Re: [HASMAT] IETF BoF @IETF-78 Maastricht: HASMAT - HTTP Application Security Minus Authentication and Transport

["Thomas Hardjono" <[e-mail]>]

I'm just starting to read the drafts.

Quick nit/suggestion: Jeff, is there any chance of renaming STS to something
else?  Reason is (as you know) STS is used in WSS literature as Security
Token Service. This term has also made it into the OAuth drafts.

Perhaps something like: Transport Strict Security (TSS) might be better.
/thomas/



> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf
Of
> =JeffH
> Sent: Tuesday, June 08, 2010 7:38 PM
> To: IETF HASMAT list
> Subject: [HASMAT] IETF BoF @IETF-78 Maastricht: HASMAT - HTTP Application
> Security Minus Authentication and Transport
> 
> [ this is a more full-featured HASMAT BoF announcement that we'll be
sending
> out to various other lists, both IETF and non-IETF, later today and
tomorrow,
> feedback welcome (send it soon if you can ;)   I incorp'd the lastest
charter
> draft ]
> 
> 
> We will be hosting the "HTTP Application Security Minus Authentication and
> Transport (HASMAT)" Birds-of-a-Feather (BoF) session at IETF-78 in
Maastricht
> NL during the week of July 25-30, 2010.
> 
> The purpose of IETF BoFs is to determine whether there is a problem worth
> solving, and whether the IETF is the right group to solve it. To that end,
> the
> problem statement is summarized below in the Draft HASMAT Working Group
> Charter, and is drawn from [1].
> 
> Various facets of this work are already underway, as outlined below in the
> draft WG charter, e.g. Strict Transport Security (STS) [2].
> 
> Of course the scope of "HTTP application security" is quite broad (as
> outlined
> in [1]), thus the intent is to coordinate this work closely with related
work
> likely to land in the W3C (and possibly other orgs), e.g. Content Security
> Policy (CSP) [3].
> 
> We have created a public mailing list for pre-BoF discussion --
> [e-mail]
> -- to which you can freely subscribe here:
> <https://www.ietf.org/mailman/listinfo/hasmat>
> 
> We encourage all interested parties to join the mailing list and engage in
> the
> on-going discussion there.
> 
> thanks,
> 
> =JeffH             (current HTTPstate WG chair)
> Peter Saint-Andre  (IETF Applications Area Director)
> Hannes Tschofenig  (IAB, IETF WG chair)
> 
> 
> [0] HASMAT mailing list.
> https://www.ietf.org/mailman/listinfo/hasmat
> 
> [1] Hodges and Steingruebl, "The Need for a Coherent Web Security Policy
> Framework", W2SP position paper, 2010.
> http://w2spconf.com/2010/papers/p11.pdf
> 
> [2] Hodges, Jackson, and Barth, "Strict Transport Security (STS)",
> revision -06.
> http://lists.w3.org/Archives/Public/www-archive/2009Dec/att-0048/draft-
> hodges-strict-transport-sec-06.plain.html
> 
> see also: http://en.wikipedia.org/wiki/Strict_Transport_Security
> 
> [3] Sterne and Stamm, "Content Security Policy (CSP)".
> https://wiki.mozilla.org/Security/CSP/Specification
> see also: http://people.mozilla.org/~bsterne/content-security-policy/
>            https://wiki.mozilla.org/Security/CSP/Design_Considerations
> 
> 
> ###
> 
> Proposed HASMAT BoF agenda
> --------------------------
> 
> Chairs: Hannes Tschofenig and Jeff Hodges
> 
> 5 min   Agenda bashing (Chairs)
> 
> 10 min  Description of the problem space (TBD)
> 
> 20 min  Motivation for standardizing (TBD)
>          draft-abarth-mime-sniff
>          draft-abarth-origin (expired)
>          draft-hodges-stricttransportsec (to-be-submitted)
> 
> 15 min  Presentation of charter text (TBD)
> 
> 60 min  Discussion of charter text and choice of the initial
> specifications (All)
> 
> 10 min  Conclusion (Chairs/ADs)
> 
> 
> 
> ###
> 
> Draft Charter for HASMAT:
> 
>     HTTP Application Security Minus Authentication and Transport WG
> 
> 
> Problem Statement
> 
> Although modern Web applications are built on top of HTTP, they provide
> rich functionality and have requirements beyond the original vision of
