[Unbearable] Request for reviews: draft-mandyam-tokbind-attest (ver -06)

[Giridhar Mandyam <[e-mail]>]

Hello,
Thanks for all the good feedback during the Montreal meeting, and the email review by Andrei Popov (https://mailarchive.ietf.org/arch/msg/unbearable/uiSRSOJTd4FqHJ__7uXQvD-GB5g).  I would like to request the group for any follow-on reviews based on the latest draft.

-Giri Mandyam

-----Original Message-----
From: Unbearable <[e-mail]> On Behalf Of Giridhar Mandyam
Sent: Tuesday, July 24, 2018 4:02 PM
To: [e-mail]
Subject: [Unbearable] New Version Notification for draft-mandyam-tokbind-attest (ver -06)

As per recommendation of the chairs at last week's meeting in Montreal, a new version of this doc has been uploaded.  Summary of changes:

a) Each attestation type now has its own tokbind.extension value.  This allowed for a simpler advertisement of supported attestation types during the TLS handshake, as each endpoint can just send a list of supported extensions.  This also avoids having to create an additional registry for attestation types.
	That being said, I realize that there is only an octet for identifying tokbind extensions.   It may be something for the group to consider whether this is sufficient.
b) There are three IANA registrations proposed:  one for the new TLS extension codepoint, and two for the proposed attestation types as separate tokbind extensions.
c) The attestation signature for both types (Android Keystore and TPM) are now created over a hash of the tokbind public key (as suggested in Montreal).  In the previous version, it was over EKM.  Moreover, the tokbind client only has to send the attestation once during the lifetime of the tokbind keypair.  

Thanks,
-Giri MAndyam

-----Original Message-----
From: [e-mail] <[e-mail]> 
Sent: Tuesday, July 24, 2018 3:02 PM
To: Giridhar Mandyam <[e-mail]>; Jon Azen <[e-mail]>; Laurence Lundblade <[e-mail]>
Subject: New Version Notification for draft-mandyam-tokbind-attest-06.txt


A new version of I-D, draft-mandyam-tokbind-attest-06.txt
has been successfully submitted by Giridhar Mandyam and posted to the IETF repository.

Name:		draft-mandyam-tokbind-attest
Revision:	06
Title:		Attested TLS Token Binding
Document date:	2018-07-24
Group:		Individual Submission
Pages:		11
URL:            https://www.ietf.org/internet-drafts/draft-mandyam-tokbind-attest-06.txt
Status:         https://datatracker.ietf.org/doc/draft-mandyam-tokbind-attest/
Htmlized:       https://tools.ietf.org/html/draft-mandyam-tokbind-attest-06
Htmlized:       https://datatracker.ietf.org/doc/html/draft-mandyam-tokbind-attest
Diff:           https://www.ietf.org/rfcdiff?url2=draft-mandyam-tokbind-attest-06

Abstract:
   Token binding allows HTTP servers to bind bearer tokens to TLS
   connections.  In order to do this, clients or user agents must prove
   possession of a private key.  However, proof-of-possession of a
   private key becomes truly meaningful to a server when accompanied by
   an attestation statement.  This specification describes extensions to
   the existing token binding protocol to allow for attestation
   statements to be sent along with the related token binding messages.

                                                                                  


Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

_______________________________________________
Unbearable mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/unbearable