Subject: [Unbearable] progress

From: Leif Johansson <[email-masked]>
Date: Sat, 3 Oct 2015 17:47:47 +0200

Folks,

Its awfully quiet on the list... does that mean we are all done? Are we
waiting for review, what?

	Cheers Leif

---

From: Andrei Popov <[email-masked]>
Date: Sat, 3 Oct 2015 20:16:09 +0000

We have a number of changes in TBPROTO-02, the most significant is probably the switch from TLS-UNIQUE to RFC5705 Keying Material Exporters.
TBNEGO has been updated with minor corrections and posted as a WG item.

Both I-Ds would benefit from review; comments are very welcome. So far I have two pieces of feedback:
1. TBPROTO: remove NamedCurve because it's already implied by key_parameters;
2. TBNEGO: drop "_sha256" suffixes from TokenBindingKeyParameters, because we're no longer hashing TLS-UNIQUEs.

Once I have some more feedback, I'll post the updated specs so that we can discuss in Yokohama.

Finally, to facilitate implementation, we need an IANA code point assignment for the TB negotiation extension.

Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of Leif Johansson
Sent: Saturday, October 3, 2015 8:48 AM
To: [email-masked]
Subject: [Unbearable] progress

Folks,

Its awfully quiet on the list... does that mean we are all done? Are we waiting for review, what?

	Cheers Leif

_______________________________________________
Unbearable mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/unbearable

---

From: Leif Johansson <[email-masked]>
Date: Sun, 4 Oct 2015 20:12:08 +0200

> Once I have some more feedback, I'll post the updated specs so that we can discuss in Yokohama.

I suggest you rev now and we can push people to review the new draft.

> Finally, to facilitate implementation, we need an IANA code point assignment for the TB negotiation extension.

I don't think we can get code points before publication though but maybe
that was not what you meant...

---

From: Andrei Popov <[email-masked]>
Date: Mon, 5 Oct 2015 17:25:18 +0000

> I suggest you rev now and we can push people to review the new draft.
Will do.

> I don't think we can get code points before publication though but maybe that was not what you meant...
I am talking about an early IANA allocation of a TLS extension code point per RFC 7120. The TLS WG has used these on a number of occasions.

There are at least two prototype implementations of the TB negotiation extension being worked on (by Google and Microsoft). An early IANA code point assignment would facilitate implementation and deployment experience prior to the publication of the RFC.

Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of Leif Johansson
Sent: Sunday, October 4, 2015 11:12 AM
To: [email-masked]
Subject: Re: [Unbearable] progress

On 2015-10-03 22:16, Andrei Popov wrote:
> 1. TBPROTO: remove NamedCurve because it's already implied by 
> key_parameters; 2. TBNEGO: drop "_sha256" suffixes from TokenBindingKeyParameters, because we're no longer hashing TLS-UNIQUEs.
> 

> Finally, to facilitate implementation, we need an IANA code point assignment for the TB negotiation extension.

I don't think we can get code points before publication though but maybe that was not what you meant...

---

From: Leif Johansson <[email-masked]>
Date: Mon, 5 Oct 2015 19:47:08 +0200

> There are at least two prototype implementations of the TB negotiation extension being worked on (by Google and Microsoft). An early IANA code point assignment would facilitate implementation and d…

ok then we should pursue that, I guess this is a task for me and JB!

---

From: Dirk Balfanz <[email-masked]>
Date: Tue, 06 Oct 2015 14:24:20 +0000

My to-do before Yokohama was to expand the Security Considerations section
in the Token Binding over HTTP to explain

(1) The issues around making the HTTP header settable (or not settable) by
Javascript, and
(2) Explain why for federation we need _two_ signed statements for
different keys (why we can't just mention the RP's key to the IdP at the
application layer).

I'll add those soon.

Dirk.

---

From: "Leif Johansson" <[email-masked]>
Date: Mon, 12 Oct 2015 20:34:12 +0200

> 5 okt 2015 kl. 19:47 skrev Leif Johansson <[email-masked]>:
> 

We have pushed this frame on the IESG stack