> static web pages.  HTTP, and the applications built on it, have evolved
> organically.  Over the past few years, we have seen a proliferation of
> AJAX-based web applications (AJAX being shorthand for asynchronous
> JavaScript and XML), as well as Rich Internet Applications (RIAs), based
> on so-called Web 2.0 technologies.  These applications bring both
> luscious eye-candy and convenient functionality, e.g. social networking,
> to their users, making them quite compelling.  At the same time, we are
> seeing an increase in attacks against these applications and their
> underlying technologies.
> 
> The list of attacks is long and includes Cross-Site-Request Forgery
> (CSRF)-based attacks, content-sniffing cross-site-scripting (XSS)
> attacks, attacks against browsers supporting anti-XSS policies,
> clickjacking attacks, malvertising attacks, as well as man-in-the-middle
> (MITM) attacks against "secure" (e.g. Transport Layer Security
> (TLS/SSL)-based) web sites along with distribution of the tools to carry
> out such attacks (e.g. sslstrip).
> 
> 
> Objectives and Scope
> 
> With the arrival of new attacks the introduction of new web security
> indicators, security techniques, and policy communication mechanisms
> have sprinkled throughout the various layers of the Web and HTTP.
> 
> The goal of this working group is to standardize a small number of
> selected specifications that have proven to improve security of Internet
> Web applications. The requirements guiding the work will be taken from
> the Web application and Web security communities.  Initial work will be
> limited to the following topics:
> 
>     - Same origin policy, as discussed in draft-abarth-origin
> 
>     - Strict transport security, as discussed in
>       draft-hodges-stricttransportsec (to be submitted shortly)
> 
>     - Media type sniffing, as discussed in draft-abarth-mime-sniff
> 
> In addition, this working group will consider the overall topic of HTTP
> application security and compose a "problem statement and requirements"
> document that can be used to guide further work.
> 
> This working group will work closely with IETF Apps Area WGs (such as
> HYBI, HTTPstate, and HTTPbis), as well as W3C WebApps working group(s).
> 
> 
> Out of Scope
> 
> As noted in this working group's title, this working group's scope does
> not include working on HTTP Authentication nor underlying transport
> (secure or not) topics. So, for example, these items are out-of-scope
> for this WG:
> 
>     - Replacements for BASIC and DIGEST authentication
> 
>     - New transports (e.g. SCTP and the like)
> 
> 
> Deliverables
> 
> 1. A document illustrating the security problems Web applications are
> facing and listing design requirements.  This document shall be
> Informational.
> 
> 2. A selected set of technical specifications documenting deployed
> HTTP-based Web security solutions.
> These documents shall be Standards Track.
> 
> 
> Goals and Milestones
> 
> Oct 2010    Submit "HTTP Application Security Problem Statement and
>              Requirements" as initial WG item.
> 
> Oct 2010    Submit "Media Type Sniffing" as initial WG item.
> 
> Oct 2010    Submit "Web Origin Concept" as initial WG item.
> 
> Oct 2010    Submit "Strict Transport Security" as initial WG item.
> 
> Feb 2011    Submit "HTTP Application Security Problem Statement and
>              Requirements" to the IESG for consideration as an
>              Informational RFC.
> 
> Mar 2011    Submit "Media Type Sniffing" to the IESG for consideration
>              as a Standards Track RFC.
> 
> Mar 2011    Submit "Web Origin Concept" to the IESG for consideration as
>              a Standards Track RFC.
> 
> Mar 2011    Submit "Strict Transport Security" to the IESG for
>              consideration as a Standards Track RFC.
> 
> Apr 2011    Possible re-chartering
> 
> 
> 
> ###
> _______________________________________________
> HASMAT mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/hasmat