Re: [Unbearable] FWD: Status of draft-ietf-tokbind-https

[=JeffH <[e-mail]>]

From: Eric Rescorla <[e-mail]>
Date: Thursday, November 16, 2017 at 8:07 AM
To: Andrei Popov <[e-mail]>
Cc: Leif Johansson <[e-mail]>, Vinod Anupam <[e-mail]>, 
"[e-mail]" 
<[e-mail]>, "[e-mail]" 
<[e-mail]>, Dirk Balfanz <[e-mail]>
Subject: Re: Status of draft-ietf-tokbind-https
Resent-From: <[e-mail]>, Eric Rescorla <[e-mail]>
Resent-To: <[e-mail]>, <[e-mail]>, Dirk 
Balfanz <[e-mail]>, Adam Langley <[e-mail]>, 
<[e-mail]>, Jeff Hodges <[e-mail]>, 
<[e-mail]>
Resent-Date: Thursday, November 16, 2017 at 8:08 AM

Thanks. As you can imagine, this week is terrible, but I should be able 
to finish my read-through next week.

-Ekr


On Thu, Nov 16, 2017 at 7:56 AM, Andrei Popov 
<[e-mail]> wrote:
Hi Eric,

Dirk has uploaded HTTPSTB-11 with additional language at the end of 
section 7.4 “ Securing Federated Sign-On Protocols”:

“Note that the presence of Token Binding does not relieve the Token
    Provider and Token Consumer from performing various checks to ensure
    the security of clients during federated sign-on protocols.  These
    include the following:

    o  The Token Provider should not issue tokens to Token Consumers that
       have been shown to act maliciously.  To aid in this, the
       federation protocol should identify the Token Consumer to the
       Token Provider (e.g., through OAuth client IDs or similar
       mechanisms), and the Token Provider should ensure that tokens are
       indeed issued to the Token Consumer identified in the token
       request (e.g., by verifying that the redirect URI is associated
       with the OAuth client ID.)

    o  The Token Consumer should verify that the tokens were issued for
       it, and not some other token consumer.  To aid in this, the
       federation protocol should include an audience parameter in the
       token response, or apply equivalent mechanisms (the implicit OAuth
       flow requires Token Consumers to identify themselves when they
       exchange OAuth authorization codes for OAuth refresh tokens,
       leaving it up to the Token Provider to verify that the OAuth
       authorization was delivered to the correct Token Consumer).“

Cheers,

Andrei