From nobody Mon Apr 2 13:26:24 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C31CF12D892 for ; Mon, 2 Apr 2018 13:26:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dtoiAUi5avq9 for ; Mon, 2 Apr 2018 13:26:13 -0700 (PDT) Received: from mail-qk0-x236.google.com (mail-qk0-x236.google.com [IPv6:2607:f8b0:400d:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6BC4012D890 for ; Mon, 2 Apr 2018 13:26:13 -0700 (PDT) Received: by mail-qk0-x236.google.com with SMTP id o205so16372046qke.3 for ; Mon, 02 Apr 2018 13:26:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Qa4XekDVlg5P37HqInwzx964hqqCz48qo0IXi2XDUiQ=; b=D7ium78SbGQbrcvaJT9elgGFtkUWVL4ZHatw5uvTHSpP5Th5eViKecUO0Nr6c0BM8t YgLattHMutXbXJTJV18CXnFh+fiXFhjCmR1Cde+DNARf0asdT6xx8moiaVfG6Zyuqt2u ZDR9r9cODJQD5sMirriF2RvCz8Oo83mrKH4aTKj3WmRUviyjuyP/uvFGXLYxsNvj6+K+ JLOCJnVFi1iDcVKLoKrC7dTuq1Bn2chQUA293OiISwMfu4Dqp2ZumKUa311cDH/1k7Jc FaNbHiOzHDj3Ymg6HvnhfwYqWshG/4dvFALvGN8cyOJXFbip1Qx26Z15qUbYtbbpFVGu b2dg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Qa4XekDVlg5P37HqInwzx964hqqCz48qo0IXi2XDUiQ=; b=r95nX1zmvrAcmpuk9YPiTA+9XdJ15H4s/VMfvj5YeiyXTmNjt5qH7Tq3PWdo2NjqOD CC4W39Tz9DwfuyX6fXM5Z7r9tyNJ6ElMzveYlvztDdmzjQmbLkC5AsxWtRbfqt5hZ4id 7iGe0J6DB/m5KORtn6kEh14IDskWMUhITLFllQn0cxoVfElnhLSHE3Yl96nS+KjjDwzw t80xtGN5hOgMa40TGPYQIRQpkpsJEclPAmhfJsskeGTGKQ6FScSEZYFVQOSIVimZu1VR W0aFwVvhZ85Sj9SQiDZgY5IxDpWgIoTsjRvg8nzXc30iNowiCmBeFx47qKc8Du8TKa4E u4WA== X-Gm-Message-State: ALQs6tDxd3EM0MMfHb6udPjisamANzSF8xalv6/Hki2Qz6V95aJg14kc y3sv/hCWnrlLtcoY6oLcj+VRwVdaYQYGSRH6x93kDQ== X-Google-Smtp-Source: AIpwx4/YkTvaVYK3DctdJJ1vsDW7qhjMqWGG6A0Qcw9N4EwCe9KQyluKDfzdG3KmGoelVlBobmier2OznDYNNqB9wLE= X-Received: by 10.55.140.2 with SMTP id o2mr14959245qkd.298.1522700771952; Mon, 02 Apr 2018 13:26:11 -0700 (PDT) MIME-Version: 1.0 Received: by 10.200.56.97 with HTTP; Mon, 2 Apr 2018 13:25:51 -0700 (PDT) In-Reply-To: <7e489950-5f18-9ea8-5c49-d8e175a5606f@verizon.net> References: <7e489950-5f18-9ea8-5c49-d8e175a5606f@verizon.net> From: Nick Harper Date: Mon, 2 Apr 2018 13:25:51 -0700 Message-ID: To: Stephen Kent Cc: secdir@ietf.org, Leif Johansson , uta@ietf.org, IETF Tokbind WG , Eric Rescorla Content-Type: multipart/alternative; boundary="94eb2c06252a9d436c0568e366b5" Archived-At: Subject: Re: [Unbearable] SECDIR early review of draft-ietf-tokbind-tls13-00 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Apr 2018 20:26:17 -0000 --94eb2c06252a9d436c0568e366b5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Mar 22, 2018 at 8:00 AM, Stephen Kent wrote: > SECDIR *early* review of draft-ietf-tokbind-tls13-00 > > > > > > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the IESG. = These > comments were written with the intent of improving security requirements > and considerations in IETF drafts. Comments not addressed in last call > may be included in AD reviews during the IESG review. Document editors > and WG chairs should treat these comments just like any other last call > comments. > > > > This (very brief) document defines how to negotiate Token Binding for TLS > v1.3. Existing IETF documents (IDs) define this protocol and how to > negotiate it capability only for earlier versions of TLS. > > > > The first question that comes to mind is why there is a need for a new ID= , > instead of adding text to draft-ietf-tokbind-negotiation-10. I realize > that draft-ietf-tokbind-negotiation-10 is in last call, but the text here > is so small that it seems overkill to create a separate RFC. I=E2=80=99m = guessing > that the argument is that this document references TLS 1.3, which is not > yet an RFC, and thus the author is trying to avoid creating a down > reference problem with draft-ietf-tokbind-negotiation-10. Right? > That sounds right. My recollection of WG discussions on whether to add this TLS 1.3 language to draft-ietf-tokbind-negotiation was that it was unclear how the tokbind drafts would get sequenced with respect to draft-ietf-tls-tls13 in IETF last call and the RFC Editor's queue, and didn't want the tokbind drafts to get delayed waiting for draft-ietf-tls-tls13 to get published. > > > Section 2 notes that the format of the extension is the same as defined i= n > draft-ietf-tokbind-negotiation-10, so nothing new there. The section > cites two differences from the behavior in draft-ietf-tokbind-negotiation= -10, > which are described in just two sentences. Section 3 adds one paragraph t= o > deal with 0-RTT, a TLS 1.3 feature not present in earlier versions. Sect= ion > 4 is non-normative, but, presumably useful. The security concerns are > asserted to be the same as for draft-ietf-tokbind-negotiation-10, plus a > sentence discussing why the 0-RTT exclusion avoids other potential securi= ty > concerns. > > > > So, if folks don=E2=80=99t want to delay publication of draft-ietf-tokbin= d-negotiation-10, > I guess this is OK as a separate document, updating that RFC. > --94eb2c06252a9d436c0568e366b5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Thu, Mar 22, 2018 at 8:00 AM, Stephen Kent <stkent@verizon.net= > wrote:
=20 =20 =20

=20

SECDIR early review of draft-ietf-tokbind-tls13-00

=C2=A0

=C2=A0

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.=C2=A0 These comments were written with the intent of improving security requirements and considerations in IETF drafts.=C2=A0 Comments not addressed in last call may be included in AD reviews during the IESG review.=C2=A0 Document editors and WG chairs should treat these comments just like any other last call comments.

=C2=A0

This (very brief) document defines how to negotiate Token Binding for TLS v1.3. Existing IETF documents (IDs) define this protocol and how to negotiate it capability only for earlier versions of TLS.

=C2=A0

The first question that comes to mind is why there is a need for a new ID, instead of adding text to draft-ietf-tokbind-negotiation-10. I realize that draft-ietf-tokbind-negotiation-10 is in last call, but the text here is so small that it seems overkill to create a separate RFC. I=E2=80=99m guessing that the argument is that this document references TLS 1.3, which is not yet an RFC, and thus the author is trying to avoid creating a down reference problem with draft-ietf-tokbind-negotiation-10. Right?


That sounds right. My recollection of WG = discussions on whether to add this TLS 1.3 language to draft-ietf-tokbind-n= egotiation was that it was unclear how the tokbind drafts would get sequenc= ed with respect to draft-ietf-tls-tls13 in IETF last call and the RFC Edito= r's queue, and didn't want the tokbind drafts to get delayed waitin= g for draft-ietf-tls-tls13 to get published.=C2=A0

=C2=A0

Section 2 notes that the format of the extension is the same as defined in draft-ietf-tokbind-negotiation-10, so nothing new there. The section cites two differences from the behavior in draft-ietf-tokbind-negotiation-10, which are described in just two sentences. Section 3 adds one paragraph to deal with 0-RTT, a TLS 1.3 feature not present in earlier versions.=C2=A0 Section 4 is non-normative, but, presumably useful. The security concerns are asserted to be the same as for draft-ietf-tokbind-negotiation-10, plus a sentence discussing why the 0-RTT exclusion avoids other potential security concerns.

=C2=A0

So, if folks don=E2=80=99t want to delay publication of draft-ietf-tokbind-negotiation-10, I guess this is OK as a separate document, updating that RFC. =


