Re: [Unbearable] Fwd: I-D Action: draft-ietf-tokbind-ttrp-01.txt

[Vladimir Dzhuvinov <[e-mail]>]

To me forgetting to configure scrubbing of the headers is the worst
thing that can potentially happen in a TLS terminating proxy setup.

When implementing mTLS we decided to make the header names configurable,
and insist on them having a random portion, to make them hard to guess,
e.g. X-Client-X509-Cert-alaeLuL8geiqu3OhOg1Mafa4Ecu9ahsh. The prefix was
put there to ease debugging. By doing this the header name essentially
becomes a secret, shared between the TLS proxy and the backend server.
Someone probing the TLS proxy to see if scrubbing was accidentally left
out will have a much harder job with this.

I don't know if something like that was discussed in Prague. I
understand that there's great interop value in making header names
standard. The downside of having set header names is that attacks on
badly configured TLS proxies become much easier to carry out. This is my
concern about the TTRP spec in this form.

Thanks,

Vladimir


On 02/08/17 20:59, Brian Campbell wrote:
> Just published the -01 draft of "HTTPS Token Binding with TLS Terminating
> Reverse Proxies" with the changes listed below.  Use of the "Sec-" prefix
> for the header names is the only big change and I didn't want to wait long
> on getting a draft out that has the new header names.
>
>    draft-ietf-tokbind-ttrp-01
> <https://tools.ietf.org/html/draft-ietf-tokbind-ttrp-01>
>
>    o  Prefix the header names with "Sec-" so that they are denoted as
>       forbidden header names by Fetch https://fetch.spec.whatwg.org/
>
>    o  Removed potentially confusing sentence from Security
>       Considerations per
>       https://mailarchive.ietf.org/arch/msg/unbearable/
> <https://mailarchive.ietf.org/arch/msg/unbearable/O0IpppyyEqMrQjEkyEi8p8CeBGA>
>       O0IpppyyEqMrQjEkyEi8p8CeBGA
> <https://mailarchive.ietf.org/arch/msg/unbearable/O0IpppyyEqMrQjEkyEi8p8CeBGA>
>
>    o  Editorial fixes.
>
>
>
> ---------- Forwarded message ----------
> From: <[e-mail]>
> Date: Wed, Aug 2, 2017 at 11:52 AM
> Subject: [Unbearable] I-D Action: draft-ietf-tokbind-ttrp-01.txt
> To: [e-mail]
> Cc: [e-mail]
>
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the Token Binding WG of the IETF.
>
>         Title           : HTTPS Token Binding with TLS Terminating Reverse
> Proxies
>         Author          : Brian Campbell
>         Filename        : draft-ietf-tokbind-ttrp-01.txt
>         Pages           : 10
>         Date            : 2017-08-02
>
> Abstract:
>    This document defines common HTTP header fields that enable a TLS
>    terminating reverse proxy to convey information about the validated
>    Token Binding Message sent by the client to a backend server, which
>    enables that backend server to bind, or verify the binding of,
>    cookies and other security tokens to the client's Token Binding key.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-tokbind-ttrp/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-tokbind-ttrp-01
> https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-ttrp-01
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-ttrp-01
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> Unbearable mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/unbearable
>
>
>