Re: [OAUTH-WG] New Version Notification for draft-fett-oauth-dpop-03.txt

Torsten Lodderstedt <torsten@lodderstedt.net> Fri, 22 November 2019 12:16 UTC

Return-Path: <torsten@lodderstedt.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B38D81208A5 for <oauth@ietfa.amsl.com>; Fri, 22 Nov 2019 04:16:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lodderstedt.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fr3iPdSu41Ae for <oauth@ietfa.amsl.com>; Fri, 22 Nov 2019 04:16:04 -0800 (PST)
Received: from mail-pf1-x433.google.com (mail-pf1-x433.google.com [IPv6:2607:f8b0:4864:20::433]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5281120970 for <oauth@ietf.org>; Fri, 22 Nov 2019 04:16:01 -0800 (PST)
Received: by mail-pf1-x433.google.com with SMTP id c13so3417558pfp.5 for <oauth@ietf.org>; Fri, 22 Nov 2019 04:16:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lodderstedt.net; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=DC7VW0B0nq+enVc6xFyDxjmSPuMPTx1yI7/NrEu2/uE=; b=rtVQdqKvtsoETZJzErlTuj4wzeBmxIBswFOprF7qR+QAYzDgqNQHQtRxD1DNBNGVuU E+7b6d+LxDG4mzXfP5gs/6JRIind5idUboAzCwwDB3f/S271raiU0nr83VZuwQk/VwTh I+D+TQgZxphG+l7Q9zwSVjzBxhr2gytrRtN7C1Ky/cxxpSVjVK1SDwaPxYz6TOVxsYp/ XtRy/l1zyyelhbhM1sA1Ma9F4fIYJ3YFC5Socm7Clmzo3evW5bw1e25rMHrO+VP4d2Yv wc6N9KjxW2iVya2RTKK6dA3DWXs0hinMZAaUBj0RZchDfbTKZe6JCg9tSNpKtZgH43j8 wuKA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=DC7VW0B0nq+enVc6xFyDxjmSPuMPTx1yI7/NrEu2/uE=; b=Nntq5RHY60dmI0YL6eoRWKvgWCSgAMXb2zVgg/JRl85IiDuVULficu2tcCMoaAPCz+ IWMvzGo4ycr/CQAjLSEvdPPnR7yrGJB5bpB/3WRZln/Jf97pp+TkF981H8usIX5l8Yfd huMFpRLSoTXv5LquJ1UmyJkxIbwf90Xiy72L48GHBZ6ZuXFuyGNYQ/2SiMKqVsqkFDFi MV3Bzt/i4w2SQmF1xeqyr8+jXh2eMXD3WUD4yXOU3QQeWIIJQBEJB+lVNadK8hI30kmT 03v06g/t3i3zBwZr3yFTu7b4a/8DZaeZ6c4kmL5t10iR5/wMZflJHVpScNgRn+XRFuWo CVIg==
X-Gm-Message-State: APjAAAV93j5VUGyh0nV7iNAsDUCCMgYjb86XKqgizWUa/Bfs0r8eWxxX 6ySrBnPJ7lhB20/8fRi48o/Tzg==
X-Google-Smtp-Source: APXvYqxRxje4UTBomDvWy5L2Q51Rf9i/7D8mE/JJkTBQdjKSKVnhGwVlPO+rwP3pVtUGyliQ+OxeWw==
X-Received: by 2002:a63:1c0e:: with SMTP id c14mr15098896pgc.96.1574424961141; Fri, 22 Nov 2019 04:16:01 -0800 (PST)
Received: from [10.84.13.52] ([103.137.210.94]) by smtp.gmail.com with ESMTPSA id i13sm7029705pfo.39.2019.11.22.04.15.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 22 Nov 2019 04:16:00 -0800 (PST)
From: Torsten Lodderstedt <torsten@lodderstedt.net>
Message-Id: <1FD6E2DF-013A-4F42-862B-ADEF45EAE689@lodderstedt.net>
Content-Type: multipart/signed; boundary="Apple-Mail=_8202B533-C1CC-473F-85C8-EFDE7004B350"; protocol="application/pkcs7-signature"; micalg=sha-256
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3601.0.10\))
Date: Fri, 22 Nov 2019 20:15:49 +0800
In-Reply-To: <D43D3929-F1B7-4A2C-ABEC-1326F3F0926C@forgerock.com>
Cc: Justin Richer <jricher@mit.edu>, oauth <oauth@ietf.org>
To: Neil Madden <neil.madden@forgerock.com>
References: <2EF412B8-AF8C-4642-9BE0-1B528B0C63D5@amazon.com> <288343F2-ACF0-43E0-8577-26AF45330E5C@forgerock.com> <CAD9ie-u_SM+1hRuBWR7zBGSi4Ex59Ht0SzoVTeFuWTRc3cFJXw@mail.gmail.com> <6DECA422-AACC-4DAA-8CD2-FF57CE02DE3E@mit.edu> <0235F8A2-83C4-4804-8805-F50305E263BB@lodderstedt.net> <D43D3929-F1B7-4A2C-ABEC-1326F3F0926C@forgerock.com>
X-Mailer: Apple Mail (2.3601.0.10)
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/7VN6wRYEH1FDuHOuXeCFakK2yr8>
Subject: Re: [OAUTH-WG] New Version Notification for draft-fett-oauth-dpop-03.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 Nov 2019 12:16:09 -0000