--94eb2c06252a9d436c0568e366b5-- From nobody Mon Apr 2 23:19:15 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8124D12E038 for ; Mon, 2 Apr 2018 23:19:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EA1dR6uCgfuX for ; Mon, 2 Apr 2018 23:19:11 -0700 (PDT) Received: from mail-ot0-x236.google.com (mail-ot0-x236.google.com [IPv6:2607:f8b0:4003:c0f::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E600F12E03A for ; Mon, 2 Apr 2018 23:19:10 -0700 (PDT) Received: by mail-ot0-x236.google.com with SMTP id a14-v6so8561otf.6 for ; Mon, 02 Apr 2018 23:19:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=tRS/bLPtHtSE4kdz8yoqe46K1J+p8QdNQZ6/wC2tAPY=; b=GTfV3YFtj5MFpLQzfhIl/DlkDbAjnrPqytXbK+qOwwRdm++zypH5Ti3/htt4DA8+qe yvbh2/BozQoAkFeanR9x6r0naZdCOJQKloHUwb6phN2QlW0iSi7PkA+Mbw452C8go2yx RpPPCOWm4Vsfdn1Cmr8PxRP5wnctGu4FxkqWKjjjAKJSPDGv7F+ugfq66PWBGo2QS6aD WSMQGzJHrBI62olV/Ysyjly/jl/Xu3ks7OFp8l60InUVqB9he/DjD1tgoXbEOJ0+SfMA YLbCRQWt/5PPVnFWaZ1bBIe6Fz3WflEYKcDPUdiDn7VafE/dyZd3xsI3HN4JNy31sRKv rxWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=tRS/bLPtHtSE4kdz8yoqe46K1J+p8QdNQZ6/wC2tAPY=; b=Ld35hM4my6VOwf3MDUKE2Kz2bozw2Kp1ZYkVOqsG2F5Dy+klqDFCNVQv7AreRXXHwd upaeLqXjFWBxbJ1hrymWevsPmulrUThpglAIFmkktQWC7r3Iwb7i4RARhp1Oy8hSm1Qp r6feRaoT33GXqAmTUXJGeJvZ0obbqbAGx3VPxS0MJ06hTpoO8lcM8mcETGdF9CpU9Nyl Ow7b0b5VndkE7sA35o/5CEkoqyqQ99wIAGZPoJaU934wIG/sEAEq+Me1G3+KrZ7E4ctV 68mC/n/gBwybVg2ZUv8mA+zPX54fk4rA/+SUXDV3TKxdXY/vC7J2dMJ5fw0TeLonN47A NoSg== X-Gm-Message-State: ALQs6tBj55EFIh9Paol6nGIoMfH9CkzsmKHZczKbfqJ3L2J7H/GeC0LK HHCA2ejx9dH/8RI4KEpcWiwQYNC2saAdXMAgyV4= X-Google-Smtp-Source: AIpwx48A9XgPMYWq/qUZesWDkXWCfnHSjL424nvcP7n4FH8RbwLAXr0kFkLsGxrLtruWFls7WCabrE0Mk+Vbbgl0k7s= X-Received: by 2002:a9d:2a09:: with SMTP id t9-v6mr6948193ota.392.1522736350209; Mon, 02 Apr 2018 23:19:10 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a9d:ac7:0:0:0:0:0 with HTTP; Mon, 2 Apr 2018 23:19:09 -0700 (PDT) In-Reply-To: References: From: Martin Thomson Date: Tue, 3 Apr 2018 16:19:09 +1000 Message-ID: To: Nick Harper Cc: IETF Tokbind WG Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Unbearable] Sec-Token-Binding header and Vary X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Apr 2018 06:19:14 -0000 ...or say nothing. ...or observe that most resources that depend on token bindings will be marked Cache-Control: private. On Fri, Mar 30, 2018 at 8:20 AM, Nick Harper wrote: > The Vary HTTP header specifies a list of headers whose values must > match for a resource to be served from the cache. HTTPSTB specifies > that a server MAY list Sec-Token-Binding in a Vary response header. I > think this behavior is silly, and we should disallow Sec-Token-Binding > in Vary. > > The reason why this is silly is that the Sec-Token-Binding header's > value is dependent on the underlying connection, and it will be > different for requests on different connections. > > Consider a request to example.com for resource foo, sent with the > Sec-Token-Binding header, that gets a response with "Vary: > Sec-Token-Binding", and a browser caches this response. The browser > then visits some page that includes resource foo, so it goes to see if > it can use it from cache. (Assume arguendo that all other caching > properties are such that if there weren't this Vary header the > response would be served from cache.) There are two options now: > > 1) The browser has no connection open to example.com. Any attempted > request for resource foo would have a different Sec-Token-Binding > header (because it cannot possibly match the header of the request > sent on a different connection), so the resource cannot be loaded from > cache because the Sec-token-Binding header can't match. > 2) The browser does have a connection open to example.com. Now, the > browser needs to check that if it were to make a request to > example.com for foo, whether the Sec-Token-Binding header it would > generate matches - if so it can serve the response from cache; if not, > it needs to continue sending the request on the network. > > A main reason for caching responses is so that they can be served > without ever going to the network. This now requires binding a request > to a particular network connection before evaluating whether it can be > served from the cache, which seems backwards and somewhere between > annoying and impossible to implement. > > I suggest changing the "MAY" to "MUST NOT": Under "Additionally, the > Sec-Token-Binding header field:" where it says "MAY be listed by a > server in a Vary response header field", change this to a "MUST NOT". > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable From nobody Tue Apr 3 11:04:55 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EA0412D7F9 for ; Tue, 3 Apr 2018 11:04:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iJ0xIo96VKTV for ; Tue, 3 Apr 2018 11:04:51 -0700 (PDT) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 463AF120713 for ; Tue, 3 Apr 2018 11:04:51 -0700 (PDT) Received: by mail-qk0-x234.google.com with SMTP id w6so19601984qkb.4 for ; Tue, 03 Apr 2018 11:04:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=n1KhkAMz+GFhI7o/eP001fd8OBfD4ldceZm51P2ptLU=; b=OjdYyaTCTzNCd9fDw/74LWziWOdQSY9GS7iKYHVl/jNjcZ8ZzvC2g8SnSEZR31WKQt wFSNgUwajnqPlAJGQCZeGFlG6ARyFns6Zo+hqgJ2uVsHv+sBWzYpmrboR6hJ8VkxQ722 g08PRCEALsR6kxeykZMtgDF3f1mmx/tpKfb/zVbM6S5oiguc2y3m4K7GegtMCP6hGUhZ zXncv2c8teK4CvaoTZlEFJe+lEuCCu6pnkTqW4s1q27iMsEpppdbKKwum5doVw0/FgcX LwhtOZqjK/lQ/AX3U7COVGAUhFJRlpwmUy2Y0vNNyvzdQzOnTaV7tqRvY/a+/V50kVl3 674g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=n1KhkAMz+GFhI7o/eP001fd8OBfD4ldceZm51P2ptLU=; b=KbLKqvbtX4n7xounv05s8n7jtWVLmy7MngYiDSno7YPNfiPjFbzmQYMftEUtZp5z5A QIY7NGfMnce3KwQRDVu3zAXA4NW7saviweJKD75EKpzCsMY70SsEHjbzqrBFcgmNzNZI b3LyQjPeQBPwHB4OZ0+RlNSH23tRrMfpcXKkB85e4GK4FKnXqDfeKxr5ISzmdwQvdGLL t7m2NMzYWBx6psorhDr1N4Pz/hkvyYjQKP3ZKOPUmYPWs+Lw+aFYbQWET61IIC3PvPyH Bi4wYDRslmg9ATQylyEWdYuAfySQ7rA/nK6mlyN4LtlJqieSotq7jtjukg+QqME7RZLL 6/Cw== X-Gm-Message-State: ALQs6tDKvtrD6t4v5wr738Z4YBAnEXwVczF7zUySXUdMeLl76XGBMSin gnYlMSCiISz9/WwCHwbhsbegT/AG9g8FDoKpo7yb3w== X-Google-Smtp-Source: AIpwx4/j/N+Y7a/Nj3FHdSjieN8Hbyi0YqqVQgp9nOsbR/8jVfRrXwNdt3OX0ShYD7jmUu8Nv8fRVEu3yEF/U2EYUuA= X-Received: by 10.55.100.73 with SMTP id y70mr20194482qkb.293.1522778689659; Tue, 03 Apr 2018 11:04:49 -0700 (PDT) MIME-Version: 1.0 Received: by 10.200.56.97 with HTTP; Tue, 3 Apr 2018 11:04:29 -0700 (PDT) In-Reply-To: References: From: Nick Harper Date: Tue, 3 Apr 2018 11:04:29 -0700 Message-ID: To: Martin Thomson Cc: IETF Tokbind WG Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Unbearable] Sec-Token-Binding header and Vary X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Apr 2018 18:04:53 -0000 Sure, I think it's reasonable to assume that most resources depending on token bindings (or in response to a request with Sec-Token-Binding) would be marked Cache-Control: private, or at least not have Vary: Sec-Token-Binding, but even if that's the common case, spec-compliant implementations still need to handle Vary: Sec-Token-Binding (rare as it is) if that's something the spec allows. On Mon, Apr 2, 2018 at 11:19 PM, Martin Thomson wrote: > ...or say nothing. > > ...or observe that most resources that depend on token bindings will > be marked Cache-Control: private. > > On Fri, Mar 30, 2018 at 8:20 AM, Nick Harper wrote: >> The Vary HTTP header specifies a list of headers whose values must >> match for a resource to be served from the cache. HTTPSTB specifies >> that a server MAY list Sec-Token-Binding in a Vary response header. I >> think this behavior is silly, and we should disallow Sec-Token-Binding >> in Vary. >> >> The reason why this is silly is that the Sec-Token-Binding header's >> value is dependent on the underlying connection, and it will be >> different for requests on different connections. >> >> Consider a request to example.com for resource foo, sent with the >> Sec-Token-Binding header, that gets a response with "Vary: >> Sec-Token-Binding", and a browser caches this response. The browser >> then visits some page that includes resource foo, so it goes to see if >> it can use it from cache. (Assume arguendo that all other caching >> properties are such that if there weren't this Vary header the >> response would be served from cache.) There are two options now: >> >> 1) The browser has no connection open to example.com. Any attempted >> request for resource foo would have a different Sec-Token-Binding >> header (because it cannot possibly match the header of the request >> sent on a different connection), so the resource cannot be loaded from >> cache because the Sec-token-Binding header can't match. >> 2) The browser does have a connection open to example.com. Now, the >> browser needs to check that if it were to make a request to >> example.com for foo, whether the Sec-Token-Binding header it would >> generate matches - if so it can serve the response from cache; if not, >> it needs to continue sending the request on the network. >> >> A main reason for caching responses is so that they can be served >> without ever going to the network. This now requires binding a request >> to a particular network connection before evaluating whether it can be >> served from the cache, which seems backwards and somewhere between >> annoying and impossible to implement. >> >> I suggest changing the "MAY" to "MUST NOT": Under "Additionally, the >> Sec-Token-Binding header field:" where it says "MAY be listed by a >> server in a Vary response header field", change this to a "MUST NOT". >> >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable From nobody Tue Apr 3 23:47:56 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6CA612708C for ; Tue, 3 Apr 2018 23:47:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hjJV7P5Z2ZSJ for ; Tue, 3 Apr 2018 23:47:52 -0700 (PDT) Received: from mail-ot0-x22d.google.com (mail-ot0-x22d.google.com [IPv6:2607:f8b0:4003:c0f::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D1B4124B17 for ; Tue, 3 Apr 2018 23:47:52 -0700 (PDT) Received: by mail-ot0-x22d.google.com with SMTP id a14-v6so4018395otf.6 for ; Tue, 03 Apr 2018 23:47:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=pZclXENlc0ARDifgRTEnoFqg1jjZ3XnjEf0EARXB03k=; b=XnaU1LdblXCe/lTOMGuM/TUx6M3dtZs9WM5LPpQnNSqP65d3FoR7/wxbODLo0HE78Z UXvUPavP79KHTur5QqWWNaoUAjbiGM7lZ/aHtBYupK7DGbVLkTa+5iwN+GHOd6C3rBjb RPcRb52fpfjnJrKWZj/OnyKEDOi8gD101Hn5eX0Gr43BIgVtASFCr18rJRaK42Pelstk W6zR1M05BVQFGrRWKHlM5GBijTiP9U1OgJAGrB4bAryUK7QffAouMXEKR5lWxFCoyx6y usfSmaPt3NSU9aiOf2eqJTloWJhs+TLbVU0OjPEeJ9NS59J9LF5tHYp/Bw3KgIcz3P8M KkTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=pZclXENlc0ARDifgRTEnoFqg1jjZ3XnjEf0EARXB03k=; b=XssNjZpJ8fgt9b3F0IJ8nZohub/rbKzcqzDh2U7/Qim5SEWfw/DTUKY2zBU0R56SD3 iC6fAU7yOGmV8iO134sO12g8eQt+Nv8uHkZl7h6ntPkp2uiS106XWeb7jSdKB+MnWFSD VVpr2tGEA5JTeyVJts1FOlbAavboNyHeAv0A6ivxXTy7XI9g03j40YRFk5cCpHiQDcNA EStkmibAMmLi36YIkZyzeObjdfcDoj7QxNhFt00p/J6YpugeX94Kkarjnb726RvRgVm7 pSd3ZegcaUiz4WAfrdPd/3ID3HRDhx3dD37wNEC7ZKgz6v12XwoBP4z2iIbVWBNvjvE3 0Vqw== X-Gm-Message-State: ALQs6tCHaX+Sp8KhkLC35qJ7KYDmyZifzeDm8mke9UCEc7CwfLoYIOSY Jy31pnuhRdO8W9iys/TdSpzw4q6jPZbZcsj5GSg= X-Google-Smtp-Source: AIpwx4/du+rUBdG/QJdsD4evotXEnFVFgyKHD1rz8nRgU6JzCwwSfAulgRoZuQAIewS9+jOGjYW4ECDPyasTG6OpkrI= X-Received: by 2002:a9d:29ea:: with SMTP id g39-v6mr10441284otd.241.1522824471762; Tue, 03 Apr 2018 23:47:51 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a9d:ac7:0:0:0:0:0 with HTTP; Tue, 3 Apr 2018 23:47:51 -0700 (PDT) In-Reply-To: References: From: Martin Thomson Date: Wed, 4 Apr 2018 16:47:51 +1000 Message-ID: To: Nick Harper Cc: IETF Tokbind WG Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Unbearable] Sec-Token-Binding header and Vary X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Apr 2018 06:47:55 -0000 That doesn't require any more text than what is already in RFC 7234 though :) On Wed, Apr 4, 2018 at 4:04 AM, Nick Harper wrote: > Sure, I think it's reasonable to assume that most resources depending > on token bindings (or in response to a request with Sec-Token-Binding) > would be marked Cache-Control: private, or at least not have Vary: > Sec-Token-Binding, but even if that's the common case, spec-compliant > implementations still need to handle Vary: Sec-Token-Binding (rare as > it is) if that's something the spec allows. > > On Mon, Apr 2, 2018 at 11:19 PM, Martin Thomson > wrote: >> ...or say nothing. >> >> ...or observe that most resources that depend on token bindings will >> be marked Cache-Control: private. >> >> On Fri, Mar 30, 2018 at 8:20 AM, Nick Harper wrote: >>> The Vary HTTP header specifies a list of headers whose values must >>> match for a resource to be served from the cache. HTTPSTB specifies >>> that a server