Re: [Ace] CWT-PoP & Multiple PoP keys
Ludwig Seitz <ludwig.seitz@ri.se> Wed, 20 June 2018 07:14 UTC
Return-Path: <ludwig.seitz@ri.se>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C639A130F73 for <ace@ietfa.amsl.com>; Wed, 20 Jun 2018 00:14:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level:
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p3-zoTbk8ik9 for <ace@ietfa.amsl.com>; Wed, 20 Jun 2018 00:14:17 -0700 (PDT)
Received: from smtp-out10.electric.net (smtp-out10.electric.net [185.38.180.33]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95E9512D949 for <ace@ietf.org>; Wed, 20 Jun 2018 00:14:17 -0700 (PDT)
Received: from 1fVXJl-000alJ-V9 by out10c.electric.net with emc1-ok (Exim 4.90_1) (envelope-from <ludwig.seitz@ri.se>) id 1fVXJl-000amR-W8 for ace@ietf.org; Wed, 20 Jun 2018 00:14:13 -0700
Received: by emcmailer; Wed, 20 Jun 2018 00:14:13 -0700
Received: from [194.218.146.197] (helo=sp-mail-2.sp.se) by out10c.electric.net with esmtps (TLSv1.2:ECDHE-RSA-AES128-SHA256:128) (Exim 4.90_1) (envelope-from <ludwig.seitz@ri.se>) id 1fVXJl-000alJ-V9 for ace@ietf.org; Wed, 20 Jun 2018 00:14:13 -0700
Received: from [192.168.0.166] (10.116.0.226) by sp-mail-2.sp.se (10.100.0.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 20 Jun 2018 09:14:13 +0200
To: ace@ietf.org
References: <VI1PR0801MB211205E0BA138E58D99E485DFA770@VI1PR0801MB2112.eurprd08.prod.outlook.com>
From: Ludwig Seitz <ludwig.seitz@ri.se>
Message-ID: <2e1720cf-ae24-552a-8eff-0fe1aefda46d@ri.se>
Date: Wed, 20 Jun 2018 09:14:13 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0
MIME-Version: 1.0
In-Reply-To: <VI1PR0801MB211205E0BA138E58D99E485DFA770@VI1PR0801MB2112.eurprd08.prod.outlook.com>
Content-Type: text/plain; charset="windows-1252"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-Originating-IP: [10.116.0.226]
X-ClientProxiedBy: sp-mail-1.sp.se (10.100.0.161) To sp-mail-2.sp.se (10.100.0.162)
X-Outbound-IP: 194.218.146.197
X-Env-From: ludwig.seitz@ri.se
X-Proto: esmtps
X-Revdns:
X-HELO: sp-mail-2.sp.se
X-TLS: TLSv1.2:ECDHE-RSA-AES128-SHA256:128
X-Authenticated_ID:
X-PolicySMART: 14510320
X-Virus-Status: Scanned by VirusSMART (c)
X-Virus-Status: Scanned by VirusSMART (s)
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/hEcb5-U37SvXz5P8nMEYdR3p8dU>
Subject: Re: [Ace] CWT-PoP & Multiple PoP keys
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Jun 2018 07:14:21 -0000
On 2018-06-20 08:57, Hannes Tschofenig wrote: > Hi Jim, > > I had a chat with Mike about relaxing the CWT-PoP spec to allow multiple > PoP keys in a single CWT token. > > He is concerned about the departure from RFC 7800 and, after giving it a > bit more thoughts, I believe there is an issue. Initially, when we > started the work our promise was that this is really just an alternative > encoding of RFC 7800. With changes like those we are obviously breaking > that concept. Having multiple keys within a single CWT is a corner case > and I am not sure anymore whether I indeed want to go into that > direction. In our implementation we are also not using multiple keys in > a single CWT either. > > Ciao > > Hannes > I agree that having multiple PoP keys in cnf for CWT-PoP seem like overkill. After all this is a draft aimed at constrained environments. I also sympathize with Mike's suggestion to keep CWT-PoP aligned with RFC 7800. /Ludwig > IMPORTANT NOTICE: The contents of this email and any attachments are > confidential and may also be privileged. If you are not the intended Sending confidential email to a public mailing list again Hannes? You are a rebel ;-) -- Ludwig Seitz, PhD Security Lab, RISE SICS Phone +46(0)70-349 92 51
- Re: [Ace] CWT-PoP & Multiple PoP keys Mike Jones
- Re: [Ace] CWT-PoP & Multiple PoP keys Ludwig Seitz
- [Ace] CWT-PoP & Multiple PoP keys Hannes Tschofenig