Re: [Webpush] Vapid public key

[Martin Thomson <[e-mail]>]

Well, I haven't revised VAPID recently (it missed the cutoff due to a
rush on -encryption).  I have an open PR, and now these changes.  I'll
add this to the pile.  (I think that I'd phrase this slightly
differently, but it's reasonable to point out that this new
authentication scheme is available to the UA and PS).

https://github.com/webpush-wg/webpush-vapid/issues/27

On 3 November 2016 at 07:22, Costin Manolache <[e-mail]> wrote:
> Apologies for any bad memories related to implementing digest auth :-)
>
> If we are updating the vapid spec - I would like to ask for one more change:
>
> "A UA may also authenticate with VAPID when making a subscribe request. If
> subscribe was
> authenticated with VAPID, all subsequent subscribe, unsubscribe, ack or
> monitor requests
> associated with the same pushset MUST be authenticated with VAPID with same
> public key"
>
> I know subscribe/monitor are over SSL - but I think it improves a bit the
> security, and the device
> already needs to have code to handle EC for the e2e encryption. The main
> concern is
> an attacker 'acking' or unsubscribing - since the messages are e2e encrypted
> they can't read it.
>
> Costin
>
> On Wed, Nov 2, 2016 at 12:43 PM jr conlin <[e-mail]> wrote:
>>
>> On 11/2/2016 11:14 AM, Costin Manolache wrote:
>>
>> From rfc2617 (digest auth):
>>
>> Authorization: Digest username="Mufasa",
>>                  realm="[e-mail]",
>>                  nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
>>                  uri="/dir/index.html",
>>                  qop=auth,
>>                  nc=00000001,
>>                  cnonce="0a4f113b",
>>                  response="6629fae49393a05397450978507c4ef1",
>>                  opaque="5ccc069c403ebaf9f0171e9517f40e41"
>>
>> No "favoriteDrink"?
>>
>> /me fights back his x.500 PTSD.
>>
>