MAY list Sec-Token-Binding in a Vary response header. I >>> think this behavior is silly, and we should disallow Sec-Token-Binding >>> in Vary. >>> >>> The reason why this is silly is that the Sec-Token-Binding header's >>> value is dependent on the underlying connection, and it will be >>> different for requests on different connections. >>> >>> Consider a request to example.com for resource foo, sent with the >>> Sec-Token-Binding header, that gets a response with "Vary: >>> Sec-Token-Binding", and a browser caches this response. The browser >>> then visits some page that includes resource foo, so it goes to see if >>> it can use it from cache. (Assume arguendo that all other caching >>> properties are such that if there weren't this Vary header the >>> response would be served from cache.) There are two options now: >>> >>> 1) The browser has no connection open to example.com. Any attempted >>> request for resource foo would have a different Sec-Token-Binding >>> header (because it cannot possibly match the header of the request >>> sent on a different connection), so the resource cannot be loaded from >>> cache because the Sec-token-Binding header can't match. >>> 2) The browser does have a connection open to example.com. Now, the >>> browser needs to check that if it were to make a request to >>> example.com for foo, whether the Sec-Token-Binding header it would >>> generate matches - if so it can serve the response from cache; if not, >>> it needs to continue sending the request on the network. >>> >>> A main reason for caching responses is so that they can be served >>> without ever going to the network. This now requires binding a request >>> to a particular network connection before evaluating whether it can be >>> served from the cache, which seems backwards and somewhere between >>> annoying and impossible to implement. >>> >>> I suggest changing the "MAY" to "MUST NOT": Under "Additionally, the >>> Sec-Token-Binding header field:" where it says "MAY be listed by a >>> server in a Vary response header field", change this to a "MUST NOT". >>> >>> _______________________________________________ >>> Unbearable mailing list >>> Unbearable@ietf.org >>> https://www.ietf.org/mailman/listinfo/unbearable From nobody Wed Apr 4 14:54:18 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F761126FDC for ; Wed, 4 Apr 2018 14:54:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BgK-umq7ROtq for ; Wed, 4 Apr 2018 14:54:14 -0700 (PDT) Received: from mail-pl0-x229.google.com (mail-pl0-x229.google.com [IPv6:2607:f8b0:400e:c01::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D567D120454 for ; Wed, 4 Apr 2018 14:54:14 -0700 (PDT) Received: by mail-pl0-x229.google.com with SMTP id 91-v6so16075973pld.3 for ; Wed, 04 Apr 2018 14:54:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=nhZ5aYWqFx/xo8KRmCTIPXQlfR3yLrQs3WbPSEJa1Wo=; b=UBV0C6+mVO+oQrOghWcV66qI2rL6Qi6iKLGDy0wL4haNGaxI4b6WqAmzN0hKun5pSN FixQ9jDk49P3T+4+DmuX3rZf87Bve+2ykvzTPiM9a5JD/g9dqzHcip0YeCk2ejKPhBfs WafqEVYeXpQQCoStWKRjbrSogu+0drJFDub4U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=nhZ5aYWqFx/xo8KRmCTIPXQlfR3yLrQs3WbPSEJa1Wo=; b=NwmAvbBMncPwADiX1Ij2Rog1UIIpUdQSog7MgI2Rq+7YtDpZX106lHT5BEcCQKYuTf ekv2Lkwz7TLnXykQTJrQjqDEal2qBLPd147JXLxBMjJBtBPmqj/aRvjlU+GVWUGrkFcK pfAtZn6b1OR93eg8v7LySCr1MeqV7uc2jxdW5NVwYR0RLrXmN7WQBixXQiaWup8eg+xN B7nJyyfCXPJdQmSeQfXtpYAc9BN6j908Nq3DZvN/Krw+H9vBi23yp3zSu+HS8xO80ywd C9zLFa2ZmYHf48GVN5vckjLi5TT7rmgu9vg33RtkJcKlaZitChBAhMurmEQ3yjvEyYko oUFA== X-Gm-Message-State: AElRT7EhDsMQLXJe+gX/j1KbU3eLisk8ZeNeahJJCZJNmbxVqrFQ11I9 SR4ys6F55he/Xy3N9XOLWxZk/5baN3A= X-Google-Smtp-Source: AIpwx4/3xH3/9VLSd7MmjB6SyRwacHgavYutAB7yVLD8EyuZ/wCd7KJLHm1pynXPFLe4Bji9rP9SVA== X-Received: by 10.99.183.67 with SMTP id w3mr13112299pgt.153.1522878854319; Wed, 04 Apr 2018 14:54:14 -0700 (PDT) Received: from [5.5.33.147] (vpn.snozzages.com. [204.42.252.17]) by smtp.gmail.com with ESMTPSA id v8sm10915356pff.42.2018.04.04.14.54.11 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Apr 2018 14:54:13 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Message-Id: <30DE57CA-FCB3-43E7-9D28-012AA35CD8D3@sn3rd.com> Date: Wed, 4 Apr 2018 16:54:06 -0500 To: unbearable@ietf.org X-Mailer: Apple Mail (2.3445.6.18) Archived-At: Subject: [Unbearable] Additional IANA consideration for draft-ietf-tokbind-negotiation X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Apr 2018 21:54:17 -0000 Hi! In = https://datatracker.ietf.org/doc/draft-ietf-tls-iana-registry-updates/, = the TLS WG is adding a Recommended column to the extensions registry. = To get a =E2=80=9CYes=E2=80=9D the extension needs to be Standards = Track. This one is so to avoid a later surprise just add this to the = Value/Extension name/Reference list: Recommended: Yes spt= From nobody Wed Apr 4 15:59:19 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2F29127909 for ; Wed, 4 Apr 2018 15:59:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xtWslucLp3_f for ; Wed, 4 Apr 2018 15:59:15 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0114.outbound.protection.outlook.com [104.47.36.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2C5F126FB3 for ; Wed, 4 Apr 2018 15:59:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=pk1rmM3wcS4smFyi7N7lFMr1ghiB7ldBpnaca2fbcpI=; b=Bvqp1Wffer8VBZ+H9Kpnp+u3J9CRLLsVxtRFIpK8GEsTCqvujeO98TBVCDs5l+d238n0YIav9xiy8mq5BkFF6MYOOsNmyPOVlgQqRdp8WBqYJrHf4o843ebl6AJM8KDi/MuYk3AX7KPk+Vz6FVyhB8PxLAM2kN3XMmRaJLPS6Cg= Received: from DM5PR21MB0507.namprd21.prod.outlook.com (10.172.91.141) by DM5PR21MB0284.namprd21.prod.outlook.com (10.173.174.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.675.1; Wed, 4 Apr 2018 22:59:13 +0000 Received: from DM5PR21MB0507.namprd21.prod.outlook.com ([fe80::752b:7708:5b11:3be8]) by DM5PR21MB0507.namprd21.prod.outlook.com ([fe80::752b:7708:5b11:3be8%7]) with mapi id 15.20.0675.003; Wed, 4 Apr 2018 22:59:13 +0000 From: Andrei Popov To: Sean Turner , "unbearable@ietf.org" Thread-Topic: [Unbearable] Additional IANA consideration for draft-ietf-tokbind-negotiation Thread-Index: AQHTzF+BGwzHs7A6eE6NLWHWeJzCoKPxN2xQ Date: Wed, 4 Apr 2018 22:59:13 +0000 Message-ID: References: <30DE57CA-FCB3-43E7-9D28-012AA35CD8D3@sn3rd.com> In-Reply-To: <30DE57CA-FCB3-43E7-9D28-012AA35CD8D3@sn3rd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2001:4898:80e8:8::4ca] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR21MB0284; 7:ENhQLZEomximrqLjiDLnCeBZXtKpZGATCt4WScAy2HwJOQWMbBJy1W/7HKOS/XPmsQkcEDvqdSMcHl4ugYkmAaTj15Rpitw7xgpGcRN1TE6nH61jS9whc+24Zy1WiKMumSe0YD4e7eRLYb30lRpof5WcWEL/GW8KzOawvemQNkTuL1o5w8yb4VimTwU8vUwUEyVbss0WHiIUZLybafwggitdsI2Bcvn9kQtvP0AJ7d5N11+OpXrY81sxEgJ70exZ; 20:gDY9gVg/LU4Qguw560s8001wjy/LRlE8cO8TNZ84tpak4It4m3BohRonLjnfEAy1t43vmFgP1gl7PrdcPPpvI9GdmZOvZAwkVgIEhXt2sgOaUNRFTjSU00NiNmdmd9zzarh0enCGGqT9hhaJ9Ue0TSHxm05O2PXvyfR8nLC23sQ= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: e67d773c-b98d-4106-5eba-08d59a7faf52 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(3008032)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7193020); SRVR:DM5PR21MB0284; x-ms-traffictypediagnostic: DM5PR21MB0284: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(189930954265078)(219752817060721); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(61425038)(6040522)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(10201501046)(3231221)(944501327)(52105095)(6055026)(61426038)(61427038)(6041310)(20161123564045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123562045)(6072148)(201708071742011); SRVR:DM5PR21MB0284; BCL:0; PCL:0; RULEID:; SRVR:DM5PR21MB0284; x-forefront-prvs: 0632519F33 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39380400002)(346002)(376002)(366004)(39860400002)(396003)(51914003)(13464003)(199004)(189003)(8990500004)(6116002)(3660700001)(68736007)(2501003)(5250100002)(55016002)(53936002)(9686003)(10090500001)(6306002)(2906002)(106356001)(3280700002)(81166006)(11346002)(8676002)(86612001)(86362001)(476003)(486006)(97736004)(446003)(105586002)(10290500003)(229853002)(8936002)(25786009)(575784001)(81156014)(74316002)(305945005)(102836004)(53546011)(186003)(6506007)(99286004)(966005)(6246003)(6436002)(478600001)(2900100001)(7736002)(72206003)(76176011)(14454004)(59450400001)(5660300001)(7696005)(46003)(33656002)(316002)(110136005)(22452003); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR21MB0284; H:DM5PR21MB0507.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 4YOfKz6ud5v43cbghs9eEr098Vdrv6c7r21amEo9tGorBZtD4V8rJR24lbv0hmKiez2RG7BQXWtuNBtZCEvwYg8COq0CqQGV7wy0vYolVitRZ8Zu0FsC984Ktnmucxvf7oqQHcB0/7udjbgLXr8yAFszpNBbNWcGtRWsPms32c9JKBqSkB7rp99/xJKNxGs9Q5BY0YpttQr1kVdUjJM5ejxfRzmrJKvFZDIuOmwFpIgiDUiWFvv554FmKqqWiRFkfj/1JiMqhGUSbeMLkeZK1yQDIeoTSsgNWBogOSa4pWTd9xnDuobeKvn+qUE6V2+eo7ei2nvxZ+kl9E7SJJq1ZPcCh+mlXiq9X5w10vUjzqKZJzEBFpsATsYsarwQ72LySssFHVXkd9hQWLH/BYR7R6O53xOw/0c6QDLjjH+aumI= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: e67d773c-b98d-4106-5eba-08d59a7faf52 X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Apr 2018 22:59:13.4187 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR21MB0284 Archived-At: Subject: Re: [Unbearable] Additional IANA consideration for draft-ietf-tokbind-negotiation X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Apr 2018 22:59:18 -0000 VGhhbmtzIGZvciB0aGUgcmVtaW5kZXIsIFNlYW47IHdlJ2xsIHVwZGF0ZSBJQU5BIGNvbnNpZGVy YXRpb25zIHRvIHJlcXVlc3QgIlJlY29tbWVuZGVkOiBZZXMiIGFzIHdlIGFkZHJlc3Mgb3RoZXIg SUVTRyBmZWVkYmFjay4NCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0KLS0tLS1PcmlnaW5hbCBNZXNz YWdlLS0tLS0NCkZyb206IFVuYmVhcmFibGUgPHVuYmVhcmFibGUtYm91bmNlc0BpZXRmLm9yZz4g T24gQmVoYWxmIE9mIFNlYW4gVHVybmVyDQpTZW50OiBXZWRuZXNkYXksIEFwcmlsIDQsIDIwMTgg Mjo1NCBQTQ0KVG86IHVuYmVhcmFibGVAaWV0Zi5vcmcNClN1YmplY3Q6IFtVbmJlYXJhYmxlXSBB ZGRpdGlvbmFsIElBTkEgY29uc2lkZXJhdGlvbiBmb3IgZHJhZnQtaWV0Zi10b2tiaW5kLW5lZ290 aWF0aW9uDQoNCkhpISAgSW4gaHR0cHM6Ly9uYTAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxv b2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZkYXRhdHJhY2tlci5pZXRmLm9yZyUyRmRvYyUyRmRy YWZ0LWlldGYtdGxzLWlhbmEtcmVnaXN0cnktdXBkYXRlcyUyRiZkYXRhPTAyJTdDMDElN0NBbmRy ZWkuUG9wb3YlNDBtaWNyb3NvZnQuY29tJTdDZmExMTgxMTlkNDY0NGJjZDk5MWQwOGQ1OWE3Njlm NDglN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MxJTdDNjM2NTg0NzU2 NjI2MzQ4Nzk3JnNkYXRhPXdsWkFremt0OFBRdWRoaHhzUyUyQmJVVU5UJTJGMGFLOENFV3VjMUFH cklHcmtvJTNEJnJlc2VydmVkPTAsIHRoZSBUTFMgV0cgaXMgYWRkaW5nIGEgUmVjb21tZW5kZWQg Y29sdW1uIHRvIHRoZSBleHRlbnNpb25zIHJlZ2lzdHJ5LiAgVG8gZ2V0IGEg4oCcWWVz4oCdIHRo ZSBleHRlbnNpb24gbmVlZHMgdG8gYmUgU3RhbmRhcmRzIFRyYWNrLiAgVGhpcyBvbmUgaXMgc28g dG8gYXZvaWQgYSBsYXRlciBzdXJwcmlzZSBqdXN0IGFkZCB0aGlzIHRvIHRoZSBWYWx1ZS9FeHRl bnNpb24gbmFtZS9SZWZlcmVuY2UgbGlzdDoNCg0KICAgUmVjb21tZW5kZWQ6IFllcw0KDQpzcHQN Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpVbmJlYXJh YmxlIG1haWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBpZXRmLm9yZw0KaHR0cHM6Ly9uYTAxLnNhZmVs aW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5v cmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ1bmJlYXJhYmxlJmRhdGE9MDIlN0MwMSU3Q0FuZHJl aS5Qb3BvdiU0MG1pY3Jvc29mdC5jb20lN0NmYTExODExOWQ0NjQ0YmNkOTkxZDA4ZDU5YTc2OWY0 OCU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzElN0M2MzY1ODQ3NTY2 MjYzNDg3OTcmc2RhdGE9T01PUTNCS1klMkZLNTl1eUhDbjN5Q2N0SjJVUWlqS1cwT3AxdVJCb3Mx JTJGVFklM0QmcmVzZXJ2ZWQ9MA0K From nobody Wed Apr 11 18:34:40 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8331C1243F6 for ; Wed, 11 Apr 2018 18:34:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.66 X-Spam-Level: X-Spam-Status: No, score=-1.66 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JKh8UPibOuh3 for ; Wed, 11 Apr 2018 18:34:37 -0700 (PDT) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0668A120713 for ; Wed, 11 Apr 2018 18:34:36 -0700 (PDT) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1523496876; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=bcQmoobzRixUFMLaV7dFRyfyzBufqvJ9SPptrXy49Cs=; b=ThoF+qzdngMiSsg1WqEOzQnf2VdHawRcaznaLQJGXQgsFxnBAPLU/ii+qQLnBEnAOr7UtHLk gGelor9pDQPVPpSFHGOgOKMhU319NM7UMf8PwAO/Y6kfVWt9xm0YPvOX/gNzp4Ad6ZeitV+c sWG5q+3PGMFSHZfMHoRgWgCzKSI= X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd X-Mailgun-Sending-Ip: 166.78.69.169 Sender: andreipo=microsoft.com@github.com Received: from github.com (Unknown [192.30.252.44]) by mxa.mailgun.org with ESMTP id 5aceb7ab.7f4534354ba0-smtp-out-n02; Thu, 12 Apr 2018 01:34:35 -0000 (UTC) Date: Wed, 11 Apr 2018 18:34:34 -0700 From: Andrei Popov Reply-To: Andrei Popov To: unbearable@ietf.org Message-ID: <5aceb7aab2b71_c392ad977885c181529f@hookshot-fe-6e9b612.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5aceb7aab2783_c392ad977885c181517"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 203daa: Updating TBPROTO and TBNEGO to incorporate editori... