Subject: [Unbearable] Triple handshake security considerations

From: Nick Harper <[email-masked]>
Date: Mon, 21 Nov 2016 17:18:49 -0800

I noticed that we have a section in Security Considerations for Triple
Handshake in both TBPROTO and HTTPSTB. Is it necessary to have both, or is
the one in TBPROTO sufficient? I can put
https://github.com/nharper/Internet-Drafts/tree/triple-hs in a PR if it
makes sense to remove that section from HTTPSTB.
-Nick

---

From: Andrei Popov <[email-masked]>
Date: Tue, 22 Nov 2016 01:45:59 +0000

So is the “Security Token Replay” section. IMHO there’s no harm in having both of these duplicated in HTTPSTB, but I don’t feel strongly either way.

Cheers,

Andrei

From: Unbearable [mailto:[email-masked]] On Behalf Of Nick Harper
Sent: Monday, November 21, 2016 5:19 PM
To: IETF Tokbind WG <[email-masked]>
Subject: [Unbearable] Triple handshake security considerations

I noticed that we have a section in Security Considerations for Triple Handshake in both TBPROTO and HTTPSTB. Is it necessary to have both, or is the one in TBPROTO sufficient? I can put https://github.com/nharper/Internet-Drafts/tree/triple-hs in a PR if it makes sense to remove that section from HTTPSTB.
-Nick

---

From: Nick Harper <[email-masked]>
Date: Tue, 22 Nov 2016 07:57:35 -0800

I have a slight preference towards not duplicating them, but I don't think
it's a big deal. If other people have stronger feelings about keeping it
I'm fine with that.

On Mon, Nov 21, 2016 at 5:45 PM, Andrei Popov <[email-masked]>
wrote:

> So is the “Security Token Replay” section. IMHO there’s no harm in having
> both of these duplicated in HTTPSTB, but I don’t feel strongly either way.
>
>
>
> Cheers,
>
>
>
> Andrei
>
>
>
> *From:* Unbearable [mailto:[email-masked]] *On Behalf Of *Nick
> Harper
> *Sent:* Monday, November 21, 2016 5:19 PM
> *To:* IETF Tokbind WG <[email-masked]>
> *Subject:* [Unbearable] Triple handshake security considerations
>
>
>
> the one in TBPROTO sufficient? I can put https://github.com/nharper/
> Internet-Drafts/tree/triple-hs in a PR if it makes sense to remove that
> section from HTTPSTB.
>
> -Nick
>