzH1 hr0YGy+ACCJ5k00b2ByUubuoPpGmSbGZe4Dt/h/6sl2bPykTSVmDOG/k5wlV44IH r8sTOnnjQuzcmXH0NW3q1hTEu3sR2+wzwqobRW5oadSC5cx7rgSHpV9SOVql51/V JhZXs41nrMr17X2hvduSaOEtK2s= Received: by filter0570p1mdw1.sendgrid.net with SMTP id filter0570p1mdw1-21550-588A46F6-42 2017-01-26 18:59:02.390889198 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0004p1iad1.sendgrid.net (SG) with ESMTP id ByjxSQe5TBOgTdobVRWdjA for ; Thu, 26 Jan 2017 18:59:01.922 +0000 (UTC) Date: Thu, 26 Jan 2017 10:59:01 -0800 From: balfanz To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_588a46f5cb6d2_1a0d3fb76289113429272f"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: balfanz X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYq6BRcvJ5IiVvPEi851uTeNUwnqtS+ouxTNGv iQuBNo67Gue0pEgpssxrLIT5oTpFEwRHECUAkM32VX8e4cMKNcXMR5CNnoDCTgqg6AXZFy1OSRJbMw L/mX7a7PHI4ijM8pxCrgpvdQFEDHCWwwkpoUGD78+onbtMZrlDmy0paaYF7iQQawmvmmm1emSJggP6 U= Archived-At: X-Mailman-Approved-At: Thu, 26 Jan 2017 11:16:03 -0800 Cc: Subscribed Subject: Re: [Unbearable] =?utf-8?q?=5BTokenBinding/Internet-Drafts=5D_WGLC_Je?= =?utf-8?q?ff_H_had_previously_proposed_this_minor_=E2=80=A6_=28=2390=29?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 18:59:18 -0000 ----==_mimepart_588a46f5cb6d2_1a0d3fb76289113429272f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #90. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/90#event-938263440 ----==_mimepart_588a46f5cb6d2_1a0d3fb76289113429272f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #90.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_588a46f5cb6d2_1a0d3fb76289113429272f-- From nobody Thu Jan 26 11:16:38 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3633129996 for ; Thu, 26 Jan 2017 11:00:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.6 X-Spam-Level: X-Spam-Status: No, score=-3.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o3NTEd0poPge for ; Thu, 26 Jan 2017 11:00:02 -0800 (PST) Received: from o11.sgmail.github.com (o11.sgmail.github.com [167.89.101.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3938A129974 for ; Thu, 26 Jan 2017 11:00:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=h4X2ZdaP+ADqf7xs3Try2+1jaio=; b=jDha7NCeZ1EDodb3 dN+DC6FNg5D2ETUj/PCW+Nx+lBRs/he3uY+CcRxEvByR948Nb8zq48Wef8369cbB +kRU/lObHaahwd6BcB3n9sLhO5elpVMAATAYc8Fx/rGhBsEdH6AVa7o5kU/7nNg0 Txo/JKAWl9oJAxkR1+N0Dzk3a8k= Received: by filter1070p1mdw1.sendgrid.net with SMTP id filter1070p1mdw1-22457-588A4730-7E 2017-01-26 19:00:00.722235372 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0003p1iad1.sendgrid.net (SG) with ESMTP id S8-TZrlfTVGIigc8TKP1Vg for ; Thu, 26 Jan 2017 19:00:00.760 +0000 (UTC) Date: Thu, 26 Jan 2017 11:00:00 -0800 From: balfanz To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_588a473026b4e_38083fbc6b9dd13855661f"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: balfanz X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYrvDVZQJlT99W9IfAtyhGkYXusoFjNDSo5Ipe RXLIH0qZRTArvi5jCk7OgfUaub2LKh4lzsZJnTuKjIcVKMV88AYrUhJg29MlTXAY8DDRuHiJdTqIVS hfOy4EbiWwtHXnHlB3po6EAou1bNIecdeMPCw/N5lmqpAiM+c/4BtDt1gZNwKPxhZ29Kfrf3bbRfMF M= Archived-At: X-Mailman-Approved-At: Thu, 26 Jan 2017 11:16:03 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] OAuth is authorization protocol (#89) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 19:00:04 -0000 ----==_mimepart_588a473026b4e_38083fbc6b9dd13855661f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #89. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/89#event-938264921 ----==_mimepart_588a473026b4e_38083fbc6b9dd13855661f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #89.