Re: [rtcweb] Regarding the assertion mechanism in the new security draft

[Eric Rescorla <[e-mail]>]

On Fri, Nov 11, 2011 at 7:42 AM, Oscar Ohlsson
<[e-mail]> wrote:
> Eric,
>
> I read through your latest security draft and I found the the assertion mechanism described in the Appendix very interesting. One thing I didn't quite understand though is why the ROAP session ID needs to be included in the assertion. As far as I can tell you only need to assert the fingerprint. I would appreciate if you could explain your reasoning here.

Thanks!

I should probably admit at this point that I haven't done a complete
security analysis
of the assertion-based system, so exactly what fields need to be
signed is, I think
a bit of an open question. I tried to make the level of maturity clear
in my draft,
but I'm not certain I did.

With that said, my theory there was that it would be a good idea to
cryptographically
bind the assertion to this specific session rather than just to the
identity in general.
This prevents replay style attacks. However, as you suggest, it's not entirely
clear how one would go about mounting such an attack without simultaneously
controlling enough keying material so you could do anything. Do you
see a downside
to signing this data?

Best,
-Ekr