IETF Logo Mail Archive

[Ace] CWT-PoP & Multiple PoP keys

Hannes Tschofenig <Hannes.Tschofenig@arm.com> Wed, 20 June 2018 06:57 UTC

Return-Path: <Hannes.Tschofenig@arm.com>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BC11131028 for <ace@ietfa.amsl.com>; Tue, 19 Jun 2018 23:57:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level:
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qYiJPPHloOcY for <ace@ietfa.amsl.com>; Tue, 19 Jun 2018 23:57:06 -0700 (PDT)
Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80087.outbound.protection.outlook.com [40.107.8.87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF22A130FBE for <ace@ietf.org>; Tue, 19 Jun 2018 23:57:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2+VR+NQFbjwZbXtGWvk4wIi6M6stuoImvS/lOg+1XPw=; b=T8JGjqvNaw4th4VVp+cm/tCifd5hanfNeN0KNHirv8P3xgz9q2dSDhdUXrEglrkvYdiNZZogGcyUafAV6GLb/7R0ilmSZ3sn/1rZ34yU3/NBEB8nt038LVfkSCxCZvPxtmGRjzI5Jzqy0L79snp5qwLRfTiTfmThG/XgXndAt0w=
Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB1568.eurprd08.prod.outlook.com (10.167.211.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.863.19; Wed, 20 Jun 2018 06:57:02 +0000
Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::d1df:1498:96ec:6b35]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::d1df:1498:96ec:6b35%4]) with mapi id 15.20.0863.016; Wed, 20 Jun 2018 06:57:02 +0000
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
To: "ace@ietf.org" <ace@ietf.org>
Thread-Topic: CWT-PoP & Multiple PoP keys
Thread-Index: AdQIY2SAG/d3FGSqSlGPkPFJdW2VHQ==
Date: Wed, 20 Jun 2018 06:57:02 +0000
Message-ID: <VI1PR0801MB211205E0BA138E58D99E485DFA770@VI1PR0801MB2112.eurprd08.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com;
x-originating-ip: [217.140.96.140]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; VI1PR0801MB1568; 7:QPKS/4SkmOq088iTaNrsY4ebgOluN5V1m/2jTU5Xt8P02YOCq6oi+ZKKkoPdcCm+/O0Lf/GtqyeY+ICAchYqMeG4sVodvGYluLWz0eoRecIsE0llxUzDJUGdVll50HW2dR9dK8VRL3TDc269QhGlbUDWlZ7yenSRgIwsWCcdb64ei8SoO5Tg+0PQmp2ph6cMLmj3OVVUB3Xc8NnbTC/J3gLSlJUlhkERwq1cptR5zeoa4FxKMrossrumB4m6bN2i
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: db0f75bd-5c8a-47f5-b23a-08d5d67b06ef
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(4534165)(4627221)(201703031133081)(201702281549075)(5600026)(711020)(48565401081)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB1568;
x-ms-traffictypediagnostic: VI1PR0801MB1568:
x-microsoft-antispam-prvs: <VI1PR0801MB15684F24B5598044716BA1B8FA770@VI1PR0801MB1568.eurprd08.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(28532068793085)(21748063052155);
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(3002001)(3231254)(944501410)(52105095)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123558120)(20161123564045)(6072148)(201708071742011)(7699016); SRVR:VI1PR0801MB1568; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB1568;
x-forefront-prvs: 070912876F
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(39380400002)(39860400002)(366004)(376002)(346002)(189003)(199004)(40434004)(6306002)(7736002)(3280700002)(8676002)(1730700003)(9686003)(81156014)(8936002)(53936002)(3660700001)(2900100001)(81166006)(2906002)(790700001)(6116002)(97736004)(3846002)(105586002)(55016002)(2351001)(25786009)(33656002)(54896002)(106356001)(5640700003)(6436002)(2501003)(5660300001)(186003)(86362001)(5890100001)(66066001)(74316002)(9326002)(316002)(486006)(6916009)(72206003)(26005)(5250100002)(99286004)(59450400001)(68736007)(6506007)(14454004)(478600001)(7696005)(476003)(5630700001)(102836004); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB1568; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: Q+25k4y9Vm96p9Zvm08qCxlXSFO7FpF7reZ6Uw0I4FXrxbXZl406XQ8vKXLxm5s/Vdd0GY6U9yi2vQ2S1JCiVXHh0RASY+xOur0+mGJA1S9naHcWRThK3iH7PUvQ6kW3uzkjjn3AJLJ82RDlaJJUh0Xvt0fkPS/G2ReKqWIrbDImfLyx1lQcYxhWjKY4SlgX7aMTo6mnrLF5nEOsk87F2VigsymFy42RD9p140vb0uYH8x2SxDFv3uxDaaGKJE7hdgW6xCYdGghkPeHHILKs8fza8nTds8y8x5Dbso+TRqq+/1oxwPuy3kkVKVP1bfv/8Fl2m3O9j4Fj7BRBBMQRtg==
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_VI1PR0801MB211205E0BA138E58D99E485DFA770VI1PR0801MB2112_"
MIME-Version: 1.0
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-Network-Message-Id: db0f75bd-5c8a-47f5-b23a-08d5d67b06ef
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2018 06:57:02.6985 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1568
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/X86PTh1uw5BH_yhOHerLRXo85H8>
Subject: [Ace] CWT-PoP & Multiple PoP keys
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Jun 2018 06:57:09 -0000

Hi Jim,

I had a chat with Mike about relaxing the CWT-PoP spec to allow multiple PoP keys in a single CWT token.

He is concerned about the departure from RFC 7800 and, after giving it a bit more thoughts, I believe there is an issue. Initially, when we started the work our promise was that this is really just an alternative encoding of RFC 7800. With changes like those we are obviously breaking that concept. Having multiple keys within a single CWT is a corner case and I am not sure anymore whether I indeed want to go into that direction. In our implementation we are also not using multiple keys in a single CWT either.

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

v2.23.0 | Report a Bug | By Email