Re: [rtcweb] Possible identity security vulnerability

I think this might somewhat be addressed here:
https://tools.ietf.org/html/draft-ietf-rtcweb-security-10#section-4.4.1

spt

> On Mar 19, 2018, at 10:43, Martin Thomson <martin.thomson@gmail.com> wrote:
> 
> As a practical matter, if the browser were to use the same certificate
> for multiple origins, then it would create a massive privacy problem
> that enables linkability (aka user tracking).  I couldn't find that
> written down, but I thought it was.  If it isn't written down, then we
> should correct that.
> 
> On Mon, Mar 19, 2018 at 1:57 PM, Sergio Garcia Murillo
> <sergio.garcia.murillo@gmail.com> wrote:
>> On 19/03/2018 14:45, westhawk wrote:
>> 
>> On 19 Mar 2018, at 13:40, Martin Thomson <martin.thomson@gmail.com> wrote:
>> 
>> It's anything that *the site* initiates (not so much the browser).
>> Certificates are origin-scoped.
>> 
>> Are they? is the private key needed in the re-use of the assertion?
>> (I haven’t looked at this for ages)
>> If not the you could push the ASN1 of the public cert somewhere not scoped
>> to the
>> origin and have another site re-use it. (e.g. transfer it to an advert
>> iframe with postmessage)
>> 
>> 
>> After checking if further, that may not be clearly explicit on the webrtc
>> w3c spec:
>> 
>> For the purposes of this API, the [[Certificate]] slot contains unstructured
>> binary data. No mechanism is provided for applications to access the
>> [[KeyingMaterial]] internal slot. Implementations MUST support applications
>> storing and retrieving RTCCertificate objects from persistent storage. In
>> implementations where an RTCCertificate might not directly hold private
>> keying material (it might be stored in a secure module), a reference to the
>> private key can be held in the [[KeyingMaterial]] internal slot, allowing
>> the private key to be stored and used.
>> 
>> So it is not clear to me if certificates are origin-scoped or if the key
>> materials could be exported outside of the browser. Worst case, certificate
>> could be exported and identity assertion reused even by a different service.
>> 
>> Best regards
>> Sergio
>> 
> 
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb