Re: [Unbearable] Possible attack on Token Binding with RSA key exchange

Lanlan Pan <> Wed, 06 September 2017 01:28 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 3BB39132192 for <>; Tue, 5 Sep 2017 18:28:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id KspciVvdRCoy for <>; Tue, 5 Sep 2017 18:28:16 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:400c:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 7ED441252BA for <>; Tue, 5 Sep 2017 18:28:16 -0700 (PDT)
Received: by with SMTP id f145so14007018wme.0 for <>; Tue, 05 Sep 2017 18:28:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/GDdwklIImBMrZ6ZswmzG1xfQsr3AmLmlRMpkgjLz4s=; b=usRbPwRhUgksb+8vzUm7KUzslz4ZgYtuKUUZbFQ22yj1mkNFzrd+8nwYxONlDvHrD/ 2yCLRhBcO/gRBbGP4YI5iO8Gz4cYSvHCKt5NA2PRct2wELcYH8/KtXB8rahdHvRpF6IQ 3+xPOvz7yulL83RStYkAvYN0C1nTxIkEXpBULMFkG7PDamLMWG2HX4/qHhYaa3kMgaYQ /1E6SO1ZFsw3iSTCboc0JNcoFsmyCBVZo8WJAxF1bKZX5Dn7a2aU3weN/mbesZ7RrEyq n4Zofu34CFtQkcfR6bukMQMnDfk+730xyzsoyop2Y91nN4YgJFi3fQKg2dTvZCzATVFP UIMA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/GDdwklIImBMrZ6ZswmzG1xfQsr3AmLmlRMpkgjLz4s=; b=Owauj+B6mEGGOY4/8F0UxM3y1T87loKbS/m2bHFJpQyoOwUOgiSF+zhbtPaEo5C7+S bI0bRBiWMGXLS6EZbkKZT+BSbv0DWfICMbhZNqcXgExQ5bDI6EbFOPjCFKoC1fv4cAbR 5ZIXlnVMFrrP/XiO3cTwycNTC33Em1nK6RKvrXK0GdrA/w3lRF72/cnxf7+7w0lpWsnV ea6ZE0zNlSXx4GAFrVrRH6UBenK+UPTQxiDXxnecrkX71WQISYnNBh+55XlwbRaN9FDG vvFFEYHAszDi/b/KhV4XBuf8IYoaqVb+dWi/Em5Hc1wsjCM47BUiQHbFVPPDZ7CBM/4T ittQ==
X-Gm-Message-State: AHPjjUiNQX5zuPTOmFVTBoCmD6199Wj4QR5g2Y9nrX6qLVOJuDRRxRMj +Mv21mdtbI6atrrkhiiqq/B9Ctr4Ww==
X-Google-Smtp-Source: ADKCNb47UReg9fn7dN21qBy4tv2IM/rSXUXIqaAB/NEH8a3wnVJfQH1Cp1A3Wg2zbG+mpa+3fX06sP5EEUZkXAXBb6E=
X-Received: by with SMTP id j28mr4801681ede.300.1504661295095; Tue, 05 Sep 2017 18:28:15 -0700 (PDT)
MIME-Version: 1.0
References: <>
In-Reply-To: <>
From: Lanlan Pan <>
Date: Wed, 06 Sep 2017 01:28:04 +0000
Message-ID: <>
To: Nick Harper <>
Content-Type: multipart/alternative; boundary="f403045c53f600674905587b42be"
Archived-At: <>
Subject: Re: [Unbearable] Possible attack on Token Binding with RSA key exchange
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 06 Sep 2017 01:28:18 -0000

+1  out of scope

encourage using (EC)DHE key exchange in the security consideration ?

Nick Harper <>于2017年9月2日周六 上午6:11写道:

> I came across an attack on Token Binding today, which I think is worth
> addressing in TBPROTO in some fashion (likely another paragraph in
> Security Considerations). This attack involves an adversary with the
> private key of a server it wishes to impersonate, and was mentioned in
> draft-balfanz-tls-channelid in the last paragraph of its Security
> Considerations.
> In brief, if an attacker has possession of a server's private key, it
> can hijack a TLS connection between client and server if the
> connection uses RSA key exchange instead of (EC)DHE key exchange,
> which allows the attacker to exercise the bound token without
> possession of the Token Binding private key.
> I realize that we're past WGLC at this point, but I think this should
> be addressed. On one end, we could require forward-secret key exchange
> modes with Token Binding. We could also describe this specific attack
> in the Security Considerations, or we could expand the Security
> Considerations to describe what attacks are and aren't in the Token
> Binding threat model, to say that attacks where the adversary has the
> server's private key are out of scope.
> _______________________________________________
> Unbearable mailing list
致礼  Best Regards

潘蓝兰  Pan Lanlan