Subject: [dispatch] draft-secure-credential-transfer

From: Ted Hardie <[email-masked]>
Date: Thu, 4 Nov 2021 09:58:54 +0000

As it looks like I will not be able to attend DISPATCH because of the
clash with MASQUE, some questions on this draft.  First, this
motivating text confuses me a bit:

  Today, there is no standard way of transferring digital credentials
   securely between two devices belonging to the same platform or two
   different platforms.  This document proposes a solution to this
   problem by introducing a Relay server which allows two devices to
   exchange encrypted Provisioning Information securely.  The Relay
   server solves this problem by creating and managing temporary mailbox
   storage.

Based on the rest of the draft, I believe the idea here is that
digital credentials being sent in a simple way like and email titled
"Here's my public key, Alice" don't meet the need because the result
is not machine readable by the systems which would need to associate
the credential with a mailbox.  Is that correct, or have I missed the
point here?

If this is the case, you may want to reconsider whether "device" is
the right unit of discussion, since even mobile devices can have
multiple personae, accounts, and so on.  (Think of the Android work
profile example).  If it is not, then your document needs a good bit
of work to rethink some core elements (as an "account claim" would
potentially involve more than two devices, since accounts are often on
multiple devices).    If device is the unit of discussion, I think the
use case here needs to be spelled out a bit more, as the privacy and
security considerations might be a bit different.  (The "Send the
secret out of band" bit of this is part of what's hard to resolve with
the device-based unit of discussion, but I may be misunderstanding
this).

I think the security and privacy aspects of this need a fair amount of
work, as there are  a lot of aspects that can't be verified in the
protocol as set out.  That leads me to suggest that the answer to the
DISPATCH question is that this needs a working group, with both APPs
and Security folks involved.  On the APPS side, it would be helpful to
have folks who dealt with things like the IMAP URLAUTH (aka "pawn
ticket") approach, as well as folks with an HTTP background.

regards,

Ted