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Apr 2018 01:34:38 -0000 ----==_mimepart_5aceb7aab2783_c392ad977885c181517 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 203daac68d1a21d328e018dac46dde95ca3536ad https://github.com/TokenBinding/Internet-Drafts/commit/203daac68d1a21d328e018dac46dde95ca3536ad Author: Andrei Popov Date: 2018-04-11 (Wed, 11 Apr 2018) Changed paths: M README.md R draft-ietf-tokbind-negotiation-10.xml A draft-ietf-tokbind-negotiation-11.xml R draft-ietf-tokbind-protocol-16.xml A draft-ietf-tokbind-protocol-17.xml Log Message: ----------- Updating TBPROTO and TBNEGO to incorporate editorial comments from ADs and IANA. ----==_mimepart_5aceb7aab2783_c392ad977885c181517-- From nobody Thu Apr 12 10:06:23 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1B86124E15 for ; Thu, 12 Apr 2018 10:06:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.66 X-Spam-Level: X-Spam-Status: No, score=-1.66 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MtU5O22MyZIT for ; Thu, 12 Apr 2018 10:06:19 -0700 (PDT) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DCE3127286 for ; Thu, 12 Apr 2018 10:06:19 -0700 (PDT) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1523552778; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=KwAX885QJWyO8qnzqySYrQUhuO+U5xScAUJM/edBakk=; b=OmRHT9K9Omaf9BCoFnXDW1BldPaALgjEsuMi8JuHx6tGnSkzdxg1ex0QigCfg8L/84wNUr4i BnAj4RZIruWISLiI1f4p9COPnhNas+Ly2BcweHFjji+QFemhk0dr4LY7yX+b6pG2oAy6CSKJ 1gFxVTGIseVbpOEZwVc0LWf+hmY= X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd X-Mailgun-Sending-Ip: 166.78.69.169 Sender: andreipo=microsoft.com@github.com Received: from github.com (Unknown [192.30.252.40]) by mxa.mailgun.org with ESMTP id 5acf9208.7f209c3850f0-smtp-out-n01; Thu, 12 Apr 2018 17:06:16 -0000 (UTC) Date: Thu, 12 Apr 2018 10:06:15 -0700 From: Andrei Popov Reply-To: Andrei Popov To: unbearable@ietf.org Message-ID: <5acf92073ddf5_7ef92ae48df19c0c197e5@hookshot-fe-d2afb11.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5acf92073da26_7ef92ae48df19c0c1964a"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 48a473: HTTPSTB-editorial: fix typo X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Apr 2018 17:06:22 -0000 ----==_mimepart_5acf92073da26_7ef92ae48df19c0c1964a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 48a4730d07a4df5a91cf39a320de693cc1ec4f37 https://github.com/TokenBinding/Internet-Drafts/commit/48a4730d07a4df5a91cf39a320de693cc1ec4f37 Author: Dave Longley Date: 2018-03-20 (Tue, 20 Mar 2018) Changed paths: M draft-ietf-tokbind-https-12.xml Log Message: ----------- HTTPSTB-editorial: fix typo Commit: 481018b89e9e8a58813cf83af60490c938fe50ee https://github.com/TokenBinding/Internet-Drafts/commit/481018b89e9e8a58813cf83af60490c938fe50ee Author: Andrei Popov Date: 2018-04-12 (Thu, 12 Apr 2018) Changed paths: M draft-ietf-tokbind-https-12.xml Log Message: ----------- Merge branch 'master' of https://github.com/dlongley/Internet-Drafts into dlongley-master Commit: d889ea814d9a4b32c7dfe3d217a0b59431282a35 https://github.com/TokenBinding/Internet-Drafts/commit/d889ea814d9a4b32c7dfe3d217a0b59431282a35 Author: Andrei Popov Date: 2018-04-12 (Thu, 12 Apr 2018) Changed paths: M draft-ietf-tokbind-https-12.xml Log Message: ----------- Merge branch 'dlongley-master' Compare: https://github.com/TokenBinding/Internet-Drafts/compare/203daac68d1a...d889ea814d9a ----==_mimepart_5acf92073da26_7ef92ae48df19c0c1964a-- From nobody Thu Apr 12 10:12:27 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC0B7127444 for ; Thu, 12 Apr 2018 10:12:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.66 X-Spam-Level: X-Spam-Status: No, score=-1.66 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OY1e5f1KM42l for ; Thu, 12 Apr 2018 10:12:23 -0700 (PDT) Received: from m71-131.mailgun.net (m71-131.mailgun.net [166.78.71.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88774127286 for ; Thu, 12 Apr 2018 10:12:23 -0700 (PDT) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1523553142; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=FAM2Y87NE8y4GFwOvTPmgVejy+EeIlc0h4jKtN1icAY=; b=c/VrtgwuN4uovzHJmEVBECuGym4fpXmjdeYV58hpk/lYcNbIvRc/StNcbYKr+xo2G/OqPSRy lxbgWgQrz1jxSr+bRJtlvpHIp99o1jVc0zL/aopCbsFhmgXOV2iLGNa2YRr0h/nf1LtTROec lqcP3lxPePrQM6YWupA1TxTdxA8= X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd X-Mailgun-Sending-Ip: 166.78.71.131 Sender: andreipo=microsoft.com@github.com Received: from github.com (Unknown [192.30.252.40]) by mxa.mailgun.org with ESMTP id 5acf9376.7f51d464b8a0-smtp-out-n03; Thu, 12 Apr 2018 17:12:22 -0000 (UTC) Date: Thu, 12 Apr 2018 10:12:22 -0700 From: Andrei Popov Reply-To: Andrei Popov To: unbearable@ietf.org Message-ID: <5acf93768117b_4cb2afbcc289c0c7717f@hookshot-fe-d2afb11.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5acf937680b5f_4cb2afbcc289c0c77057"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 0d07e0: Remove Nick Harper from acknowledgements in HTTPST... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Apr 2018 17:12:26 -0000 ----==_mimepart_5acf937680b5f_4cb2afbcc289c0c77057 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 0d07e00c8951eb28fffda4b57219c691db812e2e https://github.com/TokenBinding/Internet-Drafts/commit/0d07e00c8951eb28fffda4b57219c691db812e2e Author: Nick Harper Date: 2017-11-15 (Wed, 15 Nov 2017) Changed paths: M draft-ietf-tokbind-https-11.xml Log Message: ----------- Remove Nick Harper from acknowledgements in HTTPSTB Commit: 025b88e1c38365a118b73ee04629b03ee9abf955 https://github.com/TokenBinding/Internet-Drafts/commit/025b88e1c38365a118b73ee04629b03ee9abf955 Author: Andrei Popov Date: 2018-04-12 (Thu, 12 Apr 2018) Changed paths: M draft-ietf-tokbind-https-12.xml Log Message: ----------- Merge branch 'ack' of https://github.com/nharper/Internet-Drafts into nharper-ack Commit: 6c8a6832aa751dd12ed7b10eef0b91c8a93f7d20 https://github.com/TokenBinding/Internet-Drafts/commit/6c8a6832aa751dd12ed7b10eef0b91c8a93f7d20 Author: Andrei Popov Date: 2018-04-12 (Thu, 12 Apr 2018) Changed paths: M draft-ietf-tokbind-https-12.xml Log Message: ----------- Merge branch 'nharper-ack' Compare: https://github.com/TokenBinding/Internet-Drafts/compare/d889ea814d9a...6c8a6832aa75 ----==_mimepart_5acf937680b5f_4cb2afbcc289c0c77057-- From nobody Thu Apr 12 17:16:28 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65236127876 for ; Thu, 12 Apr 2018 17:16:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.66 X-Spam-Level: X-Spam-Status: No, score=-1.66 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZFJRPZd2lTM5 for ; Thu, 12 Apr 2018 17:16:25 -0700 (PDT) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11D301277BB for ; Thu, 12 Apr 2018 17:16:25 -0700 (PDT) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1523578584; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=JyfdZTAJ/pMHXG8kdgShJFceA9Me9VCRlwKU0Jq++UM=; b=GbHrIpkaWLqFkmUHQTuaUMFmyoCjsAGXrrCaKsAtfP3HCebSKNzAX8qzbqI+FC6brvABjOMa 6KXz5+CkJiK1DuWASHtbxbxlVlDeSeCAaj+CMhwydQqoV1EZ7+4AB32fhocg0ZL3GmY9zhP2 4Vwa7GMVflPJHwKcLp/QnX0tnXk= X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd X-Mailgun-Sending-Ip: 166.78.69.169 Sender: andreipo=microsoft.com@github.com Received: from github.com (Unknown [192.30.252.36]) by mxa.mailgun.org with ESMTP id 5acff6d7.7fe8dc4e6f60-smtp-out-n03; Fri, 13 Apr 2018 00:16:23 -0000 (UTC) Date: Thu, 12 Apr 2018 17:16:23 -0700 From: Andrei Popov Reply-To: Andrei Popov To: unbearable@ietf.org Message-ID: <5acff6d7c3e08_3bf52abf75b25c003338c@hookshot-fe-6b2eebc.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5acff6d7c36cb_3bf52abf75b25c0033220"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] eb1aac: Acknowledging tokbind chairs and ADs. X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Apr 2018 00:16:26 -0000 ----==_mimepart_5acff6d7c36cb_3bf52abf75b25c0033220 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/andrei-ack-chairs Home: https://github.com/TokenBinding/Internet-Drafts Commit: eb1aac1063b179f3c3d2dd60f1b509f959846c3e https://github.com/TokenBinding/Internet-Drafts/commit/eb1aac1063b179f3c3d2dd60f1b509f959846c3e Author: Andrei Popov Date: 2018-04-12 (Thu, 12 Apr 2018) Changed paths: M README.md R draft-ietf-tokbind-https-12.xml A draft-ietf-tokbind-https-13.xml M draft-ietf-tokbind-negotiation-11.xml M draft-ietf-tokbind-protocol-17.xml Log Message: ----------- Acknowledging tokbind chairs and ADs. ----==_mimepart_5acff6d7c36cb_3bf52abf75b25c0033220-- From nobody Fri Apr 13 08:53:34 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E18A8127419 for ; Thu, 12 Apr 2018 10:06:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.391 X-Spam-Level: X-Spam-Status: No, score=-1.391 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RvZ6SNKCLADl for ; Thu, 12 Apr 2018 10:06:18 -0700 (PDT) Received: from o3.sgmail.github.com (o3.sgmail.github.com [192.254.112.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FC39124E15 for ; Thu, 12 Apr 2018 10:06:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=5mwu/rkrz4GnP0DCBu33V6v5wbU=; b=nppHn0Ic93rfypfb YO32w8YWIL7l3FlsDavZJpdIE0juqRo2a+4etFI8QMbM+umPXcO0TZzcKuyd73Eu OivGxUcSrLv8REMZD8cmcbBgdy+/Avv+YIDAWfcIznJAOqyWPgyO9vqx2Wlq7keU r8DMH6/WQWe6IyVTByT2LHHeXK4= Received: by filter0994p1mdw1.sendgrid.net with SMTP id filter0994p1mdw1-13551-5ACF9208-2E 2018-04-12 17:06:16.908394121 +0000 UTC Received: from smtp.github.com (out-5.smtp.github.com [192.30.252.196]) by ismtpd0037p1mdw1.sendgrid.net (SG) with ESMTP id o8JIP6lRR5WkpFFysudG8w for ; Thu, 12 Apr 2018 17:06:16.860 +0000 (UTC) Date: Thu, 12 Apr 2018 17:06:17 +0000 (UTC) From: Andrei-Popov Reply-To: TokenBinding/Internet-Drafts To: TokenBinding/Internet-Drafts Cc: Subscribed Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5acf92089e4fa_4e2b2ad75733eed41004d1"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYoq55YJsYpI0gMEygUltt/jQXUbeNR/wDHgpC we1lZSqE/ciV6QoL8Api6Dlg9Q+lqaOntXm81netilQg4oJvw19oqkyvMDPy6hD+pOoJJvf44o771H XGMWJnq1kZYUTmC8Y5DTIkJATRSBl+olRMg6zQ0cZbfXJ1kNrfHOkiJ85mPZ4uC/Eh6HV5GpiyHuTG U= Archived-At: X-Mailman-Approved-At: Fri, 13 Apr 2018 08:53:32 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB-editorial: fix typo (#102) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Apr 2018 17:06:21 -0000 ----==_mimepart_5acf92089e4fa_4e2b2ad75733eed41004d1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #102. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/102#event-1571508670 ----==_mimepart_5acf92089e4fa_4e2b2ad75733eed41004d1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #102.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5acf92089e4fa_4e2b2ad75733eed41004d1-- From nobody Fri Apr 13 08:53:39 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF8C9127444 for ; Thu, 12 Apr 2018 10:06:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.463 X-Spam-Level: X-Spam-Status: No, score=-1.463 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9POUqNPvO1hs for ; Thu, 12 Apr 2018 10:06:43 -0700 (PDT) Received: from o5.sgmail.github.com (o5.sgmail.github.com [192.254.113.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 749F7127286 for ; Thu, 12 Apr 2018 10:06:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=ZwlmeO510Hj2m0R4/O/zhAcyKAY=; b=b8y2tECyfyNtDSW8 DgIdHB/KF126siZ6lW6MQk2sE8fIo7s/0zrfAdzsCwLus5trWsHAg1rMOzavtxw3 UyjWFkoghswzL5141zJmDSU4iccpQAMoovhpoawNKxAbbLYEmn50NM9G2k2wCRwN pqwvv1gIuFY+UYpG00YThDMDdic= Received: by filter0190p1las1.sendgrid.net with SMTP id filter0190p1las1-10033-5ACF9222-6 2018-04-12 17:06:42.281146409 +0000 UTC Received: from smtp.github.com (out-1.smtp.github.com [192.30.252.192]) by ismtpd0008p1iad1.sendgrid.net (SG) with ESMTP id ivIIvzBjRhWBcPB9fbvZ0g for ; Thu, 12 Apr 2018 17:06:42.084 +0000 (UTC) Date: Thu, 12 Apr 2018 17:06:42 +0000 (UTC) From: Andrei-Popov Reply-To: TokenBinding/Internet-Drafts To: TokenBinding/Internet-Drafts Cc: Subscribed Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5acf922222bd_42143f9e97d66f30869f3"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYplTu4LNOomIipY+Ymk5Q65MmzPFK9eHzHgjp 93m51ysnDmwKDvSLip+eoWuUDVvG6cbVocVP3Qp1/mbfBLRDLka7EH+akQNxQgE+5Engtjommb+Uxm BE/CexZS+RO5eGRqVplkcqMlRHAYJ87oDWpcg90/JN1heJVPT7UN3KZzLiDRCzQ4WIXpkR108l7sy+ c= Archived-At: X-Mailman-Approved-At: Fri, 13 Apr 2018 08:53:32 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB-editorial: fix typo (#102) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Apr 2018 17:06:47 -0000 ----==_mimepart_5acf922222bd_42143f9e97d66f30869f3 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged, thanks! -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/102#issuecomment-380877544 ----==_mimepart_5acf922222bd_42143f9e97d66f30869f3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged, thanks!

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5acf922222bd_42143f9e97d66f30869f3-- From nobody Fri Apr 13 08:53:43 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46926127286 for ; Thu, 12 Apr 2018 10:12:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.391 X-Spam-Level: X-Spam-Status: No, score=-1.391 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LLqw6ISCnCUA for ; Thu, 12 Apr 2018 10:12:24 -0700 (PDT) Received: from o10.sgmail.github.com (o10.sgmail.github.com [167.89.101.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C84D8127419 for ; Thu, 12 Apr 2018 10:12:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=/ZEnFTI9lXA5D/OvYnGwtoqvK/A=; b=IxPtHyFrOXBrQ5pd t6zLr97kBH6zTjDREqBeTJ6jyN62vbRnscJNwP4zl8S0QjTDGz0IJiqL5iFu49S1 +l4uhhcG9SuYknIwoLmvDeKRaYTX+4lpq+pVSfq8SCHiDUJ8PEqFGcgwZI8EDgX6 IQtEOznhD1XN4d+B2kJ63PG70KM= Received: by filter1249p1mdw1.sendgrid.net with SMTP id filter1249p1mdw1-9904-5ACF9378-F 2018-04-12 17:12:24.180244436 +0000 UTC Received: from smtp.github.com (out-2.smtp.github.com [192.30.252.193]) by ismtpd0010p1iad2.sendgrid.net (SG) with ESMTP id xjpcPNCwT928a535Zl806A for ; Thu, 12 Apr 2018 17:12:24.145 +0000 (UTC) Date: Thu, 12 Apr 2018 17:12:24 +0000 (UTC) From: Andrei-Popov Reply-To: TokenBinding/Internet-Drafts To: TokenBinding/Internet-Drafts Cc: Subscribed Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5acf93787b46_6c732ae87aed0ed01917ba"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYqZrUa6FWHRF1YPxwc4v+JNDssspWVW2oJaYI RKSQ3NOq2IjffC9C+o6rpcdKeTXy+cV6ISbMQ5GpBYFu+X+jYMxYHmhLNJa28RvcLid1DjLWrqDEZV 4WBcyQ3iFVKQALxdCufc5TImPCu+qWekwLvwhRTO5/nYF8IDQjRyGc4adD7+RokoptKp6cYmeK9qh6 4= Archived-At: X-Mailman-Approved-At: Fri, 13 Apr 2018 08:53:32 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Remove Nick Harper from acknowledgements in HTTPSTB (#99) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Apr 2018 17:12:26 -0000 ----==_mimepart_5acf93787b46_6c732ae87aed0ed01917ba Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #99. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/99#event-1571520560 ----==_mimepart_5acf93787b46_6c732ae87aed0ed01917ba Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #99.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5acf93787b46_6c732ae87aed0ed01917ba-- From nobody Fri Apr 13 08:53:46 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4226E1277BB for ; Thu, 12 Apr 2018 17:43:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.008 X-Spam-Level: X-Spam-Status: No, score=-3.008 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8zxZ60U4iC0n for ; Thu, 12 Apr 2018 17:43:53 -0700 (PDT) Received: from o3.sgmail.github.com (o3.sgmail.github.com [192.254.112.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D07A126D3F for ; Thu, 12 Apr 2018 17:43:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=W8qdJh+7QShs7ED4qwC8HFJaKxo=; b=qMCrGFue0Uo7OeE6 mMbRjB3PHGwuehg+d74FDTSGrNnk/S4Hm3koCxCu1jD/Y+v7BFiDnB+n8S47lwrT 738tMOfyotXZAX/kbVY+cvegiJCkiYLBMtxFRFDv9onm91vXC2ueBuf3Ig1qepWz +j5HPtdUUCxVPgNZ0rqOWJwbEE4= Received: by filter0843p1mdw1.sendgrid.net with SMTP id filter0843p1mdw1-3488-5ACFFD48-20 2018-04-13 00:43:52.361717367 +0000 UTC Received: from smtp.github.com (out-1.smtp.github.com [192.30.252.192]) by ismtpd0027p1mdw1.sendgrid.net (SG) with ESMTP id T97PGzpwQiudu5t1g15Gpw for ; Fri, 13 Apr 2018 00:43:52.413 +0000 (UTC) Date: Fri, 13 Apr 2018 00:43:52 +0000 (UTC) From: Andrei-Popov Reply-To: TokenBinding/Internet-Drafts To: TokenBinding/Internet-Drafts Cc: Subscribed Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5acffd48367fc_230843f86d5f7cf3841862"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYpF4VODyA76mQ1hqQ9SK50wue4C6VnsbkLzyu e6VsfbqnKzXd+XPeBc0TWBRaVnGhaIm1QCaRbvI01MVz2AdA/LzR8qL35yBqdNQMKfv+DLcJUuN4IW ataPzMcsJu9bTANQFHKgSJ9v3lQMPReffrD/gZhWYTgX3xkqVfR+vdUxo4/8QbN+e25J1Kk2GXWIr2 8= Archived-At: X-Mailman-Approved-At: Fri, 13 Apr 2018 08:53:32 -0700 Subject: [Unbearable] [TokenBinding/Internet-Drafts] Acknowledging tokbind chairs and ADs. (#103) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Apr 2018 00:43:55 -0000 ----==_mimepart_5acffd48367fc_230843f86d5f7cf3841862 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit You can view, comment on, or merge this pull request online at: https://github.com/TokenBinding/Internet-Drafts/pull/103 -- Commit Summary -- * Acknowledging tokbind chairs and ADs. -- File Changes -- M README.md (2) R draft-ietf-tokbind-https-13.xml (5) M draft-ietf-tokbind-negotiation-11.xml (3) M draft-ietf-tokbind-protocol-17.xml (3) -- Patch Links -- https://github.com/TokenBinding/Internet-Drafts/pull/103.patch https://github.com/TokenBinding/Internet-Drafts/pull/103.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/103 ----==_mimepart_5acffd48367fc_230843f86d5f7cf3841862 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

