Subject: Re: [Unbearable] WGLC for core document set

From: =JeffH <[email-masked]>
Date: Tue, 29 Nov 2016 14:58:55 -0800

Dear tokbind co-chairs,

 > This starts a working group last call for the following documents:
 >
 > draft-ietf-tokbind-https-06
 > draft-ietf-tokbind-negotiation-05
 > draft-ietf-tokbind-protocol-10
 >
 > Any comments should be send to the list before EOB November 30th

Ok, I have some modest editorial comments/polishing I'm trying to get 
done, but the 2 week WGLC is sorta short given us american's feast of 
thanksgiving last week and various end-of-year corporate must-dos. I'll 
get my comments in by the end of this week, I trust that'll be ok.

thanks,

=JeffH

---

From: Brian Campbell <[email-masked]>
Date: Wed, 30 Nov 2016 12:45:49 -0700

Jeff makes a good point here that starting WGLC during the meeting and
Thanksgiving for many people right after that likely means many won't have
a chance to do a review for WGLC (I'm just returning from family vacation
myself on top of it). Given all that and the somewhat recent publication of
new revisions of the drafts, might it make sense to extend the WGLC period?

On Tue, Nov 29, 2016 at 3:58 PM, =JeffH <[email-masked]>
wrote:

> thanksgiving last week and various end-of-year corporate must-dos. I'll get
> my comments in by the end of this week, I trust that'll be ok.
>
> thanks,
>
> =JeffH
>
> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable
>

-- 
<https://www.pingidentity.com>
<https://www.pingidentity.com>
Brian Campbell
Distinguished Engineer
[email-masked]
w: +1 720.317.2061
c: +1 303.918.9415
Connect with us: 
<https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm>
[image:
LinkedIn logo] <https://www.linkedin.com/company/21870> [image: twitter
logo] <https://twitter.com/pingidentity> 
<https://www.facebook.com/pingidentitypage> 
<https://www.youtube.com/user/PingIdentityTV> 
<https://plus.google.com/u/0/114266977739397708540> 
<https://www.pingidentity.com/en/blog.html>
<https://www.pingidentity.com/en/about.html>

---

From: John Bradley <[email-masked]>
Date: Wed, 30 Nov 2016 17:06:33 -0300

Sorry with neither of us being American we did not take your 4 day weekend into account.  

I am personally fine with a week extension and reviewing it then if people think they have something they haven't had time to contribute.

However we do want to wind this up so extensions will be limited.

John B.

> On Nov 30, 2016, at 4:45 PM, Brian Campbell <[email-masked]> wrote:
> 
> Jeff makes a good point here that starting WGLC during the meeting and Thanksgiving for many people right after that likely means many won't have a chance to do a review for WGLC (I'm just returning from family vacation myself on top of it). Given all that and the somewhat recent publication of new revisions of the drafts, might it make sense to extend the WGLC period?
> 
> On Tue, Nov 29, 2016 at 3:58 PM, =JeffH <[email-masked] <mailto:[email-masked]>> wrote:
> Dear tokbind co-chairs,
> 
> Ok, I have some modest editorial comments/polishing I'm trying to get done, but the 2 week WGLC is sorta short given us american's feast of thanksgiving last week and various end-of-year corporate must-dos. I'll get my comments in by the end of this week, I trust that'll be ok.
> 
> thanks,
> 
> =JeffH
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/unbearable <https://www.ietf.org/mailman/listinfo/unbearable>
> 
> 
> 
> -- 
>  <https://www.pingidentity.com/> <https://www.pingidentity.com/>	
> Brian Campbell	
> Distinguished Engineer	
> [email-masked] <mailto:[email-masked]>	
> w: +1 720.317.2061	
> c: +1 303.918.9415
> Connect with us: 	 <https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm>	 <https://www.linkedin.com/company/21870>  <https://twitter.com/pingidentity>	 <https://www.facebook.com/pingidentitypage>	 <https://www.youtube.com/user/PingIdentityTV>	 <https://plus.google.com/u/0/114266977739397708540>  <https://www.pingidentity.com/en/blog.html>															
>  <https://www.pingidentity.com/en/about.html>_______________________________________________
> Unbearable mailing list
> [email-masked]

---

From: Brian Campbell <[email-masked]>
Date: Wed, 30 Nov 2016 13:32:02 -0700

Just speaking for myself, I've been following along and think I'm good with
the state of things. But other than glancing at the recent changes, I've
not had a chance to sit down and do the end-to-end review of the documents
that I'd like to for WGLC. And just given things like staring it during the
meeting and USA being great again with 4 day weekends, I'm not sure when
I'll be able to do that. Will try to soon.

On Wed, Nov 30, 2016 at 1:06 PM, John Bradley <[email-masked]> wrote:

> I am personally fine with a week extension and reviewing it then if people
> think they have something they haven't had time to contribute.
>
> w: +1 720.317.2061 <(720)%20317-2061>
> c: +1 303.918.9415 <(303)%20918-9415>
> Connect with us: 
> <https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm> [image:

---

From: [email-masked]
Date: Wed, 30 Nov 2016 23:22:38 +0100 (CET)

This set of documents failed to meet the terms of références of the WG charter.

