Subject: [OAUTH-WG] Formal analysis of draft-ietf-oauth-pop-key-distribution

From: Luca Arnaboldi <[email-masked]>
Date: Fri, 26 Apr 2019 10:51:53 +0000

* I spoke with Hannes after the IETF meeting in Prague and he expressed the need to enhance our formal analysis (as presented at the OAuth Security Workshop) to verify whether it is necessary to demonstrate possession of the private key by the client to the authorization server.

* The analysis checked whether it was necessary for a proof of possession to be performed between the client and AS to ensure security. The result was that even without verification by the AS the client would not be able to access the resource from the RS without possessing the secret key associated to the token (assuming the check is done correctly by the RS).

Tamarin model for specific example with proofs available at : https://github.com/Yiergot/ACE-OAuth-FormalModel

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Benjamin Kaduk <[email-masked]>
Date: Sat, 27 Apr 2019 22:57:32 -0500

> * The analysis checked whether it was necessary for a proof of possession to be performed between the client and AS to ensure security. The result was that even without verification by the AS the c…

My apologies for not checking the model directly (I'm on a plane), but I'll
note that we have seen similar PoP scenarios in other protocols where a
misbehaving client will deliberately try to bind the (valid) key from
another party to a token it authorizes, which can sometimes result in the
other party taking actions different from the ones they intended.  So I'd
suggest being careful about what scope of attacks are considered.

Thanks,

Ben