Subject: [OAUTH-WG] Fwd: [Unbearable] one proposal for a charter - please dicsuss

From: Stephen Farrell <[email-masked]>
Date: Mon, 08 Dec 2014 23:20:44 +0000

Hiya,

I've kicked off that discussion on the unbearable list.
*Please* let's have the discussion there. On one mailing
list, not two.

Thanks,
S.

-------- Forwarded Message --------
Subject: [Unbearable] one proposal for a charter - please dicsuss
Date: Mon, 08 Dec 2014 23:19:28 +0000
From: Stephen Farrell <[email-masked]>
To: [email-masked]

Hi all,

There's about 70+ people on the list now so let's kick off.

Andrei sent Kathleen and I the charter proposal below a while
ago. For myself I don't think its quite right yet but I'd
rather hear what you all think. So please discuss...

Cheers,
S.

Token Binding (TB)

Charter for Working Group

Web services generate various security tokens (e.g.  HTTP cookies, OAuth
tokens, etc.) for web applications to access protected resources.
Currently these are bearer tokens, i.e. any party in possession of such
token gains access to the protected resource. Attackers export bearer
tokens from client machines or from compromised network connections,
present these bearer tokens to Web services, and impersonate
authenticated users. The idea of Token Binding is to prevent such
attacks by cryptographically binding security tokens to the TLS layer.

The tasks of this working group are as follows:
1.            Specify the Token Binding protocol v1.0.
2.            Specify the use of the Token Binding protocol in
combination with HTTPS.

It is a goal of this working group to prevent security token export and
replay attacks, but other issues associated with the use of security
tokens are out of scope. It is a goal of this working group to design
the Token Binding protocol such that it would be also useable with
application protocols other than HTTPS, however specifying such uses is
not a primary goal.

Some of the main design goals for the Token Binding protocol, in no
particular order:
1.            Prevent export and replay of security tokens.
2.            Allow strong key protection, e.g. using hardware-bound keys.
3.            Support both first-party and federation scenarios.
4.            Preserve user privacy.
5.            Make the Token Binding protocol useable in combination
with a variety of application protocols.
6.            Allow the negotiation of the Token Binding protocol
without additional round-trips.
7.            Allow the use of multiple cryptographic algorithms, so
that a variety of secure hardware modules with different cryptographic
capabilities could be used with Token Binding.

The working group will use the following documents as a starting point
for its work:
-              draft-popov-token-binding-00;
-              draft-balfanz-https-token-binding-00.

This WG will collaborate with other IETF WGs, in particular with the
TLS, HTTPbis and Oauth WGs.

Milestones:

March 2015: WG document for the Token Binding Protocol v1.0.
March 2015: WG document for HTTPS Token Binding.
November 2015: Token Binding Protocol v1.0 to IESG.
November 2015: HTTPS Token Binding to IESG.

_______________________________________________
Unbearable mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/unbearable