Re: [Atlas] Request signing

[Hannes Tschofenig <[e-mail]>]

Hi Russ, Hi Phil,

You raise good points.

I can only talk about the use cases we have investigated, which are related to Internet of Things deployments.

As an example, consider a Bluetooth Smart device that talks to a cloud based service via a smart phone or tablet. The data needs to be secured from the Bluetooth Smart device to the cloud-based service. Now imagine that the Bluetooth Smart device does not talk IP or HTTP (an assumption that is not unrealistic). The phone / tablet will, however, use HTTPS.

The data, which is encoded using JSON or CBOR, needs to be protected using an AEAD cipher. Whether it is better to re-use the TLS record protocol or whether COSE/JOSE should be re-used for application data protection is something this group needs to find out.

In my example, the challenges you outline below do not surface. I do, however, agree that there has been a long history of failed attempts of “signing” application protocols in face of intermediaries like proxies, and session border controllers.

Ciao
Hannes

From: Atlas [mailto:[e-mail]] On Behalf Of Russ Housley
Sent: 22 January 2018 15:20
To: Phil Hunt
Cc: [e-mail]
Subject: Re: [Atlas] Request signing

This was the primary goal of SHTTP.  See RFC 2660.  Of course, SHTTP never saw wide-spread deployment.

Russ


On Jan 22, 2018, at 2:41 PM, Phil Hunt <[e-mail]<mailto:[e-mail]>> wrote:

A problem that keeps coming up in HTTP is the ability to sign requests/responses. Some see this as additional security, but others see this as beneficial for after-the-fact verification (e.g auditing).

If ATLAS proposes to encapsulate HTTP to prevent interference by intermediaries than it likely would also solve problems that HTTP request signing proposals have not been able to overcome — the possibility that intermediaries may alter HTTP requests for good (or bad) reasons.

Has this been discussed?

Thanks,

Phil

Oracle Corporation, Identity Cloud Services Architect
@independentid
www.independentid.com<http://www.independentid.com/>
[e-mail]<mailto:[e-mail]>

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.