Re: [Wimse] Binding tokens to TLS sessions

[Hannes Tschofenig <[e-mail]>]

FWIW you could still do a binding to TLS but this usage of TLS would be
at the application layer.


See, for example, Application-Layer TLS
(https://datatracker.ietf.org/doc/draft-friel-tls-atls/) for how you can
use TLS across middleboxes.


Ciao

Hannes


Am 21.01.2024 um 17:57 schrieb Yaron Sheffer:
> Even though Joe and I wrote the new text together, on second thought I think this particular sentence is a mistake.
>
> Yes we need to bind tokens to the caller's cryptographic identity (public key), to prevent token stealing. But this is application-level binding.
>
> TLS-level binding is impractical because we're assuming TLS middleboxes in an enterprise environment, and middleboxes would break TLS channel binding.
>
> So I would suggest to change:
>
> 	This deliverable includes both a token format and usage, including binding to the TLS layer.
>
> To:
>
> 	This deliverable includes both a token format and usage, including binding to caller's identity.
>
> We might still end up with *optional* TLS binding for cases where it works, but I don't think it needs to be in the charter.
>
> Thanks,
> 	Yaron
>
>