Subject: [OAUTH-WG] Fwd: [websec] unbearable - new mailing list to discuss better than bearer tokens...

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 05 Dec 2014 20:17:07 +0100

-------- Forwarded Message --------
Subject: [websec] unbearable - new mailing list to discuss better than
bearer tokens...
Date: Fri, 05 Dec 2014 16:43:19 +0000
From: Stephen Farrell <[email-masked]>
Reply-To: Stephen Farrell <[email-masked]>
To: [email-masked] <[email-masked]>, websec <[email-masked]>,
[email-masked] <[email-masked]>, [email-masked] Group
<[email-masked]>, [email-masked] <[email-masked]>

Hiya,

Following up on the presentation at IETF-91 on this topic, [1]
we've created a new list [2] for moving that along. The list
description is:

"This list is for discussion of proposals for doing better than bearer
tokens (e.g. HTTP cookies, OAuth tokens etc.) for web applications.
The specific goal is chartering a WG focused on preventing security
token export and replay attacks."

If you're interested please join in.

Thanks to Vinod and Andrei for agreeing to admin the list.

We'll kick off discussion in a few days when folks have had
a chance to subscribe.

Cheers,
S.

PS: Please don't reply-all to this, join the new list, wait
a few days and then say what you need to say:-)

[1] https://tools.ietf.org/agenda/91/slides/slides-91-uta-2.pdf
[2] https://www.ietf.org/mailman/listinfo/unbearable

_______________________________________________
websec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/websec

---

From: Phil Hunt <[email-masked]>
Date: Fri, 5 Dec 2014 17:48:38 -0800

Doesn't that duplicate our current work?

Phil

> On Dec 5, 2014, at 11:17, Hannes Tschofenig <[email-masked]> wrote:
> 
> 
> 
> 
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: John Bradley <[email-masked]>
Date: Sat, 6 Dec 2014 05:52:36 -0300

No,  this is the the work formerly known as origin bound certificates & Channel ID.   We need this to bind id_tokens and or access tokens to TLS sessions.

So it is an alternative TLS binding mechanism.   We still need to describe how to use it with OAuth and JWT.

It is a building block we can use for PoP.

John B.
> On Dec 5, 2014, at 10:48 PM, Phil Hunt <[email-masked]> wrote:
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Sat, 06 Dec 2014 10:28:00 +0100

I agree with Phil. As currently described it replicates a lot of the
work we have done in PoP.

Ciao
Hannes

---

From: John Bradley <[email-masked]>
Date: Sat, 6 Dec 2014 07:09:04 -0300

They have examples of how it could be used in OAuth and Connect.  They didn't look at what we were doing with PoP so the examples don't line up.

That is why it is important to keep on top of this so that it is the OAuth WG that is defining how this binding mechanism is used in OAuth and JWT.

The specs themselves are, or should be independent of token type.

We have been waiting for TLS to produce this for around 4 years now.   It is not really new work, mostly a change of venue to make progress.

All of this was discussed at the last IETF meeting.  I thought a significant number of people from the OAuth WG were in the room.

John B.
> On Dec 6, 2014, at 6:28 AM, Hannes Tschofenig <[email-masked]> wrote:
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Sat, 06 Dec 2014 12:42:57 +0100

I think it should be the responsibility of document authors to read the
the state of the art to avoid re-inventing the wheel (particularly since
their co-workers have been heavily involved in the work).

It is not true that we have been waiting for 4 years for this now since
they have changed their solution approach many times and the use of the
raw public key in combination with the PoP solution would have given a
complete solution.

Ciao
Hannes

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 06 Dec 2014 13:55:22 +0000

Hiya, 

Sorry - I should have posted the announce here too. Not doing so was just an oversight.

Discussion of overlaps between the newly proposed and existing work is a fine topic for the new list I'd say. But better there than here. 

Cheers, 
S

On 6 December 2014 11:42:57 GMT+00:00, Hannes Tschofenig <[email-masked]> wrote:
>> They have examples of how it could be used in OAuth and Connect. 
>They didn't look at what we were doing with PoP so the examples don't
>line up.
>> 
>> That is why it is important to keep on top of this so that it is the
>OAuth WG that is defining how this binding mechanism is used in OAuth
>and JWT.
>> 
>> We have been waiting for TLS to produce this for around 4 years now. 
> It is not really new work, mostly a change of venue to make progress.
>> 
>> All of this was discussed at the last IETF meeting.  I thought a
>significant number of people from the OAuth WG were in the room.
>> 
>> John B.
>>>> No,  this is the the work formerly known as origin bound
>certificates & Channel ID.   We need this to bind id_tokens and or
>access tokens to TLS sessions.
>>>>
>>>> So it is an alternative TLS binding mechanism.   We still need to
>describe how to use it with OAuth and JWT.
>>>>
>------------------------------------------------------------------------
>

---

From: Phil Hunt <[email-masked]>
Date: Sat, 6 Dec 2014 08:08:04 -0800

On the surface (as currently presented) this work appears to duplicate the POP work going on in OAuth.  The key difference is that this work is focused on using ALPN to bind tokens to the TLS channel. From a use case perspective it is very close to OAuth POP, and a specific use case of the current OAuth POP (proof of possession) architecture.

I note that the OAuth WG had originally dropped TLS binding in part because TLS was not always end-to-end in cases where load-balancers where used. The identified use-cases required end-to-end proof of possession (e.g. to prevent token re-use and relaying).

Never-the-less, events and approaches change and this is worth discussing (again).  

I think the architectural/protocol issues around the use of load balancers have to be discussed as the current ALPN proposal may be unbearable for many. 

Phil

@independentid
www.independentid.com
[email-masked]

> On Dec 5, 2014, at 8:43 AM, Stephen Farrell <[email-masked]> wrote:
> 
> 
> Hiya,
> 
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 06 Dec 2014 16:37:32 +0000

Hi Phil,

Good points that need discussing but I'd suggest we give the new
list a few days to allow folks to subscribe and then have that
discussion.

Thanks,
S.

---

From: Phil Hunt <[email-masked]>
Date: Sat, 6 Dec 2014 11:49:02 -0800

:-)

Phil

> On Dec 6, 2014, at 08:37, Stephen Farrell <[email-masked]> wrote:
> 
> 
> 
> Hi Phil,
> 
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable