Re: [websec] handling STS header field extendability

Collin Jackson <collin.jackson@sv.cmu.edu> Mon, 13 August 2012 23:21 UTC

Return-Path: <collin.jackson@west.cmu.edu>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E945121F859B for <websec@ietfa.amsl.com>; Mon, 13 Aug 2012 16:21:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.894
X-Spam-Level:
X-Spam-Status: No, score=-2.894 tagged_above=-999 required=5 tests=[AWL=0.083, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xkJ4MQrBqB2f for <websec@ietfa.amsl.com>; Mon, 13 Aug 2012 16:21:38 -0700 (PDT)
Received: from mail-yx0-f172.google.com (mail-yx0-f172.google.com [209.85.213.172]) by ietfa.amsl.com (Postfix) with ESMTP id 3B1EB21F8592 for <websec@ietf.org>; Mon, 13 Aug 2012 16:21:38 -0700 (PDT)
Received: by yenm5 with SMTP id m5so4199442yen.31 for <websec@ietf.org>; Mon, 13 Aug 2012 16:21:37 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding:x-gm-message-state; bh=DEFYGvBRP8rJaux9OCeGGBIDufQX4PvQfNCWM8ZK3q8=; b=ZRaRPLbKFN2eUWF3aN+UHHhZtZ0uIgsYbkb3vpOsFctH+wjUbzuGkR7uVfbDM+YpUf 3MchWWg1u5HhISUayhRs7jLeGNusgEhS1m4IAp7kILHmVCVtnBvEmpPjGXecfa3b1Uf6 X83H7OB4G8Bn5dxAjoOvoGuDLDNVrSJiX97AFwoSQ+ol8QhU2qRfZnrZ9lU8gr3joIGP 9IMJyaqWQkS82G5CSrv+laJkr5UI48mi2Fz6IcT4W/Xwduhpo/WNlLW+4z8eF9iizsty PPh48e0Ru7hKS1NL/fcE2VMARBi8gVJC9flRG9Od9ZJNcPd3xsPROBVikVEq+eh5D7RE EWHg==
Received: by 10.101.141.40 with SMTP id t40mr4014771ann.77.1344900097577; Mon, 13 Aug 2012 16:21:37 -0700 (PDT)
Received: from mail-yw0-f44.google.com (mail-yw0-f44.google.com [209.85.213.44]) by mx.google.com with ESMTPS id e24sm1755334yhh.4.2012.08.13.16.21.36 (version=SSLv3 cipher=OTHER); Mon, 13 Aug 2012 16:21:37 -0700 (PDT)
Received: by yhq56 with SMTP id 56so4206371yhq.31 for <websec@ietf.org>; Mon, 13 Aug 2012 16:21:36 -0700 (PDT)
Received: by 10.68.235.68 with SMTP id uk4mr35012903pbc.52.1344900096112; Mon, 13 Aug 2012 16:21:36 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.68.21.131 with HTTP; Mon, 13 Aug 2012 16:20:55 -0700 (PDT)
In-Reply-To: <370C9BEB4DD6154FA963E2F79ADC6F2E1C2818@DEN-EXDDA-S12.corp.ebay.com>
References: <5024352D.4040604@KingsMountain.com> <CAOuvq23dxoKyV2No55WEYePhVj+Fcab5cF65C1FsiqgtmEkXMA@mail.gmail.com> <CA+cU71kx4Ck2aMeSHhnpb--aZ+mRmszQdojepM4aapVn2TsR=Q@mail.gmail.com> <370C9BEB4DD6154FA963E2F79ADC6F2E1C251C@DEN-EXDDA-S12.corp.ebay.com> <CANVv-VfcVBhd7AUqsZ83dKJiDL3V=_Fd2Wmm=o7WXMiEgCAusg@mail.gmail.com> <FD1D3117-B393-417A-868F-AB954907C16C@vpnc.org> <370C9BEB4DD6154FA963E2F79ADC6F2E1C2818@DEN-EXDDA-S12.corp.ebay.com>
From: Collin Jackson <collin.jackson@sv.cmu.edu>
Date: Mon, 13 Aug 2012 16:20:55 -0700
Message-ID: <CANVv-VdgHWDcXcL9JiT48mK9Aub51zJuy8zomMfUqpWHSzcPzg@mail.gmail.com>
To: "Hill, Brad" <bhill@paypal-inc.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Gm-Message-State: ALoCoQklk26OTko2M6AN1MM0PbfjQVFTYeFREMjfPlo/n1x+73gbS/uS83fUPX37X6pNDf65hxTl
Cc: Ben Campbell <ben@nostrum.com>, IETF WebSec WG <websec@ietf.org>, Paul Hoffman <paul.hoffman@vpnc.org>
Subject: Re: [websec] handling STS header field extendability
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Aug 2012 23:21:39 -0000

On Mon, Aug 13, 2012 at 2:20 PM, Hill, Brad <bhill@paypal-inc.com> wrote:
> I have an EV certificate for www.example.com.  On the main page, it includes the following tag:
>
>  <script src="https://scripts.example.com/myscript.js">
>
> Mallory is presumably much more likely to be able to obtain a DV certificate for scripts.example.com than an EV cert for www.example.com.  But Mallory can still use the DV certificate to attack the EV content at www.example.com by MITMing the fetch of myscript.js, which will be transcluded into the DOM.
>
> Or alternately, assume that Mallory gets a DV certificate for www.example.com which is different (and has a different key pair) from my legitimate EV certificate.  Mallory can still MITM content loaded in some frame other than the one displaying the EV indicator and gain control of that content because her "www.example.com" using the DV certificate is the same origin as my "www.example.com" using the EV one.
>
> So, Collin is right that perhaps I'm making the case *for* LockEV, but as my first example shows, it would have to include a full-fledged mixed-content distinction between EV and non-EV, as currently exists between HTTPS and HTTP.

I don't agree that browsers would need to include a mixed content
distinction between EV and non EV. In fact, I think that would be a
bad idea to do so. You can still make an all-EV site and benefit from
LockEV. The attacker will not be able to MITM it without an EV
certificate.

> When you start to consider more modern technologies for intercommunication between multiple instances of client-side apps with things like postMessage, webRTC, etc. I wonder if you wouldn't need a full-fledged origin distinction on EV/non-EV, as we do today on protocol, to create a strong barrier, and if it is worth it and there is any appetite among browser vendors for such a thing.

As we wrote in our 2008 paper on finer-grained origins, I agree that
browsers should not include EV in the origin distinction. However,
LockEV would still be helpful to all-EV sites.

> Again: instead of "LockEV", wouldn't a much saner security policy be "LockKey"?

Sites might want to commit to serving everything over EV, but might
not want to commit to keeping the same key, or the same CA.

> I think that's important to consider about LockEV - PayPal is one of the sites most ready for and most pervasively EV, and it would not be prepared today to have a mixed-content policy enforced for EV/DV.  It would take a lot of work and a great deal of expense to achieve this, and not just for PayPal.  Consider how many sites use off-origin analytics, ads, CDNs, etc.

We agree. I am opposed to using EV in the mixed content distinction.
However, LockEV still prevents MITM attacks using DV certificates
against all-EV sites.

> I'm not convinced that:
>
> a) it's worth doing LockEV unless it's going to be a real security barrier

As long as a site isn't using DV certs for scripts, it's a real
security barrier.

> b) the complexity introduced in making it a real security barrier is worth it for such a rare attack

There is very little complexity introduced if you don't introduce the
mixed content distinction.

Collin