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_588a473026b4e_38083fbc6b9dd13855661f-- From nobody Thu Jan 26 11:16:42 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A56512996D for ; Thu, 26 Jan 2017 11:00:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=dirk=balfanz.net@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Au48L3rMzUek for ; Thu, 26 Jan 2017 11:00:03 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B02BD129995 for ; Thu, 26 Jan 2017 11:00:03 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1485457203; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=35gXL/eWqZ44Ai8CcUXiwZU7qkvlgvbWNKP0m2ehnQk=; b=bAAV4viTregda8Eq7wFAXEto3xrd/X+pKVw+rbeOcGhIXHTfcJUrv/7T+X1iZqbHfL0JXiyA vMtCYbDDOPKiao0VJAYY6nBj8atXXbYAJubJDeds+a+qhbO2970gbbhFVDfKfRzVhqkAf8+c ns+0VTObtQyPnX6/BVpneUNoFkg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=l35Qp8sTG+6mcKfgE9CHCGWhiQjAAuS080C1KjSG4HLUXb+ZSiSJZHFKHeMh/gvXWcLIBM W0Ta4JG8VSaWoUpOA+sBx5IpoOXbD5k528KMobIEeiCrmgOEcEGCK/DEShnN79YJq8rjRNMp JBZpmL/t/wnsw2J+HjE80abv9aLsQ= Sender: dirk=balfanz.net@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.40]) by mxa.mailgun.org with ESMTP id 588a4732.7f406809ecf0-smtp-out-n02; Thu, 26 Jan 2017 19:00:02 -0000 (UTC) Date: Thu, 26 Jan 2017 11:00:01 -0800 From: balfanz To: unbearable@ietf.org Message-ID: <588a4731e4d9_30103fcdd32c113c814c1@hookshot-fe6-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_588a4731deac_30103fcdd32c113c81341"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: X-Mailman-Approved-At: Thu, 26 Jan 2017 11:16:03 -0800 Subject: [Unbearable] [TokenBinding/Internet-Drafts] 0ccb5b: OAuth is authorization protocol and problems have ... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: balfanz List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 19:00:05 -0000 ----==_mimepart_588a4731deac_30103fcdd32c113c81341 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 0ccb5b97620f6328b2d3c33893583e982684c6f3 https://github.com/TokenBinding/Internet-Drafts/commit/0ccb5b97620f= 6328b2d3c33893583e982684c6f3 Author: Brian Campbell Date: 2016-12-19 (Mon, 19 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- OAuth is authorization protocol and problems have arisen from misusing = it for authentication (see https://oauth.net/articles/authentication/ for= example). While this is a bit of nit, I worry that wording like =E2=80=9C= ... to cryptographically bind authentication tokens (such as cookies and = OAuth tokens) to ..." in the HTTPSTB abstract might contribute to the mis= conception. This commit just adds "or authorization" to the sentence in t= he abstract. Commit: 17f0e80e9659e92fdaa8f57e8733ddc6dd8d2de0 https://github.com/TokenBinding/Internet-Drafts/commit/17f0e80e9659= e92fdaa8f57e8733ddc6dd8d2de0 Author: balfanz Date: 2017-01-26 (Thu, 26 Jan 2017) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- Merge pull request #89 from b---c/noauth OAuth is authorization protocol Compare: https://github.com/TokenBinding/Internet-Drafts/compare/22851cd5= 2266...17f0e80e9659= ----==_mimepart_588a4731deac_30103fcdd32c113c81341-- From nobody Thu Jan 26 11:18:12 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 775961299A8 for ; Thu, 26 Jan 2017 11:18:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.998 X-Spam-Level: X-Spam-Status: No, score=-0.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=balfanz=google.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fw3RDuBgB9yu for ; Thu, 26 Jan 2017 11:18:06 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B21F3129992 for ; Thu, 26 Jan 2017 11:18:06 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1485458286; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=elCKw1c6CErKRii1uJq9nAgJaiJ0fQGd8vHevoceTMo=; b=b8MlN8xUw6igK8YrwV8I61LwFR2YeYy4pgm1pmp55vQeL1/F/bPUoDEO15+5CeAgSjXPV5h+ tno8RfXZ3kCEWHiUPa6cm0Tbeey3HuvzxUPmX7ajPWPEhBu+x+IoJwDnnXwqcUVJhHlhOGHT YQHGoGeho1hT4nCx9X/2uAjJ1Pc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=OXAEpAapvZvc9DLj9RLKxvBaTFyVd1GvwZZETpyAXQ6zxF66Obsvs2DgqTpuSwtqdBQHs/ ujBm2aF1U7Enc8l8jKGF/YoJU6nFhxiecsbCpoK18rrWdtq0geW80K9YvCjH3iPlOxfxsH9a wiufQLrtxo8BGF0pOSKoh14xVFu1U= Sender: balfanz=google.com@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.40]) by mxa.mailgun.org with ESMTP id 588a4b6d.7f49b8679c00-smtp-out-n02; Thu, 26 Jan 2017 19:18:05 -0000 (UTC) Date: Thu, 26 Jan 2017 11:18:04 -0800 From: Dirk Balfanz To: unbearable@ietf.org Message-ID: <588a4b6c45f5a_26303fe80b64f1307532d@hookshot-fe6-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_588a4b6c45b70_26303fe80b64f1307525e"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 59de98: Fix reference. Closes #91. X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Dirk Balfanz List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 19:18:08 -0000 ----==_mimepart_588a4b6c45b70_26303fe80b64f1307525e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 59de987dc1ef935a9b6c956922749e1b6d1d5cb5 https://github.com/TokenBinding/Internet-Drafts/commit/59de987dc1ef935a9b6c956922749e1b6d1d5cb5 Author: Dirk Balfanz Date: 2017-01-26 (Thu, 26 Jan 2017) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- Fix reference. Closes #91. ----==_mimepart_588a4b6c45b70_26303fe80b64f1307525e-- From nobody Fri Jan 27 15:40:47 2017 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2725B129AB8 for ; Fri, 27 Jan 2017 15:40:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.557 X-Spam-Level: X-Spam-Status: No, score=-2.557 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.156, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nSXdN-qC_Md0 for ; Fri, 27 Jan 2017 15:40:41 -0800 (PST) Received: from gproxy1-pub.mail.unifiedlayer.com (gproxy1-pub.mail.unifiedlayer.com [69.89.25.95]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C100129A93 for ; Fri, 27 Jan 2017 15:40:41 -0800 (PST) Received: from CMOut01 (cmgw2 [10.0.90.82]) by gproxy1.mail.unifiedlayer.com (Postfix) with ESMTP id 0D136175AB1 for ; Fri, 27 Jan 2017 16:40:35 -0700 (MST) Received: from box514.bluehost.com ([74.220.219.114]) by CMOut01 with id dbgV1u01A2UhLwi01bgYhZ; Fri, 27 Jan 2017 16:40:33 -0700 X-Authority-Analysis: v=2.1 cv=H75InYoi c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=IgFoBzBjUZAA:10 a=48vgC7mUAAAA:8 a=jqDRajb7-9n0O1ncTjMA:9 a=QEXdDO2ut3YA:10 a=orGnALmuJsoA:10 a=Loiz2am82kgA:10 a=QRqwYXEsALEA:10 a=WiK120Dk7qUA:10 a=lYD0ki2b3jMA:10 a=mi_YozUutk0A:10 a=w1C3t2QeGrPiZgrLijVG:22 Received: from [173.224.162.69] (port=60386 helo=[10.225.80.103]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.87) (envelope-from ) id 1cXG87-0007hf-2J for unbearable@ietf.org; Fri, 27 Jan 2017 16:40:31 -0700 To: IETF TokBind WG From: =JeffH Message-ID: Date: Fri, 27 Jan 2017 15:40:26 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cXG87-0007hf-2J X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.103]) [173.224.162.69]:60386 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] HTTPSTB updates and respin WGLC X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Jan 2017 23:40:45 -0000 Dirk and I caught up yesterday wrt draft-ietf-tokbind-https aka HTTPSTB and we merged the outstanding PRs which closed 2 of the 4 remaining issues, creating draft-ietf-tokbind-https-08.xml. two issues remain.. HTTPSTB: TODO remains wrt specifying sec-token-binding header field behavior (#88) https://www.ietf.org/mail-archive/web/unbearable/current/msg01058.html HTTPSTB: TBPROTO: "token binding key" terminology ambiguity.. (#87) https://www.ietf.org/mail-archive/web/unbearable/current/msg01056.html ..and I'll be working on them (in HTTPSTB) over the next several days and we can merge them into -08, then it will be ready per the Chairs' request.. [Unbearable] respin WGLC https://www.ietf.org/mail-archive/web/unbearable/current/msg01115.html AFAIK, Andrei considers TBPROTO-12 & TBNEGO-07 "ready" (however, IMV issue #87 also applies to TBPROTO). =JeffH