Re: [GNAP] Defense protection

Hi Kathleen, thanks so much for raising this topic! It’s important that GNAP learn from what’s come before.

Some aspects of that are already built into the design, based on what we’ve learned form years of OIDC and SAML deployments. One of the things that made the SAML attacks work was that the fake assertions could be easily injected into SP’s (the relying party equivalent) with a browser request by the attackers. GNAP already doesn’t allow injection of results (such as assertions) over the front channel, so an attacker would need to run an in-the-middle attack against the AS and return the faulty assertion as well. Properly configured OIDC (with state and nonce) has some similar protections, but even then it’s more easily misconfigured.

I agree that the detection of unusual events needs to be part of the protocol. Maybe we should have more language about the direct information return — things like assertions and subject information — and explicitly tell clients that they shouldn’t accept that information from unexpected calls of any type? We might also want to lock down the callback function from extensions so that people don’t re-invent the implicit flow and all its problems.

I don’t know if there’s anything that can be done around protecting against key theft. The key is the identity of the component proven through the protocol. Do you have suggestions on how this can be called out more? The security considerations section is just a placeholder still, and it seems that would be a good place for it, to me.

 — Justin

> On May 28, 2021, at 3:28 PM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:
> 
> Hello!
> 
> In light of recent attacks against SAML and OAuth, I'd like to see what defense mechanisms and detection could be built into the spec.  One example would be from the recent SAML attack.  If there was a detection of instances of authorization without authentication, the SAML attack used in SolarWinds might have been detected sooner.
> 
> If you think along the lines of fraud detection, where you detect unusual events, there may be some specific to GNAP that could enable early detection of abuse, misuse, or exploits.
> 
> Are there some planned?  Would people like to brainstorm on this?
> Thanks!
> 
> -- 
> 
> Best regards,
> Kathleen
> -- 
> TXAuth mailing list
> TXAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth