Re: [Unbearable] reviewing our 00's

Done. I've also added issue 12, based on implementation experience:

Token Binding ID includes tokenbinding_type field to indicate whether this is a Provided or Referred binding.

In the federation scenario, the client proves possession of the same Krp to the RP (as Provided binding) and to the IDP (as Referred binding). If the IDP includes the Referred Token Binding ID in the token, the RP cannot directly compare it with the Provided Token Binding ID established with the client, because the first byte of the ID (tokenbinding_type) will be different.

We should provide guidance on this in draft-ietf-tokbind-https to avoid confusion. The easiest thing to do is probably to exclude tokenbinding_type when comparing Token Binding IDs.

Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Leif Johansson
Sent: Monday, April 20, 2015 11:56 PM
To: unbearable@ietf.org
Subject: Re: [Unbearable] reviewing our 00's

On 04/20/2015 11:54 PM, Andrei Popov wrote:
> Hi Ilari,
> 
> 1) Agreement has been reached in Dallas that we will define a new TLS extension to negotiate Token Binding key parameters, instead of using ALPN. I hope to publish a new I-D for the TLS extension, and update  draft-ietf-tokbind-protocol in the next 2-3 weeks.
> 

Why don't you make a note in the appropriate issue to this fact so we don't have to revisit.

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable