Re: [Unbearable] SECDIR early review of draft-ietf-tokbind-tls13-00

Nick Harper <> Mon, 02 April 2018 20:26 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id C31CF12D892 for <>; Mon, 2 Apr 2018 13:26:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.71
X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id dtoiAUi5avq9 for <>; Mon, 2 Apr 2018 13:26:13 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:400d:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 6BC4012D890 for <>; Mon, 2 Apr 2018 13:26:13 -0700 (PDT)
Received: by with SMTP id o205so16372046qke.3 for <>; Mon, 02 Apr 2018 13:26:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Qa4XekDVlg5P37HqInwzx964hqqCz48qo0IXi2XDUiQ=; b=D7ium78SbGQbrcvaJT9elgGFtkUWVL4ZHatw5uvTHSpP5Th5eViKecUO0Nr6c0BM8t YgLattHMutXbXJTJV18CXnFh+fiXFhjCmR1Cde+DNARf0asdT6xx8moiaVfG6Zyuqt2u ZDR9r9cODJQD5sMirriF2RvCz8Oo83mrKH4aTKj3WmRUviyjuyP/uvFGXLYxsNvj6+K+ JLOCJnVFi1iDcVKLoKrC7dTuq1Bn2chQUA293OiISwMfu4Dqp2ZumKUa311cDH/1k7Jc FaNbHiOzHDj3Ymg6HvnhfwYqWshG/4dvFALvGN8cyOJXFbip1Qx26Z15qUbYtbbpFVGu b2dg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Qa4XekDVlg5P37HqInwzx964hqqCz48qo0IXi2XDUiQ=; b=r95nX1zmvrAcmpuk9YPiTA+9XdJ15H4s/VMfvj5YeiyXTmNjt5qH7Tq3PWdo2NjqOD CC4W39Tz9DwfuyX6fXM5Z7r9tyNJ6ElMzveYlvztDdmzjQmbLkC5AsxWtRbfqt5hZ4id 7iGe0J6DB/m5KORtn6kEh14IDskWMUhITLFllQn0cxoVfElnhLSHE3Yl96nS+KjjDwzw t80xtGN5hOgMa40TGPYQIRQpkpsJEclPAmhfJsskeGTGKQ6FScSEZYFVQOSIVimZu1VR W0aFwVvhZ85Sj9SQiDZgY5IxDpWgIoTsjRvg8nzXc30iNowiCmBeFx47qKc8Du8TKa4E u4WA==
X-Gm-Message-State: ALQs6tDxd3EM0MMfHb6udPjisamANzSF8xalv6/Hki2Qz6V95aJg14kc y3sv/hCWnrlLtcoY6oLcj+VRwVdaYQYGSRH6x93kDQ==
X-Google-Smtp-Source: AIpwx4/YkTvaVYK3DctdJJ1vsDW7qhjMqWGG6A0Qcw9N4EwCe9KQyluKDfzdG3KmGoelVlBobmier2OznDYNNqB9wLE=
X-Received: by with SMTP id o2mr14959245qkd.298.1522700771952; Mon, 02 Apr 2018 13:26:11 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Mon, 2 Apr 2018 13:25:51 -0700 (PDT)
In-Reply-To: <>
References: <>
From: Nick Harper <>
Date: Mon, 02 Apr 2018 13:25:51 -0700
Message-ID: <>
To: Stephen Kent <>
Cc:, Leif Johansson <>,, IETF Tokbind WG <>, Eric Rescorla <>
Content-Type: multipart/alternative; boundary="94eb2c06252a9d436c0568e366b5"
Archived-At: <>
Subject: Re: [Unbearable] SECDIR early review of draft-ietf-tokbind-tls13-00
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 02 Apr 2018 20:26:17 -0000

On Thu, Mar 22, 2018 at 8:00 AM, Stephen Kent <> wrote:

> SECDIR *early* review of draft-ietf-tokbind-tls13-00
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.  These
> comments were written with the intent of improving security requirements
> and considerations in IETF drafts.  Comments not addressed in last call
> may be included in AD reviews during the IESG review.  Document editors
> and WG chairs should treat these comments just like any other last call
> comments.
> This (very brief) document defines how to negotiate Token Binding for TLS
> v1.3. Existing IETF documents (IDs) define this protocol and how to
> negotiate it capability only for earlier versions of TLS.
> The first question that comes to mind is why there is a need for a new ID,
> instead of adding text to draft-ietf-tokbind-negotiation-10. I realize
> that draft-ietf-tokbind-negotiation-10 is in last call, but the text here
> is so small that it seems overkill to create a separate RFC. I’m guessing
> that the argument is that this document references TLS 1.3, which is not
> yet an RFC, and thus the author is trying to avoid creating a down
> reference problem with draft-ietf-tokbind-negotiation-10. Right?

That sounds right. My recollection of WG discussions on whether to add this
TLS 1.3 language to draft-ietf-tokbind-negotiation was that it was unclear
how the tokbind drafts would get sequenced with respect to
draft-ietf-tls-tls13 in IETF last call and the RFC Editor's queue, and
didn't want the tokbind drafts to get delayed waiting for
draft-ietf-tls-tls13 to get published.

> Section 2 notes that the format of the extension is the same as defined in
> draft-ietf-tokbind-negotiation-10, so nothing new there. The section
> cites two differences from the behavior in draft-ietf-tokbind-negotiation-10,
> which are described in just two sentences. Section 3 adds one paragraph to
> deal with 0-RTT, a TLS 1.3 feature not present in earlier versions.  Section
> 4 is non-normative, but, presumably useful. The security concerns are
> asserted to be the same as for draft-ietf-tokbind-negotiation-10, plus a
> sentence discussing why the 0-RTT exclusion avoids other potential security
> concerns.
> So, if folks don’t want to delay publication of draft-ietf-tokbind-negotiation-10,
> I guess this is OK as a separate document, updating that RFC.