Re: [Webpush] Kathleen Moriarty's No Objection on draft-ietf-webpush-vapid-03: (with COMMENT)

[Martin Thomson <[e-mail]>]

On 16 August 2017 at 04:50, Kathleen Moriarty
<[e-mail]> wrote:
> In section 3, it seems that you are just signing the JWK and that seems fine
> from the text and the purpose listed - origin server authentication.
>
> Then in section 3.2, there's a reference to I-D.ietf-webpush-encryption saying,
> "An application server MUST select a different
>    private key for the key exchange".  This makes me think that encryption is
>    used as well, but I think it would be helpful to see the point made more
>    clear here or in the security considerations section.  Is confidentiality
>    provided/required or just integrity for this draft?

There are two separate mechanisms.  -encryption sends a message to the
user agent.  That message has confidentiality and integrity protection
- the push service can't see or modify that message.  In the envelope
of that message, we have this JWT.  The confidentiality/integrity
protection for that is HTTPS.  Confidentiality is required to prevent
theft of the token, as stated in the security considerations.  What I
now realize is that I didn't actually reiterate the requirement for
HTTPS from 8030.

  https://github.com/webpush-wg/webpush-vapid/pull/41

The text you cite is included specifically to maybe prevent someone
from incorrectly using the same key for signing (in -vapid) and
encryption (in -encryption).  Unfortunately, this specific type of
misuse is possible in a lot of codebases and does happen.