Hi Neil,

> On 22. Nov 2019, at 18:08, Neil Madden <neil.madden@forgerock.com> wrote:
> 
> On 22 Nov 2019, at 07:53, Torsten Lodderstedt <torsten=40lodderstedt.net@dmarc.ietf.org> wrote:
>> 
>> 
>> 
>>> On 22. Nov 2019, at 15:24, Justin Richer <jricher@mit.edu> wrote:
>>> 
>>> I’m going to +1 Dick and Annabelle’s question about the scope here. That was the one major thing that struck me during the DPoP discussions in Singapore yesterday: we don’t seem to agree on what DPoP is for. Some (including the authors, it seems) see it as a quick point-solution to a specific use case. Others see it as a general PoP mechanism. 
>>> 
>>> If it’s the former, then it should be explicitly tied to one specific set of things. If it’s the latter, then it needs to be expanded. 
>> 
>> as a co-author of the DPoP draft I state again what I said yesterday: DPoP is a mechanism for sender-constraining access tokens sent from SPAs only. The threat to be prevented is token replay.
> 
> I think the phrase "token replay" is ambiguous. Traditionally it refers to an attacker being able to capture a token (or whole requests) in use and then replay it against the same RS. This is already protected against by the use of normal TLS on the connection between the client and the RS. I think instead you are referring to a malicious/compromised RS replaying the token to a different RS - which has more of the flavour of a man in the middle attack (of the phishing kind).

I would argue TLS basically prevents leakage and not replay. The threats we try to cope with can be found in the Security BCP. There are multiple ways access tokens can leak, including referrer headers, mix-up, open redirection, browser history, and all sorts of access token leakage at the resource server

Please have a look at https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-4.

https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-4.8 also has an extensive discussion of potential counter measures, including audience restricted access tokens and a conclusion to recommend sender constrained access tokens over other mechanisms.

> 
> But if that's the case then there are much simpler defences than those proposed in the current draft:
> 
> 1. Get separate access tokens for each RS with correct audience and scopes. The consensus appears to be that this is hard to do in some cases, hence the draft.

How many deployments do you know that today are able to issue RS-specific access tokens?
BTW: how would you identify the RS?

I agree that would be an alternative and I’m a great fan of such tokens (and used them a lot at Deutsche Telekom) but in my perception this pattern needs still to be established in the market. Moreover, they basically protect from a rough RS (if the URL is used as audience) replaying the token someplace else, but they do not protect from all other kinds of leakage/replay (e.g. log files).

> 2. Make the DPoP token be a simple JWT with an "iat" and the origin of the RS. This stops the token being reused elsewhere but the client can reuse it (replay it) for many requests.
> 3. Issue a macaroon-based access token and the client can add a correct audience and scope restrictions at the point of use.

Why is this needed if the access token is already audience restricted? Or do you propose this as alternative? 

> 
> Protecting against the first kind of replay attacks only becomes an issue if we assume the protections in TLS have failed. But if DPoP is only intended for cases where mTLS can't be used, it shouldn't have to protect against a stronger threat model in which we assume that TLS security has been lost.

I agree. 

best regards,
Torsten. 

> 
> -- Neil