You can view, comment on, or merge this pull request online at:

  https://github.com/TokenBinding/Internet-Drafts/pull/103

Commit Summary

  • Acknowledging tokbind chairs and ADs.

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5acffd48367fc_230843f86d5f7cf3841862-- From nobody Fri Apr 13 08:53:51 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEDE2126D3F for ; Thu, 12 Apr 2018 17:44:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.391 X-Spam-Level: X-Spam-Status: No, score=-1.391 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1KYmauh8zikT for ; Thu, 12 Apr 2018 17:44:06 -0700 (PDT) Received: from o8.sgmail.github.com (o8.sgmail.github.com [167.89.101.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5BCE01277BB for ; Thu, 12 Apr 2018 17:44:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=s3YUWcNhDcG0/eM+3EYhFbHQY3g=; b=Ss66ONvf3j+thzJb YF2X0ZWtIUI6gwNBXiaB4N1sMh9t5c3UzfLROmHdMkOq4pztk/IvMafh2Xc0c1nW j8z03OBkYIk/AHN373XN3YfJKa005HsS2tlskvGJ+ZnJ8KcvX10gcWJtNcVj80/A vDTWZoj4SYN6/6e4+qnSnUVTCBo= Received: by filter0858p1mdw1.sendgrid.net with SMTP id filter0858p1mdw1-30283-5ACFFD55-8 2018-04-13 00:44:05.220058025 +0000 UTC Received: from smtp.github.com (out-1.smtp.github.com [192.30.252.192]) by ismtpd0024p1iad2.sendgrid.net (SG) with ESMTP id usa0UEq8Tji6WQAQJAd6Sg for ; Fri, 13 Apr 2018 00:44:05.263 +0000 (UTC) Date: Fri, 13 Apr 2018 00:44:05 +0000 (UTC) From: Andrei-Popov Reply-To: TokenBinding/Internet-Drafts To: TokenBinding/Internet-Drafts Cc: Subscribed Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5acffd551a8cf_73373fb806ad8f385643"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYp5TwrRF4vE7ryBYy3UCzzl6Mq1smpgWbEuqd N72V985sA+edkvissDlTO8uRYdxZithyr4+gM7l8+FZW/lk9NG1zt9wLMTqrEdvWLHp8stlVpXA4WT 6eAd1ofveMjmlPDzYIRTJiigvnfe00b/VhLtOUugp1erYzH6g9GUbQxUFb1vjRxbYp+4lU+8bC1env s= Archived-At: X-Mailman-Approved-At: Fri, 13 Apr 2018 08:53:32 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] Acknowledging tokbind chairs and ADs. (#103) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Apr 2018 00:44:08 -0000 ----==_mimepart_5acffd551a8cf_73373fb806ad8f385643 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #103. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/103#event-1572239820 ----==_mimepart_5acffd551a8cf_73373fb806ad8f385643 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #103.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5acffd551a8cf_73373fb806ad8f385643-- From nobody Fri Apr 13 08:54:36 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87DF11277BB for ; Thu, 12 Apr 2018 17:03:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.863 X-Spam-Level: * X-Spam-Status: No, score=1.863 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_ADSP_NXDOMAIN=0.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, TVD_SPACE_RATIO=0.001, TVD_SPACE_RATIO_MINFP=1.472, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xZnwyQUrx52d for ; Thu, 12 Apr 2018 17:03:08 -0700 (PDT) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6269124D6C for ; Thu, 12 Apr 2018 17:03:07 -0700 (PDT) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1523577787; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=cB/ajjiVWUtbUROI91Hxj/aFSKqsmAFxhzmW4c8U5XU=; b=lJcJuhxvkXHc14U8yy3R6TOmk+vEUf53dKZUsNjrY9w4lXqKIlVvyZAxERAKQyO71NuH6jUp 31fd72oalEtaM7ZLPYs8JTA8apIUxhJ94QFsi8JtBHFrzYsMPP61Tv3hQXqdhKa6Tb8z70fc pRO3V3kcT2fjF9U4OOSgZaLZG7k= X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd X-Mailgun-Sending-Ip: 166.78.69.169 Sender: Andrei-Popov=users.noreply.github.com@github.com Received: from github.com (Unknown [192.30.252.36]) by mxa.mailgun.org with ESMTP id 5acff3bb.7f68b07980f0-smtp-out-n03; Fri, 13 Apr 2018 00:03:07 -0000 (UTC) Date: Thu, 12 Apr 2018 17:03:06 -0700 From: Andrei-Popov Reply-To: Andrei-Popov To: unbearable@ietf.org Message-ID: <5acff3ba5a48_18362ad603c83c103819f@hookshot-fe-cace476.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5acff3ba560c_18362ad603c83c103801b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: X-Mailman-Approved-At: Fri, 13 Apr 2018 08:54:35 -0700 Subject: [Unbearable] [TokenBinding/Internet-Drafts] X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Apr 2018 00:03:09 -0000 ----==_mimepart_5acff3ba560c_18362ad603c83c103801b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/andrei-ack-chairs Home: https://github.com/TokenBinding/Internet-Drafts ----==_mimepart_5acff3ba560c_18362ad603c83c103801b-- From nobody Fri Apr 13 08:54:42 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8ECB812895E for ; Thu, 12 Apr 2018 17:44:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.01 X-Spam-Level: X-Spam-Status: No, score=-1.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_NXDOMAIN=0.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9A8LMeohSzU8 for ; Thu, 12 Apr 2018 17:44:06 -0700 (PDT) Received: from m71-131.mailgun.net (m71-131.mailgun.net [166.78.71.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7C4D126D3F for ; Thu, 12 Apr 2018 17:44:05 -0700 (PDT) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1523580245; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=OYdVZE5KWcx5KK+ty32mRrzuQ62Jz9OCVSKdW7BI/iE=; b=CtjgLeQp9hbcVOaJqOXwsTGoYf5d2qcoP+8rXeb9BJPPuryjoDkjL3dPdGgGJzy2wadQ3BTx DKOMh2XIW0KOCVEDwU14hD3FSmeD8tPtG0NZpbu/K9UHg1lyaLauyKYiAE+P/4hZoJ2/9Frs Z85pjQDdTmP61Df6EDyKWyKGuvw= X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd X-Mailgun-Sending-Ip: 166.78.71.131 Sender: Andrei-Popov=users.noreply.github.com@github.com Received: from github.com (Unknown [192.30.252.38]) by mxa.mailgun.org with ESMTP id 5acffd54.7fa134aa9870-smtp-out-n01; Fri, 13 Apr 2018 00:44:04 -0000 (UTC) Date: Thu, 12 Apr 2018 17:44:04 -0700 From: Andrei-Popov Reply-To: Andrei-Popov To: unbearable@ietf.org Message-ID: <5acffd54c4260_1fec2ae04d2f5c08483f4@hookshot-fe-265448d.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5acffd54c3aa8_1fec2ae04d2f5c08482ab"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: X-Mailman-Approved-At: Fri, 13 Apr 2018 08:54:35 -0700 Subject: [Unbearable] [TokenBinding/Internet-Drafts] eb1aac: Acknowledging tokbind chairs and ADs. X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Apr 2018 00:44:07 -0000 ----==_mimepart_5acffd54c3aa8_1fec2ae04d2f5c08482ab Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: eb1aac1063b179f3c3d2dd60f1b509f959846c3e https://github.com/TokenBinding/Internet-Drafts/commit/eb1aac1063b179f3c3d2dd60f1b509f959846c3e Author: Andrei Popov Date: 2018-04-12 (Thu, 12 Apr 2018) Changed paths: M README.md R draft-ietf-tokbind-https-12.xml A draft-ietf-tokbind-https-13.xml M draft-ietf-tokbind-negotiation-11.xml M draft-ietf-tokbind-protocol-17.xml Log Message: ----------- Acknowledging tokbind chairs and ADs. Commit: 10c313a5b3b1de0f60592f336bf8f1b6279a6f00 https://github.com/TokenBinding/Internet-Drafts/commit/10c313a5b3b1de0f60592f336bf8f1b6279a6f00 Author: Andrei-Popov Date: 2018-04-12 (Thu, 12 Apr 2018) Changed paths: M README.md R draft-ietf-tokbind-https-12.xml A draft-ietf-tokbind-https-13.xml M draft-ietf-tokbind-negotiation-11.xml M draft-ietf-tokbind-protocol-17.xml Log Message: ----------- Merge pull request #103 from TokenBinding/andrei-ack-chairs Acknowledging tokbind chairs and ADs. Compare: https://github.com/TokenBinding/Internet-Drafts/compare/6c8a6832aa75...10c313a5b3b1 ----==_mimepart_5acffd54c3aa8_1fec2ae04d2f5c08482ab-- From nobody Fri Apr 13 09:43:41 2018 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CAE012785F; Fri, 13 Apr 2018 09:43:34 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: Cc: unbearable@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.78.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152363781451.5573.3285319320861839787@ietfa.amsl.com> Date: Fri, 13 Apr 2018 09:43:34 -0700 Archived-At: Subject: [Unbearable] I-D Action: draft-ietf-tokbind-negotiation-11.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Apr 2018 16:43:35 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding WG of the IETF. Title : Transport Layer Security (TLS) Extension for Token Binding Protocol Negotiation Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Filename : draft-ietf-tokbind-negotiation-11.txt Pages : 8 Date : 2018-04-13 Abstract: This document specifies a Transport Layer Security (TLS) extension for the negotiation of Token Binding protocol version and key parameters. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-negotiation/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-11 https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-negotiation-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-negotiation-11 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Apr 13 09:46:41 2018 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DFE3812751F; Fri, 13 Apr 2018 09:46:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: Cc: unbearable@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.78.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152363799588.5590.6925436938378308551@ietfa.amsl.com> Date: Fri, 13 Apr 2018 09:46:35 -0700 Archived-At: Subject: [Unbearable] I-D Action: draft-ietf-tokbind-protocol-17.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Apr 2018 16:46:36 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding WG of the IETF. Title : The Token Binding Protocol Version 1.0 Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Jeff Hodges Filename : draft-ietf-tokbind-protocol-17.txt Pages : 18 Date : 2018-04-13 Abstract: This document specifies Version 1.0 of the Token Binding protocol. The Token Binding protocol allows client/server applications to create long-lived, uniquely identifiable TLS bindings spanning multiple TLS sessions and connections. Applications are then enabled to cryptographically bind security tokens to the TLS layer, preventing token export and replay attacks. To protect privacy, the Token Binding identifiers are only conveyed over TLS and can be reset by the user at any time. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tokbind-protocol-17 https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-protocol-17 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-protocol-17 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Apr 13 09:55:08 2018 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 71097127522; Fri, 13 Apr 2018 09:55:07 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: Cc: unbearable@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.78.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152363850742.5436.52379182259619814@ietfa.amsl.com> Date: Fri, 13 Apr 2018 09:55:07 -0700 Archived-At: Subject: [Unbearable] I-D Action: draft-ietf-tokbind-https-13.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Apr 2018 16:55:07 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding WG of the IETF. Title : Token Binding over HTTP Authors : Andrei Popov Magnus Nyström Dirk Balfanz Adam Langley Nick Harper Jeff Hodges Filename : draft-ietf-tokbind-https-13.txt Pages : 25 Date : 2018-04-13 Abstract: This document describes a collection of mechanisms that allow HTTP servers to cryptographically bind security tokens (such as cookies and OAuth tokens) to TLS connections. We describe both first-party and federated scenarios. In a first- party scenario, an HTTP server is able to cryptographically bind the security tokens it issues to a client, and which the client subsequently returns to the server, to the TLS connection between the client and server. Such bound security tokens are protected from misuse since the server can generally detect if they are replayed inappropriately, e.g., over other TLS connections. Federated token bindings, on the other hand, allow servers to cryptographically bind security tokens to a TLS connection that the client has with a different server than the one issuing the token. This Internet-Draft is a companion document to The Token Binding Protocol. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-https/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tokbind-https-13 https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-https-13 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-https-13 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Apr 13 10:11:42 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 345F6127369 for ; Fri, 13 Apr 2018 10:11:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.862 X-Spam-Level: * X-Spam-Status: No, score=1.862 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_ADSP_NXDOMAIN=0.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, TVD_SPACE_RATIO=0.001, TVD_SPACE_RATIO_MINFP=1.472, T_DKIMWL_WL_HIGH=-0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CklctB4L5imW for ; Fri, 13 Apr 2018 10:11:38 -0700 (PDT) Received: from m69-170.mailgun.net (m69-170.mailgun.net [166.78.69.