Re: [OAUTH-WG] HTTP signing spec and nonce
Dominick Baier <dbaier@leastprivilege.com> Sat, 27 February 2016 07:06 UTC
Return-Path: <dbaier@leastprivilege.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09D8C1B3693 for <oauth@ietfa.amsl.com>; Fri, 26 Feb 2016 23:06:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hVPZxWwIXXMm for <oauth@ietfa.amsl.com>; Fri, 26 Feb 2016 23:06:38 -0800 (PST)
Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com [IPv6:2a00:1450:400c:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C61E61B361B for <oauth@ietf.org>; Fri, 26 Feb 2016 23:06:37 -0800 (PST)
Received: by mail-wm0-x231.google.com with SMTP id p65so11066476wmp.1 for <oauth@ietf.org>; Fri, 26 Feb 2016 23:06:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leastprivilege-com.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:message-id:in-reply-to:references:subject :mime-version; bh=gdDsjHXa/KK/DAQNSCLyGRhfvjPShunveIl7jW3c9ak=; b=kp05ILhFqYR1buIX9ycGl82LmiDh1998tzZ+powuHMdiSph0gEdOwwMnNwFaSz0bxA +LTkORMJl3vF/9W1e9lSi858bCvDdlZJGkUbeGOz49Dazft9fJgesuz3kA3nbC4nn2b3 RaMtEzMd92u9cAn1/La0gCyQXr5f4tnLuuf2ZXFn7pWZgUuvaXaIJ/zB0imO5j7NXOaP 2dTB90wURg/NQi7VD79keXByTWU7Z3Uiq4q0eFxs5B9QNBKcu1zkk+jTPTgbesIer9ha PDPIcYV/9XZHIfZ0+kLfdpbAmU/eb71YTSBUch5Lc9igRvqlHuRcQyoJulbZNniwlbAk siuw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:message-id:in-reply-to :references:subject:mime-version; bh=gdDsjHXa/KK/DAQNSCLyGRhfvjPShunveIl7jW3c9ak=; b=WvP5wskaQa1eY0SShZiqQo9f7Gdpy2BxFhliL6bumcSjPN6g0Nrrdplvt77ApSjGGL zxMnBwEIpXgXGj3XxsHvSG6Ia1zLqu3pGetxTbgw9ssyJU1VEj4tSBayrlMmfkqLFasp XU9rICzUCKNSrdaLz0eimS+SqokPsy9MIazFvUMROxaQBaVjwjI1FzQrgoezYZBdxmxe GFQtjsu+3eqcu3i5MfQ1YBEe2flnW8c7W0B3bBPQNirwEBqJg3hMoYeVL9HzMlKjR+B5 IPe2VqNPDgiApAS7y8UogCk8j4Kw4PSMrXt7PMt2ClsfNeszGHslo2n72lk5HVIeroA2 o0SQ==
X-Gm-Message-State: AD7BkJLfMVIgkntTjPHpBEorX/d4EEnrtFm6JcjCafA6YEbmaaYXbLS+TIGgbNn83V7lZw==
X-Received: by 10.28.73.66 with SMTP id w63mr1694811wma.53.1456556796331; Fri, 26 Feb 2016 23:06:36 -0800 (PST)
Received: from dombp.fritz.box (p5087A4AF.dip0.t-ipconnect.de. [80.135.164.175]) by smtp.gmail.com with ESMTPSA id xx3sm15445379wjc.32.2016.02.26.23.06.34 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 26 Feb 2016 23:06:34 -0800 (PST)
Date: Sat, 27 Feb 2016 08:06:33 +0100
From: Dominick Baier <dbaier@leastprivilege.com>
To: Justin Richer <jricher@mit.edu>, Brock Allen <brockallen@gmail.com>
Message-ID: <etPan.56d14afa.11e44d1b.12e86@dombp.fritz.box>
In-Reply-To: <69709F83-8D24-44DE-9A3B-D3BF8F70C201@mit.edu>
References: <008201d170a4$f5216910$df643b30$@gmail.com> <69709F83-8D24-44DE-9A3B-D3BF8F70C201@mit.edu>
X-Mailer: Airmail (351)
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="56d14afa_62750943_12e86"
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/OwIE0zr32ZtszH23bmJWmX1ZlYI>
Cc: "<oauth@ietf.org>" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] HTTP signing spec and nonce
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 27 Feb 2016 07:06:40 -0000
The nonce would allow to build a replay cache, the timestamp to trim that cache and reject messages that are too old. Similar protocols have a nonce for the above reasons (ws-sec msg security, hawk)... — cheers Dominick Baier On 27 February 2016 at 03:48:00, Justin Richer (jricher@mit.edu) wrote: I’d be glad to add in a nonce if there’s a compelling reason for it, such as closing a security attack vector. What’s the proposed purpose of the nonce? Is it just to add randomness to the signing base? Or is it to prevent replay at the RS? If the former, the timestamp should add enough of that and it can be verified to be within a reasonable window by the RS by comparing it with the time the request was made. If the latter, the RS is going to have to track previously used nonces for some amount of time. There was a small discussion of just signing an outgoing “Date:” header instead of the separate timestamp, but the timestamp seemed to be more robust. I forget the full reasoning though. — Justin On Feb 26, 2016, at 9:49 AM, Brock Allen <brockallen@gmail.com> wrote: Question about the HTTP signing spec – why is there no nonce (and just a timestamp)? TIA -Brock _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
- [OAUTH-WG] HTTP signing spec and nonce Brock Allen
- Re: [OAUTH-WG] HTTP signing spec and nonce Justin Richer
- Re: [OAUTH-WG] HTTP signing spec and nonce Dominick Baier
- Re: [OAUTH-WG] HTTP signing spec and nonce Justin Richer
- Re: [OAUTH-WG] HTTP signing spec and nonce Samuel Erdtman