Subject: Re: [kitten] Clarification on use of per-message tokens

From: "Cantor, Scott" <[email-masked]>
Date: Wed, 23 Nov 2011 17:20:27 +0000

On 11/23/11 11:39 AM, "Nico Williams" <[email-masked]> wrote:

>Yes, but there are a number of standards-track Internet protocols that
>use the GSS-API and its per-message tokens (DNS GSS-TSIG, SSHv2,
>RPCSEC_GSSv1, SASL/GS1, ...).

One of the reasons I was asking is to figure out if it's worth thinking
about ways to establish the master key that would only be good ideas in
the presence of channel binding.

-- Scott

---

From: Nico Williams <[email-masked]>
Date: Wed, 23 Nov 2011 12:23:07 -0600

> the presence of channel binding.

I think it would only be a good idea to do that with unique and
private channel binding types anyways.

---

From: "Cantor, Scott" <[email-masked]>
Date: Wed, 23 Nov 2011 19:08:23 +0000

>private channel binding types anyways.

Ok, thanks. Trying to do this with bearer token clients is really an
exercise in "better than nothing" at the end of the day.

-- Scott

---

From: Nico Williams <[email-masked]>
Date: Wed, 23 Nov 2011 14:16:26 -0600

> exercise in "better than nothing" at the end of the day.

Pretty much :)

You might as well send a nonce and declare it the session key.  No
real security is possible for per-message tokens, nor for CB, and you
depend entirely on the secure channel for authentication of the RP to
the initiator, but to the extent that applications depend on
per-message tokens, you can make them work (or, rather, not fail).

---

From: "Cantor, Scott" <[email-masked]>
Date: Wed, 23 Nov 2011 20:36:11 +0000

On 11/23/11 3:16 PM, "Nico Williams" <[email-masked]> wrote:
>
>You might as well send a nonce and declare it the session key.

Well, my proposal was to have the IdP supply the key to both of them.
Mainly because the attacker would have to get access to the actual message
received by the client, not just the bearer assertion in the message.

-- Scott