Re: [Unbearable] (belated) WGLC draft-ietf-tokbind-ttrp

Can we please stop adding text that says "don't share your private key with
others" to IETF drafts? That is an inherent part of PKI and does not need
to be repeated everywhere IMO, just like text about how verifying TLS
server certificate should work is not repeated in drafts where TLS is a
requirement. Perhaps a reference to generic PKI principles and guidelines
may be included?

Hans.

On Mon, Sep 17, 2018 at 11:32 AM Denis <denis.ietf@free.fr> wrote:

> Comments on draft-ietf-tokbind-ttrp-06: HTTPS Token Binding with TLS
> Terminating Reverse Proxies
>
> The introduction states:
>
> An HTTP server issuing cookies or other security tokens can associate them
> with the Token Binding ID, which ensures those tokens
> cannot be used successfully over a different TLS connection or by a
> different client than the one to which they were issued.
>
> When there are only external attackers, the sentence is correct but is
> incorrect when there is a collusion between a legitimate client and another
> client.
> The sentence should be corrected. Here is a proposal:
>
> An HTTP server issuing cookies or other security tokens can associate them
> with the Token Binding ID, which ensures those tokens
> cannot be used successfully over a different TLS connection or by a
> different client than the one to which they were issued, as long as
> there is no collusion between the legitimate client and another client.
>
> In the "Security Considerations" section (section 4), some explanations
> should be added. Here is a proposal:
>
> The token binding mechanism is efficient against external attackers, but,
> in case a legitimate client collaborates with another client,
> the mechanism can be defeated since the legitimate client, using the
> private key which proves possession of the security token, can perform
> all the cryptographic computations that the other client needs to
> demonstrate the possession of that security token.
>
> Denis
>
>
> This message marks the start of a 2 week WGLC on
> draft-ietf-tokbind-ttrp-06 as agreed in Montreal but only now effected
> by your chair.
>
> Please provide your final comments, voices of support or objections
> by COB Fri 28 Sept in any TZ.
>
> 	Best R
> 	Leif
>
> _______________________________________________
> Unbearable mailing listUnbearable@ietf.orghttps://www.ietf.org/mailman/listinfo/unbearable
>
>
> _______________________________________________
> Unbearable mailing list
> Unbearable@ietf.org
> https://www.ietf.org/mailman/listinfo/unbearable
>

-- 
hans.zandbelt@zmartzone.eu
ZmartZone IAM - www.zmartzone.eu