[websec] Proposed Work Item: Session Continuation

Yoav Nir <ynir@checkpoint.com> Wed, 02 January 2013 05:21 UTC

From: Yoav Nir <ynir@checkpoint.com>
To: IETF WebSec WG <websec@ietf.org>
Thread-Topic: Proposed Work Item: Session Continuation
Thread-Index: AQHN6Kj4TGrWm5x6LkCXvy4676ba+g==
Date: Wed, 02 Jan 2013 05:21:08 +0000
Message-ID: <4613980CFC78314ABFD7F85CC30277210EE20E90@IL-EX10.ad.checkpoint.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <761F2CE1AA47D84DBB34ECE4BDC28F4B@ad.checkpoint.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Yaron Sheffer <yaronf.ietf@gmail.com>
Subject: [websec] Proposed Work Item: Session Continuation
Precedence: list

Hi all

Some of you may have attended the HTTPAuth BoF in Atlanta. That BoF was not successful in forming a working group, but one of the take-aways from that meeting was that a better session management protocol was both needed, and something the IETF could do decent work on. This is partially motivated by the recent BEAST and CRIME attacks, which relied on the repeated transmission of the session cookie, and in another part by the realization that the use of HTTP cookies to manage sessions as it is done today is unsound.

In the last few weeks, a design team has been working on a problem statement document. The design team includes Nico Williams, Phillip Hallam-Baker, Yaron Sheffer, and Paul Leach. The draft is by no means finished, but we think it is ready to go public for discussion on this list.

Here's a link to the draft:
http://tools.ietf.org/html/draft-williams-websec-session-continue-prob-00

It should be noted that this document and a possible subsequent protocol document are NOT currently on the WebSec charter. Only X-Frame-Options and Key Pinning are. But we do think this list is a good venue for this item, and if there's enough interest we can ask our AD to add this to our charter.

If accepted, the problem statement should be followed by a protocol document, and perhaps by a client practices document. But that's for the future. The design team has also been working on a proposed session continuation protocol document[1], but that is in a more initial state, and (with chair hat on) we will consider it among other possible proposals when the time comes.

I'd like to thank the design team members for this work, and especially Nico Williams for editing the problem statement document.

Regards,

Yoav

[1] http://tools.ietf.org/html/draft-williams-websec-session-continue-proto-00

[websec] Proposed Work Item: Session Continuation Yoav Nir