Re: [websec] Fwd: [secdir] SecDir review of draft-williams-websec-session-continue-prob-00

Ben Laurie <benl@google.com> Thu, 07 February 2013 08:10 UTC

MIME-Version: 1.0
In-Reply-To: <4613980CFC78314ABFD7F85CC30277211199DCC1@IL-EX10.ad.checkpoint.com>
References: <CABrd9SR0-RTAWnK_g3N8cPStcQfMcFn-8Eq=Ny6xiADYY3NR+w@mail.gmail.com> <4613980CFC78314ABFD7F85CC30277211199DCC1@IL-EX10.ad.checkpoint.com>
Date: Thu, 07 Feb 2013 08:10:48 +0000
Message-ID: <CABrd9SRk4HrGwnMvEDf+cx6gEaiAnr0js8bAY9b5VW+xpaDgbA@mail.gmail.com>
From: Ben Laurie <benl@google.com>
To: Yoav Nir <ynir@checkpoint.com>, "secdir@ietf.org" <secdir@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: "ietf-websec-sessions@googlegroups.com" <ietf-websec-sessions@googlegroups.com>, IETF WebSec WG <websec@ietf.org>
Subject: Re: [websec] Fwd: [secdir] SecDir review of draft-williams-websec-session-continue-prob-00
Precedence: list

On 7 February 2013 07:46, Yoav Nir <ynir@checkpoint.com> wrote (that I wrote):
> " 10. Must work across all types of proxies. Proxies that can modify
>
>        the plaintext HTTP requests and responses can (but should not)
>        interfere with any session continuation protocol."
>
> A man-in-the-middle is a type of proxy, so this seems like an
> unsatisfiable requirement.

Actually, that's not quite right. Protocols can work across a proxy,
but what's required is that the proxy does not gain the ability to
pretend to be one of the endpoints.

If you satisfy this, then a MitM can snoop, but can't masquerade.

But this seems to impose quite a strong constraint on the protocol: in
particular, future traffic must somehow be bound to the (end-to-end)
session continuation.

[websec] Fwd: [secdir] SecDir review of draft-wil… Yoav Nir
Re: [websec] Fwd: [secdir] SecDir review of draft… Ben Laurie