Re: [http-state] draft-salgueiro-secure-state-management

[Adam Barth <[e-mail]>]

Thanks for the interesting read.

This working group is current in "phase one," which is to create a
specification for the de facto cookie protocol in use today.  In phase
two, we'll be considering way of improving HTTP state management.
This document looks like useful input for phase two.

The document isn't entirely clear about what security problem with the
current cookie protocol you're trying to solve.  It would be helpful
if you included a threat model and an explanation of your security
goals.  You argue against using TLS for all HTTP traffic on the basis
of requiring a different IP for each host name.  This problem will be
solved in the intermediate term by the SNI extension, which will
undoubtably beat any improved state management protocol to market.

The document preserves some of the syntax from the cookie protocol.
I'd advise dumping the current syntax entirely.

The document seems quite concerned about passive network attackers,
but doesn't seem that concerned abou the other security issues with
cookies.  You might consult the Security Considerations section of
http://tools.ietf.org/html/draft-ietf-httpstate-cookie for a survey of
security problems a new protocol might improve.  (Note that this
section will be improved markedly in the next version of the draft,
which you can see here
http://github.com/abarth/http-state/blob/master/drafts/cookie.xml).

Adam


On Thu, Feb 18, 2010 at 3:45 PM, Gonzalo Salgueiro <[e-mail]> wrote:
> Folks -
>
> I have posted the following draft:
>
> http://tools.ietf.org/html/draft-salgueiro-secure-state-management
>
> This draft provides a simple method for providing a reasonable level of security when exchanging state management information through HTTP in situations where TLS is not employed.
>
> We would appreciate receiving any comments you have and input on whether you think this might be a complementary addition to the work the WG is already undertaking.
>
> Thanks,
>
> Gonzalo
>
>
>
> This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message.
>
> For corporate legal information go to:
> http://www.cisco.com/web/about/doing_business/legal/cri/index.html
>
>