[OAUTH-WG] security considerations for draft-ietf-oauth-mtls-12
John-Mark Gurney <jmg+oauth@newcontext.com> Wed, 31 October 2018 22:12 UTC
Return-Path: <john-mark.gurney@newcontext.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1169A130DDA for <oauth@ietfa.amsl.com>; Wed, 31 Oct 2018 15:12:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=newcontext.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c_-6IqZS4zXp for <oauth@ietfa.amsl.com>; Wed, 31 Oct 2018 15:12:34 -0700 (PDT)
Received: from mail-pl1-x62d.google.com (mail-pl1-x62d.google.com [IPv6:2607:f8b0:4864:20::62d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 644EB130DD4 for <oauth@ietf.org>; Wed, 31 Oct 2018 15:12:34 -0700 (PDT)
Received: by mail-pl1-x62d.google.com with SMTP id bh10-v6so7939500plb.4 for <oauth@ietf.org>; Wed, 31 Oct 2018 15:12:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=newcontext.com; s=google; h=mime-version:from:date:message-id:subject:to; bh=kxfAPBlYQLaILwD8W9B1OeHRNHSjy0ctSTo9egcpU/s=; b=H1D3+7TFt1yETzygkIK7K3OGyhRrbSwPvjLNvckjMphFdzfl03X4CGSFpjGxcKEWy+ SvHMNhl8i9dy3OFXt/rWzbHoKbxgJs5PimqB37/PEe5lGEEcX1O93k7zT+ZjLJuEuqmR 5PIWNouFwzndMWfGiHdx9vv1V5M79hXlUXYwmFwQf7Di5lHDp2SftPHi7f7QXP501Udb 2tso472SleBTFfJE64b8Ds9TgylLf3vlobgQRwnOJo6hindjrut2cl/hRHLX+V7Bmfga ce7VofZlCmxL1o462JuR9HY+PMrQE1cO36exEouzBXxDuiduH5llFXrtSOyJJW3E7/eN 3MPQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=kxfAPBlYQLaILwD8W9B1OeHRNHSjy0ctSTo9egcpU/s=; b=YgV6ySRR73pXx1TaZXrScfUus9kqycFvETIqzaTiQkFoG2bHYPUmjy0278AdfClYx4 7JX+Fq7Z9yDgr0R8f4KVo2GzUPNTnJMUUmxqoJ++jM57pDtuECR0rDOueYGMyl09uapc klxNZV0oH38voLhAj8geHRVDODUgYZSSXdkWdaus2isvBPNyJoZ5ywxS8GMKDqQfC74r 7Vj9ziHJp9YpWe6sJjji9HevCkVUWeCSM06sj+zRIX1LBMYIW5qFVkzXeZnBUwk1rwGA PgCBbhbbOSl1v/pV9yCfOiPFF0VcYQQv8lOxegh+Y3XEwwPVnI4eUgmRo4B4SyMzAPOJ R0/A==
X-Gm-Message-State: AGRZ1gIb3cxQv7Jp2Ut/6Ci1g79frEvf9IlfDp/UdgA/Y8gl2v3sokxu nYd3v9zwkgwI0UQ+k7h2hwUGnevG7lk3vn1pNbHfEeX+o14=
X-Google-Smtp-Source: AJdET5eb67C2UKeGMUc8wEt1c0KnA6BYBQ66XImndAwVyuWytmHV4oGLLvRHjiU7guWC2bazHugmZjzRoskvr22nQlQ=
X-Received: by 2002:a17:902:2ec1:: with SMTP id r59-v6mr5063705plb.243.1541023953631; Wed, 31 Oct 2018 15:12:33 -0700 (PDT)
MIME-Version: 1.0
From: John-Mark Gurney <jmg+oauth@newcontext.com>
Date: Wed, 31 Oct 2018 15:12:22 -0700
Message-ID: <CALgdmdsoj9uaVyha5x7anxt4iU_0f8FqyfjNH00Syd-MKSQ_UQ@mail.gmail.com>
To: oauth@ietf.org
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/sewmoUYKw5srwGL7HpIZIS_2ONk>
Subject: [OAUTH-WG] security considerations for draft-ietf-oauth-mtls-12
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 31 Oct 2018 22:12:36 -0000
I would suggest that the security considerations section of draft-ietf-oauth-mtls-12 be expanded to include the privacy implications of using this on versions of TLS before 1.3. On all versions of TLS before 1.3, the client cert is not encrypted and can be used by third parties to monitor and track users. I recently posted a blog entry about this: https://blog.funkthat.com/2018/10/tls-client-authentication-leaks-user.html Thanks. John-Mark Gurney
- [OAUTH-WG] security considerations for draft-ietf… John-Mark Gurney
- Re: [OAUTH-WG] security considerations for draft-… Brian Campbell
- Re: [OAUTH-WG] security considerations for draft-… Neil Madden
- Re: [OAUTH-WG] security considerations for draft-… Nat Sakimura
- Re: [OAUTH-WG] security considerations for draft-… John-Mark Gurney
- Re: [OAUTH-WG] security considerations for draft-… John-Mark Gurney
- Re: [OAUTH-WG] security considerations for draft-… Nomad On Walkabout
- Re: [OAUTH-WG] security considerations for draft-… Brian Campbell