Re: [Unbearable] 0-RTT Token Binding: When to switch exporters?

[Nick Harper <[e-mail]>]

On Tue, Mar 21, 2017 at 10:07 AM, Andrei Popov
<[e-mail]> wrote:
> The rules for the switch from 0-RTT EKM to the proper EKM are becoming
> fairly complex and hard-to-enforce.

We can make these rules much simpler if we use the 0-RTT exporter for
all token bindings on a connection where the server accepted 0-RTT
data.
>
> On the other hand, the use of 0-RTT EKM, generally, makes bound tokens
> replayable.
>
>
>
> I think that a server that cares enough about token replay to enable TB (and
> verify extra signatures) should not accept 0-RTT (at least with those
> clients that offer TB).

This depends on what the server's threat model is, and there are
servers that will choose to enable both TB and 0-RTT on the same
connection and accept the slightly weaker security properties.

There are two kinds of replay to consider with 0-RTT TB:

First is a network attacker retransmitting a ClientHello and early
data, i.e. repeating the exact same application message. This replay
problem exists without TB. A server that chooses to enable 0-RTT has
already mitigated this replay by e.g. including a nonce in requests so
that a replayed request is idempotent or otherwise deciding that the
0-RTT replay is acceptable.

Second replay of a TokenBinding message on a new connection (where the
exporter is the same). This involves client malware, which can just as
easily do private key operations to generate new TokenBinding messages
to use on new connections. In TBPROTO, this is also possible, but it
can only be done for active connections. With 0-RTT, the attacker can
do this for connections that will be created up to 7 days in the
future.

If a server's threat model does not include client malware, i.e. the
server is only using Token Binding to protect against attacks like XSS
(e.g. to protect cookies without the HttpOnly flag set, or OAuth
tokens), then enabling both TB and 0-RTT is perfectly reasonable.
Depending on the server's policies, even if client malware is in its
threat model it still could find the 7 day window acceptable.
>
>
>
> Cheers,
>
>
>
> Andrei
>
>
>