Re: [Unbearable] WGLC 3 on core documents

[Nick Harper <[e-mail]>]

The client collusion scenario is about one client exporting a bound token
for another client to use. This bound token is a security token, and
reusing the token (whether it is on the same client or another client) is
replaying it. Hence, "Security Token Replay" is a perfectly appropriate
section for those sentences. They don't need their own section.

On Mon, Feb 27, 2017 at 1:19 AM, Denis <[e-mail]> wrote:

> Comments on draft-ietf-tokbind-protocol-13 (The Token Binding Protocol
> Version 1.0)
>
> On page 14 within the Security Considerations section, I appreciate the
> fact that the following sentences have been added:
>
> *   The Token Binding protocol does not prevent cooperating clients from*
> *   sharing a bound token.  A client could intentionally export a bound*
> *   token with the corresponding Token Binding private key, or perform*
> *   signatures using this key on behalf of another client.*
>
>
> However, these sentences have been placed inside section 7.1. which is
> called "Security Token Replay".
>
> This security consideration has nothing to do with "Security Token Replay"
> but with "Client collusion".
>
> Therefore, these sentences should be placed under a new section called:
> "7.2. Client collusion".
>
> ============================================================
> ==========================
>
> Comments on draft-ietf-tokbind-https-08 (Token Binding over HTTP)
>
> On page 14 within the Security Considerations section, the same kind of
> change as the one requested
> for draft-ietf-tokbind-protocol-13 (The Token Binding Protocol Version
> 1.0) should be done, i.e. add a new section
> called: "7.2. Client collusion" with the following text :
>
>
>
>
> *   Token Binding over HTTP does not prevent cooperating clients from
> sharing a bound token.  A client could intentionally export a bound
> token with the corresponding Token Binding private key, or perform
> signatures using this key on behalf of another client.*
>
>
> Denis
>
> _______________________________________________
> Unbearable mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/unbearable
>
>