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 906491243F3 for ; Fri, 13 Apr 2018 10:11:34 -0700 (PDT) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1523639493; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=Sfb/F12Su8vF8ATpygg2P5tGM8dwXbItkRJx8psbPYc=; b=goSd8BPvTc4FCgtRtpGl5svXVaZHvJDoym3vA9fvyqe21yx1+2NXzl//MRiX2uu1ruSPhBot EMKQYwiTWCCPKD8d3os266cevLxQRp53u+a2eUpuso/E/q4MTGPCBsXB7NX6V0NlPpgWoFgp Ux41X00qsWoM+ybA3NM62DdEBSk= X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd X-Mailgun-Sending-Ip: 166.78.69.170 Sender: Andrei-Popov=users.noreply.github.com@github.com Received: from github.com (Unknown [192.30.253.29]) by mxa.mailgun.org with ESMTP id 5ad0e4c5.7f32e877a3f0-smtp-out-n03; Fri, 13 Apr 2018 17:11:33 -0000 (UTC) Date: Fri, 13 Apr 2018 10:11:32 -0700 From: Andrei-Popov Reply-To: Andrei-Popov To: unbearable@ietf.org Message-ID: <5ad0e4c487694_2f802aac2ce99c0894735@hookshot-fe-b0febf1.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5ad0e4c4871c5_2f802aac2ce99c08946d"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Apr 2018 17:11:40 -0000 ----==_mimepart_5ad0e4c4871c5_2f802aac2ce99c08946d Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/andrei-fix-section-ref Home: https://github.com/TokenBinding/Internet-Drafts ----==_mimepart_5ad0e4c4871c5_2f802aac2ce99c08946d-- From nobody Thu Apr 19 18:48:06 2018 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 160FE12E8AD; Thu, 19 Apr 2018 18:48:04 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Matthew Miller To: Cc: draft-ietf-tokbind-protocol.all@ietf.org, unbearable@ietf.org, ietf@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.78.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152418888406.10829.5856838219601060605@ietfa.amsl.com> Date: Thu, 19 Apr 2018 18:48:04 -0700 Archived-At: Subject: [Unbearable] Artart telechat review of draft-ietf-tokbind-protocol-17 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Apr 2018 01:48:04 -0000 Reviewer: Matthew Miller Review result: Ready This document is well-written and clearly defines the format, creation, and validation of a TokenBindingMessage. Major Issues: NONE Minor Issues: NONE Nits: NONE From nobody Thu Apr 26 10:04:09 2018 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 10C4E126D85; Thu, 26 Apr 2018 10:04:08 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?q?Mirja_K=C3=BChlewind?= To: "The IESG" Cc: draft-ietf-tokbind-protocol@ietf.org, John Bradley , tokbind-chairs@ietf.org, ve7jtb@ve7jtb.com, unbearable@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.79.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152476224805.23077.13176130654875835156.idtracker@ietfa.amsl.com> Date: Thu, 26 Apr 2018 10:04:08 -0700 Archived-At: Subject: [Unbearable] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_d?= =?utf-8?q?raft-ietf-tokbind-protocol-17=3A_=28with_COMMENT=29?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Apr 2018 17:04:08 -0000 Mirja Kühlewind has entered the following ballot position for draft-ietf-tokbind-protocol-17: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Maybe I'm just missing something but given the TokenBindingType and the TB_ExtensionType share the same number space, how do I know if there is another TokenBinding or and an TB_Extension following after the signature? Nit: Please spell out TPM (in sec 1). From nobody Thu Apr 26 10:19:17 2018 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B027E127735; Thu, 26 Apr 2018 10:19:11 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?q?Mirja_K=C3=BChlewind?= To: "The IESG" Cc: draft-ietf-tokbind-negotiation@ietf.org, John Bradley , tokbind-chairs@ietf.org, ve7jtb@ve7jtb.com, unbearable@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.79.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152476315171.22993.18212137716941814070.idtracker@ietfa.amsl.com> Date: Thu, 26 Apr 2018 10:19:11 -0700 Archived-At: Subject: [Unbearable] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_d?= =?utf-8?q?raft-ietf-tokbind-negotiation-11=3A_=28with_COMMENT=29?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Apr 2018 17:19:12 -0000 Mirja Kühlewind has entered the following ballot position for draft-ietf-tokbind-negotiation-11: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tokbind-negotiation/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- One quick question: Why does this spec not cover TLS1.3? From nobody Thu Apr 26 10:22:35 2018 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C218124205; Thu, 26 Apr 2018 10:22:28 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?q?Mirja_K=C3=BChlewind?= To: "The IESG" Cc: draft-ietf-tokbind-protocol@ietf.org, John Bradley , tokbind-chairs@ietf.org, ve7jtb@ve7jtb.com, unbearable@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.79.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152476334804.22993.9338830122951336003.idtracker@ietfa.amsl.com> Date: Thu, 26 Apr 2018 10:22:28 -0700 Archived-At: Subject: [Unbearable] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_d?= =?utf-8?q?raft-ietf-tokbind-protocol-17=3A_=28with_COMMENT=29?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Apr 2018 17:22:28 -0000 Mirja Kühlewind has entered the following ballot position for draft-ietf-tokbind-protocol-17: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Update (after reading draft-ietf-tokbind-negotiation): Given different negotiation mechanisms could be used, maybe it would make sense to say slightly more about version handling in this doc as well, e.g. at least explaining/requiring that version negotiation is done by the negotiation protocol... Maybe I'm just missing something but given the TokenBindingType and the TB_ExtensionType share the same number space, how do I know if there is another TokenBinding or and an TB_Extension following after the signature? Nit: Please spell out TPM (in sec 1). From nobody Thu Apr 26 11:01:37 2018 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 26DB712785F; Thu, 26 Apr 2018 11:01:36 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?q?Mirja_K=C3=BChlewind?= To: "The IESG" Cc: draft-ietf-tokbind-https@ietf.org, John Bradley , tokbind-chairs@ietf.org, ve7jtb@ve7jtb.com, unbearable@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.79.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152476569615.23060.189824531189681897.idtracker@ietfa.amsl.com> Date: Thu, 26 Apr 2018 11:01:36 -0700 Archived-At: Subject: [Unbearable] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Record_on_draf?= =?utf-8?q?t-ietf-tokbind-https-13=3A_=28with_COMMENT=29?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Apr 2018 18:01:36 -0000 Mirja Kühlewind has entered the following ballot position for draft-ietf-tokbind-https-13: No Record When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tokbind-https/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Maybe use normative SHOULDs in sec 8.2: "HTTPS clients such as Web user agents should therefore provide a user interface for discarding Token Binding key pairs" and "the user agent should also discard Token Binding key pairs from such modes after the session is over" Nit: 1) In abstract: s/This Internet-Draft/This document/ 2) Maybe provide a refernce for SAML From nobody Thu Apr 26 11:02:11 2018 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E732127909; Thu, 26 Apr 2018 11:02:05 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?q?Mirja_K=C3=BChlewind?= To: "The IESG" Cc: draft-ietf-tokbind-protocol@ietf.org, John Bradley , tokbind-chairs@ietf.org, ve7jtb@ve7jtb.com, unbearable@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.79.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152476572557.22940.3607200722925408317.idtracker@ietfa.amsl.com> Date: Thu, 26 Apr 2018 11:02:05 -0700 Archived-At: Subject: [Unbearable] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_d?= =?utf-8?q?raft-ietf-tokbind-protocol-17=3A_=28with_COMMENT=29?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Apr 2018 18:02:06 -0000 Mirja Kühlewind has entered the following ballot position for draft-ietf-tokbind-protocol-17: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Sorry for spamming but one more update (after reading draft-ietf-tokbind-https): In sec 3: "This message MUST be sent in the client's first application protocol message." Why is that a generic requirement for all uses of token binding and not just for HTTPS? Update (after reading draft-ietf-tokbind-negotiation): Given different negotiation mechanisms could be used, maybe it would make sense to say slightly more about version handling in this doc as well, e.g. at least explaining/requiring that version negotiation is done by the negotiation protocol... Maybe I'm just missing something but given the TokenBindingType and the TB_ExtensionType share the same number space, how do I know if there is another TokenBinding or and an TB_Extension following after the signature? Nit: Please spell out TPM (in sec 1). From nobody Mon Apr 30 15:48:45 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD92E127599 for ; Mon, 30 Apr 2018 15:48:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rT8tiHDQA8Rh for ; Mon, 30 Apr 2018 15:48:41 -0700 (PDT) Received: from mail-qt0-x235.google.com (mail-qt0-x235.google.com [IPv6:2607:f8b0:400d:c0d::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B798127342 for ; Mon, 30 Apr 2018 15:48:41 -0700 (PDT) Received: by mail-qt0-x235.google.com with SMTP id c2-v6so12871733qtn.9 for ; Mon, 30 Apr 2018 15:48:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=amAirtVxWTCoSqJUvezonCDJG51HWTatTFZ2nvZ637k=; b=jwclzXuYz+iCFIWvcqnEZ+RStvxvIDzz4Zp33OJgF4RE5eVjyQkL4BxqRXR4ltUTU8 zDfrhnZY4P3LBmOWN17T1Qk42yFYn7xRds7zApetk0vih6ukFivWNaxdpex5v5BlnTJ1 N8s6PwNA2bKm+Fa6vhuj0OqxzqD9RXLJqbAUT/kw/7EEFRNTLxFXgsq43r9cPAn/g6j/ lUfZsbMg6BZZ//YeBkC8mVwpVCbqYDWFr3sMsztlChRpoonnnOFgRGd7TolCV7sAWztg oZOlX3HHqCwuvURCs4El85vtP2eRBoudc+93/JzhXaMfO/a9Sg1jfpI01MEq6bboWY1B H6fA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=amAirtVxWTCoSqJUvezonCDJG51HWTatTFZ2nvZ637k=; b=hnbzmLL+/Tr+NM5/g9YJMyf1hOG++wxhEC50RwSpqa2CSPG9EK2fDJKvGDE1AAAHEQ N3oVEYAbLaGelpBXpTJEluWo2jME8vyRKH7KZvaWOUuuDvOvNwecAGtSc5MYNJTFxzC+ YEI67PBUQwPVZSOaw4T2cwfpsL6gdejY97dX0Gr55J4fh9Ag0ptm/oRtqZteogibqtZV PBJPgHZHdTd6lCBmveQPFFrYh3DmnaU20WTrsZrG2BPo9gVxKIMFyjYk7fXXHIes7+Pz CmAZdSOtiNzwhi2qraiDwasOgDGH2lc9gHBcLj4hr8gEE9hLJRzhjN2sUFP3gvQkZvBJ au0w== X-Gm-Message-State: ALQs6tCxuqfKnrQR7emCTwJAtNErjj4ZayX6wQWobksJQH9Zh9uomU6Q bRW4t2ZtRJVe1fsi1YFHss9qUQ== X-Google-Smtp-Source: AB8JxZq8WpDNNRRcSw1tFX0v+u7yhiwtUWxKRghKb6xp50hNeWZe5m98Q6mLhXlL7xhODpR7qpmRLA== X-Received: by 2002:aed:35e5:: with SMTP id d34-v6mr12339542qte.246.1525128519816; Mon, 30 Apr 2018 15:48:39 -0700 (PDT) Received: from [192.168.8.102] ([181.203.105.125]) by smtp.gmail.com with ESMTPSA id m28-v6sm7581049qta.67.2018.04.30.15.48.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 30 Apr 2018 15:48:38 -0700 (PDT) From: John Bradley Message-Id: <80A2384D-2DFF-4996-AF37-1D8CCE161D31@ve7jtb.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_25360FD6-2A1B-4454-9353-38950E3475A5" Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Mon, 30 Apr 2018 19:48:30 -0300 In-Reply-To: <152476315171.22993.18212137716941814070.idtracker@ietfa.amsl.com> Cc: The IESG , draft-ietf-tokbind-negotiation@ietf.org, tokbind-chairs@ietf.org, unbearable@ietf.org To: =?utf-8?Q?Mirja_K=C3=BChlewind?= References: <152476315171.22993.18212137716941814070.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.6.18) Archived-At: Subject: Re: [Unbearable] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_?= =?utf-8?q?draft-ietf-tokbind-negotiation-11=3A_=28with_COMMENT=29?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Apr 2018 22:48:44 -0000 --Apple-Mail=_25360FD6-2A1B-4454-9353-38950E3475A5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Mirja Because of differences between TLS 1.2 and 1.3 we split the TLS 1.3 = considerations into a separate spec In trying to organize the WG=E2=80=99s documents we split TLS1.3 into = its own document. https://datatracker.ietf.org/doc/draft-ietf-tokbind-tls13/ = Basically the negotiation will use Encrypted extensions in TLS 1.3 so = TLS 1.3 is out of scope for this spec. I hope we can progress the TLS 1.3 spec quickly as TLS1.3 itself is = nearing the end of it=E2=80=99s long road to become a RFC. Regards John B. > On Apr 26, 2018, at 2:19 PM, Mirja K=C3=BChlewind = wrote: >=20 > Mirja K=C3=BChlewind has entered the following ballot position for > draft-ietf-tokbind-negotiation-11: No Objection >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut = this > introductory paragraph, however.) >=20 >=20 > Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-tokbind-negotiation/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > One quick question: Why does this spec not cover TLS1.3? >=20 >=20 --Apple-Mail=_25360FD6-2A1B-4454-9353-38950E3475A5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Mirja

