IETF Logo Mail Archive

Re: [OAUTH-WG] Mix-Up and CnP/ Code injection

Daniel Fett <fett@uni-trier.de> Thu, 05 May 2016 14:27 UTC

Return-Path: <prvs=926009313=fett@uni-trier.de>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD05712D862 for <oauth@ietfa.amsl.com>; Thu, 5 May 2016 07:27:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.196
X-Spam-Level:
X-Spam-Status: No, score=-5.196 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.996] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Px2rBf2y8RPP for <oauth@ietfa.amsl.com>; Thu, 5 May 2016 07:27:56 -0700 (PDT)
Received: from mx1.uni-trier.de (mx1.uni-trier.de [136.199.224.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B94D12DA18 for <oauth@ietf.org>; Thu, 5 May 2016 07:20:44 -0700 (PDT)
X-IronPort-AV: E=Sophos;i="5.24,582,1454972400"; d="scan'208";a="20168735"
Received: from rzmail.uni-trier.de ([136.199.8.220]) by mx1i.uni-trier.de with ESMTP; 05 May 2016 16:20:43 +0200
Received: from [136.199.52.39] (infsec39.uni-trier.de [136.199.52.39]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by rzmail.uni-trier.de (Postfix) with ESMTPSA id 8FD7D408FE for <oauth@ietf.org>; Thu, 5 May 2016 16:20:43 +0200 (CEST)
To: oauth@ietf.org
References: <571B60BA.8090301@lodderstedt.net>
From: Daniel Fett <fett@uni-trier.de>
Message-ID: <572B56BB.9080903@uni-trier.de>
Date: Thu, 05 May 2016 16:20:43 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.7.2
MIME-Version: 1.0
In-Reply-To: <571B60BA.8090301@lodderstedt.net>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/rfgtHvNejxCvQu2FSwlYxXxQ6RQ>
Subject: Re: [OAUTH-WG] Mix-Up and CnP/ Code injection
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 May 2016 14:27:58 -0000

Am 23.04.2016 um 13:47 schrieb Torsten Lodderstedt:
> I'm very much interested to find a solution within the OAuth realm as
> I'm not interested to either implement two solutions (for OpenId Connect
> and OAuth) or adopt a OpenId-specific solution to OAuth (use id! tokens
> in the front channel). I therefore would like to see progress and
> propose to continue the discussion regarding mitigations for both threats.
> 
> https://tools.ietf.org/html/draft-ietf-oauth-mix-up-mitigation-00
> proposes reasonable mitigations for both attacks. There are alternatives
> as well:
> - mix up:
> -- AS specific redirect uris
> -- Meta data/turi
> (https://tools.ietf.org/html/draft-sakimura-oauth-meta-07#section-5)
> - CnP:
> -- use of the nonce parameter (as a distinct mitigation beside state for
> counter XSRF)

>From our formal analysis of OAuth we are pretty confident that the
mitigation proposed in draft-ietf-oauth-mix-up-mitigation-00 should be
sufficient against the Mix-Up attack.

Cheers,
Daniel


-- 
Informationssicherheit und Kryptografie
Universität Trier - Tel. 0651 201 2847 - H436

v2.23.0 | Report a Bug | By Email