Re: [Unbearable] Fwd: I-D Action: draft-ietf-tokbind-ttrp-01.txt

Vladimir Dzhuvinov <vladimir@connect2id.com> Thu, 03 August 2017 13:33 UTC

Return-Path: <vladimir@connect2id.com>
X-Original-To: unbearable@ietfa.amsl.com
Delivered-To: unbearable@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89057131FF2 for <unbearable@ietfa.amsl.com>; Thu, 3 Aug 2017 06:33:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.699
X-Spam-Level:
X-Spam-Status: No, score=-4.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sw51nA9pSc4X for <unbearable@ietfa.amsl.com>; Thu, 3 Aug 2017 06:33:42 -0700 (PDT)
Received: from p3plsmtpa06-02.prod.phx3.secureserver.net (p3plsmtpa06-02.prod.phx3.secureserver.net [173.201.192.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B438131FE7 for <unbearable@ietf.org>; Thu, 3 Aug 2017 06:33:32 -0700 (PDT)
Received: from [192.168.0.101] ([78.130.190.73]) by :SMTPAUTH: with SMTP id dGFGd6DtncYpUdGFIdQ9z9; Thu, 03 Aug 2017 06:33:00 -0700
To: unbearable@ietf.org
References: <150169636325.5791.16128248741008174399@ietfa.amsl.com> <CA+k3eCRkVoHD_QawfH4fPZJB-WtG=X_zORP0LHV7nD_54qE5Hg@mail.gmail.com>
From: Vladimir Dzhuvinov <vladimir@connect2id.com>
Organization: Connect2id Ltd.
Message-ID: <0618fbec-ce24-d608-bab8-b1a2a24ece47@connect2id.com>
Date: Thu, 3 Aug 2017 16:32:27 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1
MIME-Version: 1.0
In-Reply-To: <CA+k3eCRkVoHD_QawfH4fPZJB-WtG=X_zORP0LHV7nD_54qE5Hg@mail.gmail.com>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms060605020301070509040501"
X-CMAE-Envelope: MS4wfMpOarkNdbMl/PIFUm7kERyTFTx/vo4626vuvQdXLrAgI9VRwFbJtmiBxIFuJKYnuEU/G2MJhCvn29VgtwabrRdE6KuZpcRp4Yr650XPnszxzHxSRbZQ h3dTpcVAkETWB8XaAG1aJqd3lk5EVFqzqzXe3CJq4HozfgvGP1iwdvKkazuGoqOpFe7jb4KcBeygUA==
Archived-At: <https://mailarchive.ietf.org/arch/msg/unbearable/J3NPcg0dolWNskKD7Jxk9MLMnbs>
Subject: Re: [Unbearable] Fwd: I-D Action: draft-ietf-tokbind-ttrp-01.txt
X-BeenThere: unbearable@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" <unbearable.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/unbearable>, <mailto:unbearable-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/unbearable/>
List-Post: <mailto:unbearable@ietf.org>
List-Help: <mailto:unbearable-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/unbearable>, <mailto:unbearable-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Aug 2017 13:33:45 -0000

To me forgetting to configure scrubbing of the headers is the worst
thing that can potentially happen in a TLS terminating proxy setup.

When implementing mTLS we decided to make the header names configurable,
and insist on them having a random portion, to make them hard to guess,
e.g. X-Client-X509-Cert-alaeLuL8geiqu3OhOg1Mafa4Ecu9ahsh. The prefix was
put there to ease debugging. By doing this the header name essentially
becomes a secret, shared between the TLS proxy and the backend server.
Someone probing the TLS proxy to see if scrubbing was accidentally left
out will have a much harder job with this.

I don't know if something like that was discussed in Prague. I
understand that there's great interop value in making header names
standard. The downside of having set header names is that attacks on
badly configured TLS proxies become much easier to carry out. This is my
concern about the TTRP spec in this form.

Thanks,

Vladimir


On 02/08/17 20:59, Brian Campbell wrote:
> Just published the -01 draft of "HTTPS Token Binding with TLS Terminating
> Reverse Proxies" with the changes listed below.  Use of the "Sec-" prefix
> for the header names is the only big change and I didn't want to wait long
> on getting a draft out that has the new header names.
>
>    draft-ietf-tokbind-ttrp-01
> <https://tools.ietf.org/html/draft-ietf-tokbind-ttrp-01>
>
>    o  Prefix the header names with "Sec-" so that they are denoted as
>       forbidden header names by Fetch https://fetch.spec.whatwg.org/
>
>    o  Removed potentially confusing sentence from Security
>       Considerations per
>       https://mailarchive.ietf.org/arch/msg/unbearable/
> <https://mailarchive.ietf.org/arch/msg/unbearable/O0IpppyyEqMrQjEkyEi8p8CeBGA>
>       O0IpppyyEqMrQjEkyEi8p8CeBGA
> <https://mailarchive.ietf.org/arch/msg/unbearable/O0IpppyyEqMrQjEkyEi8p8CeBGA>
>
>    o  Editorial fixes.
>
>
>
> ---------- Forwarded message ----------
> From: <internet-drafts@ietf.org>
> Date: Wed, Aug 2, 2017 at 11:52 AM
> Subject: [Unbearable] I-D Action: draft-ietf-tokbind-ttrp-01.txt
> To: i-d-announce@ietf.org
> Cc: unbearable@ietf.org
>
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the Token Binding WG of the IETF.
>
>         Title           : HTTPS Token Binding with TLS Terminating Reverse
> Proxies
>         Author          : Brian Campbell
>         Filename        : draft-ietf-tokbind-ttrp-01.txt
>         Pages           : 10
>         Date            : 2017-08-02
>
> Abstract:
>    This document defines common HTTP header fields that enable a TLS
>    terminating reverse proxy to convey information about the validated
>    Token Binding Message sent by the client to a backend server, which
>    enables that backend server to bind, or verify the binding of,
>    cookies and other security tokens to the client's Token Binding key.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-tokbind-ttrp/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-tokbind-ttrp-01
> https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-ttrp-01
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-ttrp-01
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> Unbearable mailing list
> Unbearable@ietf.org
> https://www.ietf.org/mailman/listinfo/unbearable
>
>
>