Subject: [Unbearable] Open source token binding libraries available

From: Bill Cox <[email-masked]>
Date: Mon, 14 Nov 2016 15:30:13 -0800

My long awaited library is at github.com/google/token_bind.  As a
super-awesome bonus, Piotr also open-sourced an NGINX module that uses it
to provide token binding securityfor NGINX proxies, but I'll leave it up to
Piotr to describe his work.  Thanks again, Piotr!

Bill

---

From: Dave Tonge <[email-masked]>
Date: Wed, 16 Nov 2016 09:42:20 +0000

Thanks Bill.
Really good news.

On 14 November 2016 at 23:30, Bill Cox <[email-masked]> wrote:

> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable
>
>

-- 
Dave Tonge
CTO
10 Temple Back | Bristol | BS1 6FL
t: +44 (0)117 280 5120
m: +44 (0)7577 815570

Momentum Financial Technology Ltd is authorised and regulated by the
Financial Conduct Authority (Register number 561538). Registered in England
& Wales, company registration number 06909772. DISCLAIMER: This email
(including any attachments) is subject to copyright, and the information in
it is confidential. Use of this email or of any information in it other
than by the addressee is unauthorised and unlawful. Whilst reasonable
efforts are made to ensure that any attachments are virus-free, it is the
recipient's sole responsibility to scan all attachments for viruses. All
calls and emails to and from this company may be monitored and recorded for
legitimate purposes relating to this company's business. Any opinions
expressed in this email (or in any attachments) are those of the author and
do not necessarily represent the opinions of Momentum Financial Technology
Ltd or of any other group company.

---

From: Piotr Sikora <[email-masked]>
Date: Wed, 23 Nov 2016 16:31:36 -0800

Hey,
NGINX module was released last week, and it's available at:
https://github.com/google/ngx_token_binding

It provides two features, which can be combined:

1. Transparent binding & verification of HTTP cookies, which can be
used without any modifications to the backend. In this mode, NGINX
adds HMAC to selected cookies before sending them to the clients, and
it verifies that the signature is correct in selected cookies before
forwarding them to the backend. This way, clients always see bound
cookies, and backend servers always see unbound cookies.

2. Forwarding of base64url-encoded SHA256 of Token Binding ID to the
backend servers. This allows backend to use Token Binding, even when
it doesn't terminate TLS connections from the clients.

Please let me know if you have any questions!

Best regards,
Piotr Sikora

On Mon, Nov 14, 2016 at 3:30 PM, Bill Cox <[email-masked]> wrote:
> super-awesome bonus, Piotr also open-sourced an NGINX module that uses it to
> provide token binding securityfor NGINX proxies, but I'll leave it up to