Re: [Unbearable] Fwd: I-D Action: draft-ietf-tokbind-ttrp-01.txt

I think the main concern is sanitizing the Referred-Token-Binding-ID and Sec-Provided-Token-Binding-ID headers rather than the original Sec-Token-Binding header.

The concern is if the TTP is not properly configured an attacker could send the 
Referred-Token-Binding-ID and Sec-Provided-Token-Binding-ID headers directly to bypass security.

At the F2F a number of suggestions were made around how to prevent/detect misconfiguration of one of a set of TTP that is not configured to sanitize those headders.

John B

> On Aug 3, 2017, at 11:31 AM, Bill Cox <waywardgeek@google.com> wrote:
> 
> 
> 
> On Thu, Aug 3, 2017 at 6:32 AM, Vladimir Dzhuvinov <vladimir@connect2id.com <mailto:vladimir@connect2id.com>> wrote:
> The downside of having set header names is that attacks on badly configured TLS proxies become much easier to carry out. This is my concern about the TTRP spec in this form.
> 
> Thanks,
> Vladimir
> I think most coders adding the standard header will the RFC, and will be more likely to remember to scrub the header.
> 
> One question about the spec: Why must the "sec-token-binding" header be removed?  I did that originally in an implementation, and was asked to stop "molesting the headers".
> 
> Bill
> _______________________________________________
> Unbearable mailing list
> Unbearable@ietf.org
> https://www.ietf.org/mailman/listinfo/unbearable

Re: [Unbearable] Fwd: I-D Action: draft-ietf-tokbind-ttrp-01.txt

Attachment: smime.p7s