[Unbearable] draft-campbell-tokbind-tls-term architecture.

[Eric Rescorla <[e-mail]>]

I have read this document. Comments below.

OVERALL
In S 2 you say:

   Reverse proxies MUST only add the "Token-Binding-Context" header when
   explicitly configured to do so and MUST only dispatch requests
   containing it to trusted backend servers.  Any occurrence of the
   "Token-Binding-Context" header in the request from the client MUST be
   removed or overwritten before forwarding the request.  Backend
   servers MUST only accept the "Token-Binding-Context" header when
   explicitly configured to do so and only from trusted reverse proxies.

As well as/instead of requiring proxies to sanitize, why not make it
not possible for the client to construct a valid header. One way to
do this would be to require that the header be MACed with a shared
key between the proxy and the server.

Also, I think some analysis of why this header doesn't need to be
in Sec-* would be valable. I am assuming your argument is going
to be that it's always stripped by proxies?


S 1.
Nit:
   standardized approach, different implementations will will address it

Duplicate will

-Ekr