It is not resistant to the ABC attack (Alice and Bob collusion attack).
In this attack Bob who is older than 18 colloborates with Alice and transmits a token to Alice who is only 14 so that she can démonstrateur to a RS that she is older than 18.

This kind of attack is not even mentionned in the security considerations section.

This set of documents should not be progressed to IETF last call unless the attack can be countered.

Denis

---

From: Andrei Popov <[email-masked]>
Date: Wed, 30 Nov 2016 23:20:01 +0000

Hi Denis,

For an RP to accept the bound token that Alice has received from Bob, Alice needs to prove possession of the corresponding Token Binding key. So Bob would have to either:
1. export the TB key to Alice, or 
2. be willing to sign Alice's data with his TB key.

If we're missing something and you have a scenario that allows Alice to replay a bound token and have an RP accept it, please explain in more detail.

Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, November 30, 2016 2:23 PM
To: [email-masked]
Cc: John Bradley <[email-masked]>; IETF TokBind WG <[email-masked]>; =JeffH Hodges <[email-masked]>
Subject: [Unbearable] Answer to WGLC for core document set

Denis
>> thanksgiving last week and various end-of-year corporate must-dos. 
>> I'll get my comments in by the end of this week, I trust that'll be ok.
>>
>> thanks,
>>
>> =JeffH
>>
> <https://www.pingidentity.com/> 
> <https://www.pingidentity.com/> Brian Campbell Distinguished Engineer 
> LinkedIn logo] <https://www.linkedin.com/company/21870> [image: 
> twitter logo] <https://twitter.com/pingidentity> [image: facebook 
> logo] <https://www.facebook.com/pingidentitypage> [image: youtube 
> logo] <https://www.youtube.com/user/PingIdentityTV> [image: Google+ 
> logo] <https://plus.google.com/u/0/114266977739397708540> [image: Blog 
> logo] <https://www.pingidentity.com/en/blog.html>

--
<https://www.pingidentity.com> <https://www.pingidentity.com> Brian Campbell Distinguished Engineer [email-masked]
w: +1 720.317.2061
c: +1 303.918.9415
Connect with us:  <https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm>
[image:
LinkedIn logo] <https://www.linkedin.com/company/21870>  <https://twitter.com/pingidentity>  <https://www.facebook.com/pingidentitypage>  <https://www.youtube.com/user/PingIdentityTV>  <https://plus.google.com/u/0/114266977739397708540>  <https://www.pingidentity.com/en/blog.html>
<https://www.pingidentity.com/en/about.html>

---

From: John Bradley <[email-masked]>
Date: Wed, 30 Nov 2016 20:42:13 -0300

For this attack to work Bob would also need to transmit the token binding
keys for the issued token to Alice.

Is that what you mean by the collision attack?

Would addressing in security considerations that this won't protect against
user collision unless the token binding keys are stored in some sort of
secure storage and not extractable by the user, satisfy your concern, Or
are you imagining some other method of binding the token.

Regards
John B

On Nov 30, 2016 19:22, <[email-masked]> wrote:

> In this attack Bob who is older than 18 colloborates with Alice and
> transmits a token to Alice who is only 14 so that she can démonstrateur to
> a RS that she is older than 18.
>
> get

---

From: [email-masked]
Date: Thu, 1 Dec 2016 01:36:48 +0100 (CET)

Hi Andrei

It is option 2. Bob is willing to collaborateurs with Alice.

He does not need to give away any secret but only using his secret key to compute everything that Alice is needing.

Denis

----- Mail d'origine -----
De: John Bradley <[email-masked]>
À: Denis <[email-masked]>
Cc: [email-masked], =JeffH Hodges <[email-masked]>
Envoyé: Thu, 01 Dec 2016 00:42:13 +0100 (CET)
Objet: Re: Answer to WGLC for core document set

Regards
John B

---

From: [email-masked]
Date: Thu, 1 Dec 2016 02:05:52 +0100 (CET)

For this attack to work there is not need to transmit any key but only doing the right computation at the right time.

It is not a collision attack but  collusion attack. You can also call it a collaboration attack.

A secure storage preventing the export of the key would indeed be needed but would be insuficiant since Bob would still be able to perform computations for the benefit of Alice.

Additional security properties need to be supported by a secure element.

For exemple U-Prove from Microsoft and Idemix from IBM are both vulnerable to the ABC attack. The ABC4Trust project which is now closed has ommitted to considerations this attack and is this vulnerable to the ABC attack.

I am currently on a two weeks vacation in Patagonia and do not have a laptop with me. 

I wanted to inform you about this issue but typing on a small keyboard with one pencil takes much time.

So, please excuse me for this short answer.

Denis

----- Mail d'origine -----
De: John Bradley <[email-masked]>
À: Denis <[email-masked]>
Cc: [email-masked], =JeffH Hodges <[email-masked]>
Envoyé: Thu, 01 Dec 2016 00:42:13 +0100 (CET)
Objet: Re: Answer to WGLC for core document set

Regards
John B