Because of = differences between TLS 1.2 and 1.3 we split the TLS 1.3 considerations = into a separate spec

In trying to organize the WG=E2=80=99s documents we split = TLS1.3 into its own document.
https://datatracker.ietf.org/doc/draft-ietf-tokbind-tls13/<= /div>

Basically the = negotiation will use Encrypted extensions in TLS 1.3 so TLS 1.3 is out = of scope for this spec.

I hope we can progress the TLS 1.3 spec quickly as TLS1.3 = itself is nearing the end of it=E2=80=99s long road to become a = RFC.

Regards
John B.

On Apr = 26, 2018, at 2:19 PM, Mirja K=C3=BChlewind <ietf@kuehlewind.net>= wrote:

Mirja K=C3=BChlewind has entered the following ballot = position for
draft-ietf-tokbind-negotiation-11: No = Objection

When responding, please keep the = subject line intact and reply to all
email addresses = included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.htmlfor more information about IESG DISCUSS and COMMENT = positions.


The document, = along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tokbind-negotiation= /



---------------------------------------------------------------= -------
COMMENT:
---------------------------------------------------------------= -------

One quick question: Why does this = spec not cover TLS1.3?



= --Apple-Mail=_25360FD6-2A1B-4454-9353-38950E3475A5-- From nobody Mon Apr 30 17:49:48 2018 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A7A112DA21 for ; Mon, 30 Apr 2018 17:49:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.66 X-Spam-Level: X-Spam-Status: No, score=-1.66 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cVD-ZvAmzIsd for ; Mon, 30 Apr 2018 17:49:44 -0700 (PDT) Received: from m69-170.mailgun.net (m69-170.mailgun.net [166.78.69.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB1FC126CB6 for ; Mon, 30 Apr 2018 17:49:44 -0700 (PDT) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1525135783; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=bF/9jfBPCkXSAMNXpYUtsiurMP3PRM0D0cP0dyZq8Xw=; b=OdO/29etioJvoP26WxXGP6OvXyhwyFiT0jJVidDBkf8F/cHpmioG5lW7EHVLoZAiVACt49ma WZajguWwbU+rzueCAP7PVq2/yWQIl/+CRc61RaKljOK/eNrzcLjzwavk/v/+X2RuCX1wVuA3 pqmETdouGcdw0gm/9DWEoLt5whU= X-Mailgun-Sending-Ip: 166.78.69.170 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Sender: andreipo=microsoft.com@github.com Received: from github.com (Unknown [192.30.253.29]) by mxa.mailgun.org with ESMTP id 5ae7b9a7.7f4ec6e11480-smtp-out-n03; Tue, 01 May 2018 00:49:43 -0000 (UTC) Date: Mon, 30 Apr 2018 17:49:43 -0700 From: Andrei Popov Reply-To: Andrei Popov To: unbearable@ietf.org Message-ID: <5ae7b9a71235e_51122aebc2a61c1476520@hookshot-fe-b0febf1.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5ae7b9a712002_51122aebc2a61c1476463"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] fe669d: Further clarifying the negotiation based on Paul K... X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 May 2018 00:49:46 -0000 ----==_mimepart_5ae7b9a712002_51122aebc2a61c1476463 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: fe669d25e09e6cd856da5dd1d515546b9b0c00a6 https://github.com/TokenBinding/Internet-Drafts/commit/fe669d25e09e6cd856da5dd1d515546b9b0c00a6 Author: Andrei Popov Date: 2018-04-30 (Mon, 30 Apr 2018) Changed paths: M README.md R draft-ietf-tokbind-negotiation-11.xml A draft-ietf-tokbind-negotiation-12.xml Log Message: ----------- Further clarifying the negotiation based on Paul Kuzivat's comments. ----==_mimepart_5ae7b9a712002_51122aebc2a61c1476463--