Re: [apps-discuss] HTTP MAC Authentication Scheme

Eran Hammer-Lahav <eran@hueniverse.com> Thu, 02 June 2011 15:58 UTC

Return-Path: <eran@hueniverse.com>
X-Original-To: apps-discuss@ietfa.amsl.com
Delivered-To: apps-discuss@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4D39E0827 for <apps-discuss@ietfa.amsl.com>; Thu, 2 Jun 2011 08:58:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.823
X-Spam-Level:
X-Spam-Status: No, score=-2.823 tagged_above=-999 required=5 tests=[AWL=-0.224, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Are86GKE5-sD for <apps-discuss@ietfa.amsl.com>; Thu, 2 Jun 2011 08:58:51 -0700 (PDT)
Received: from p3plex1out02.prod.phx3.secureserver.net (p3plex1out02.prod.phx3.secureserver.net [72.167.180.18]) by ietfa.amsl.com (Postfix) with SMTP id 14295E0826 for <apps-discuss@ietf.org>; Thu, 2 Jun 2011 08:58:50 -0700 (PDT)
Received: (qmail 11884 invoked from network); 2 Jun 2011 15:45:16 -0000
Received: from unknown (HELO smtp.ex1.secureserver.net) (72.167.180.19) by p3plex1out02.prod.phx3.secureserver.net with SMTP; 2 Jun 2011 15:45:16 -0000
Received: from P3PW5EX1MB01.EX1.SECURESERVER.NET ([10.6.135.19]) by P3PW5EX1HT001.EX1.SECURESERVER.NET ([72.167.180.19]) with mapi; Thu, 2 Jun 2011 08:45:04 -0700
From: Eran Hammer-Lahav <eran@hueniverse.com>
To: Mark Nottingham <mnot@mnot.net>
Date: Thu, 2 Jun 2011 08:44:35 -0700
Thread-Topic: [apps-discuss] HTTP MAC Authentication Scheme
Thread-Index: AcwgujliuTi4Kf4mRayjenHdrNw8EQAgXYFA
Message-ID: <90C41DD21FB7C64BB94121FBBC2E723447583CA782@P3PW5EX1MB01.EX1.SECURESERVER.NET>
References: <90C41DD21FB7C64BB94121FBBC2E723447581DA8EA@P3PW5EX1MB01.EX1.SECURESERVER.NET> <EF1DF135-708B-4244-AA3A-020761EDB290@mnot.net> <90C41DD21FB7C64BB94121FBBC2E723447583CA4CC@P3PW5EX1MB01.EX1.SECURESERVER.NET> <BB837BE0-060E-4201-821A-4A7F5FFED3A4@mnot.net>
In-Reply-To: <BB837BE0-060E-4201-821A-4A7F5FFED3A4@mnot.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "apps-discuss@ietf.org" <apps-discuss@ietf.org>, Ben Adida <ben@adida.net>, "'Adam Barth \(adam@adambarth.com\)'" <adam@adambarth.com>, "http-state@ietf.org" <http-state@ietf.org>, HTTP Working Group <ietf-http-wg@w3.org>, OAuth WG <oauth@ietf.org>
Subject: Re: [apps-discuss] HTTP MAC Authentication Scheme
X-BeenThere: apps-discuss@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: General discussion of application-layer protocols <apps-discuss.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/apps-discuss>, <mailto:apps-discuss-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/apps-discuss>
List-Post: <mailto:apps-discuss@ietf.org>
List-Help: <mailto:apps-discuss-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/apps-discuss>, <mailto:apps-discuss-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Jun 2011 15:58:51 -0000

> -----Original Message-----
> From: Mark Nottingham [mailto:mnot@mnot.net]
> Sent: Wednesday, June 01, 2011 5:16 PM
> To: Eran Hammer-Lahav
> Cc: apps-discuss@ietf.org; Ben Adida; http-state@ietf.org; OAuth WG;
> 'Adam Barth (adam@adambarth.com)'#x27;; HTTP Working Group
> Subject: Re: [apps-discuss] HTTP MAC Authentication Scheme
> 
> 
> On 02/06/2011, at 1:00 AM, Eran Hammer-Lahav wrote:
> 
> > This was suggested before, but are there really attack vectors for this?
> 
> If not having a current, working attack to demonstrate is a valid way to shrug
> off a security concern, that's great; it'll be a useful approach to many of the
> discussions I have. :)

No, but its valid as long as it is fully documented. We're not going to solve everything.

> > The problem is that content-type is a pretty flexible header, which means
> normalization of the header will be required (case, parameter order, white
> space, etc.).
> 
> The media type is the important part, and it's much more constrained.

So include just the:

	type "/" subtype

forced to lowercase?

> 
> > I would argue that if you are using MAC with body hash and an attacker
> changing the media type can cause harm, you should use additional methods
> to secure the content-type (such as making the body self-describing).
> 
> 
> That seems like a step backwards, considering all of the work that Adam has
> put into limiting the use of sniffing.

I wasn't suggesting sniffing.

EHL

> Cheers,
> 
> --
> Mark Nottingham   http://www.mnot.net/
> 
>