[Webpush] CALL FOR CONSENSUS: VAPID cut-and-paste protection

[Phil Sorber <[e-mail]>]

This is a call for consensus for an issue relating to
draft-ietf-webpush-vapid, which is currently in IESG evaluation. Interested
participants should respond no later than Friday, September 1st 2017.

During its initial review, one of the Security Area Directors expressed
concerns regarding the cryptographic properties of the JWT:

https://mailarchive.ietf.org/arch/msg/webpush/HYW9NcUioQo5X2Np-d2hjCzB1Fo

Specifically: as implemented, the JWT is merely a bearer token. While the
DISCUSS provides a thumbnail sketch of how this could be mitigated, the
crux of the issue isn’t the specifics of the implementation, but whether
the WG had considered other, more cryptographically secure approaches.

Although participants are free to respond in any way they choose, the most
useful input would be of one of the following three forms:


   1.

   I believe the working group has already discussed adding such a
   mechanism and rejected it (with citation to an email discussion or minutes
   reflecting such discussion).

   2.

   I do not think the working group has discussed the issue before, however
   I am opposed to changing the mechanism prior to publication because...

   3.

   I do not think the working group has discussed the issue before, and
   would support bringing the document back to the working group for the
   purpose of mitigating copy-and-paste attacks.


Thank you.