Re: [Unbearable] WGLC 3 on core documents

Nick,

For being able to speak of a "replay", there should first be a "play of 
the token".
But in this case, there is a single"play" of it, and hence no replay.

Denis

> The client collusion scenario is about one client exporting a bound 
> token for another client to use. This bound token is a security token, 
> and reusing the token (whether it is on the same client or another 
> client) is replaying it. Hence, "Security Token Replay" is a perfectly 
> appropriate section for those sentences. They don't need their own 
> section.
>
> On Mon, Feb 27, 2017 at 1:19 AM, Denis <denis.ietf@free.fr 
> <mailto:denis.ietf@free.fr>> wrote:
>
>     Comments on draft-ietf-tokbind-protocol-13 (The Token Binding
>     Protocol Version 1.0)
>
>     On page 14 within the Security Considerations section, I
>     appreciate the fact that the following sentences have been added:
>
>
>     *The Token Binding protocol does not prevent cooperating clients from*
>     *sharing a bound token.A client could intentionally export a bound*
>     *token with the corresponding Token Binding private key, or perform*
>     *signatures using this key on behalf of another client.*
>
>     However, these sentences have been placed inside section 7.1.
>     which is called "Security Token Replay".
>
>     This security consideration has nothing to do with "Security Token
>     Replay" but with "Client collusion".
>
>     Therefore, these sentences should be placed under a new section
>     called: "7.2. Client collusion".
>
>     ======================================================================================
>
>     Comments on draft-ietf-tokbind-https-08 (Token Binding over HTTP)
>
>     On page 14 within the Security Considerations section, the same
>     kind of change as the one requested
>     for draft-ietf-tokbind-protocol-13 (The Token Binding Protocol
>     Version 1.0) should be done, i.e. add a new section
>     called: "7.2. Client collusion" with the following text :
>
>     *Token Binding over HTTP does not prevent cooperating clients from
>     sharing a bound token.A client could intentionally export a bound
>     token with the corresponding Token Binding private key, or perform
>     signatures using this key on behalf of another client.*
>
>
>     Denis
>
>
>     _______________________________________________
>     Unbearable mailing list
>     Unbearable@ietf.org <mailto:Unbearable@ietf.org>
>     https://www.ietf.org/mailman/listinfo/unbearable
>     <https://www.ietf.org/mailman/listinfo/unbearable>
>
>