Subject: [Acme] Multiple Accounts with Same Key

From: Logan Widick <[email-masked]>
Date: Thu, 20 Apr 2017 11:35:21 -0500

All,

How should a server respond if a client is trying to perform an action that
would result in multiple active accounts having the same account key? For
example:

   - Sending a key-change request with a newKey that is already in use by
   another account
   - (If https://github.com/ietf-wg-acme/acme/issues/294 is merged into
   master) Sending a new-account request (that doesn't have the new "recovery"
   field or has the new field set to false) with a key that is already used by
   another account

Should the server respond with an error code? Allow multiple accounts with
the same key to coexist? Do something else?

Sincerely,

Logan Widick

---

From: Zach Shepherd <[email-masked]>
Date: Thu, 20 Apr 2017 20:29:51 +0000

Given that account recovery is based on key (with or without #294<https://github.com/ietf-wg-acme/acme/issues/294>), it seems like allowing multiple accounts to coexist with the same key would be problematic.

It also seems like attempting to create a second account with the same key would almost always indicate user- or client-error.

Responding with an error seems best, but no existing error type seems appropriate.

________________________________
From: Acme <[email-masked]> on behalf of Logan Widick <[email-masked]>
Sent: Thursday, April 20, 2017 9:35 AM
To: ACME WG
Subject: [Acme] Multiple Accounts with Same Key

All,

How should a server respond if a client is trying to perform an action that would result in multiple active accounts having the same account key? For example:

  *   Sending a key-change request with a newKey that is already in use by another account
  *   (If https://github.com/ietf-wg-acme/acme/issues/294<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_ietf-2Dwg-2Dacme_acme_issues_294&d=DwMFaQ&c=uilaK90D4TOVoH58JNXRgQ&r=Z9jmRNJFc0_mrYgZ7k4FWDuC1AsqA1UJKUYIM6ZnnNk&m=fT5vYOMkmme0438ks680s1E87y3_9uzpVRXo68BKP0g&s=RQZTzj8SNgzWJCM0DOIr88G0VC9ETYS7ZMt_QKVTT1I&e=> is merged into master) Sending a new-account request (that doesn't have the new "recovery" field or has the new field set to false) with a key that is already used by another account

Should the server respond with an error code? Allow multiple accounts with the same key to coexist? Do something else?

Sincerely,

Logan Widick

---

From: Logan Widick <[email-masked]>
Date: Thu, 20 Apr 2017 18:02:04 -0500

So there would need to be a new error type (possibly named something like
"accountKeyCollision")?

If so, what would be the right HTTP code? 400 (Bad Request)? Or something
else?

On receiving the error, should the client either generate a different key
to change to or use the account URL recovery mechanism?

Would the desired response change if the key clash involved a deactivated
account (whether by client or CA) instead of an active one?

On Thu, Apr 20, 2017 at 3:29 PM, Zach Shepherd <[email-masked]> wrote:

> Given that account recovery is based on key (with or without #294
> <https://github.com/ietf-wg-acme/acme/issues/294>), it seems like
> allowing multiple accounts to coexist with the same key would be
> problematic.
>
>
> It also seems like attempting to create a second account with the same key
> would almost always indicate user- or client-error.
>
> ------------------------------
> *From:* Acme <[email-masked]> on behalf of Logan Widick <
> [email-masked]>
> *Sent:* Thursday, April 20, 2017 9:35 AM
> *To:* ACME WG
> *Subject:* [Acme] Multiple Accounts with Same Key
>
> All,
>
> How should a server respond if a client is trying to perform an action
> that would result in multiple active accounts having the same account key?
> For example:
>
>    - (If https://github.com/ietf-wg-acme/acme/issues/294
>    <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_ietf-2Dwg-2Dacme_acme_issues_294&d=DwMFaQ&c=uilaK90D4TOVoH58JNXRgQ&r=Z9jmRNJFc0_mrYgZ7k4FWDuC1AsqA1UJKUYIM6ZnnNk&m=fT5vYOMkmme0438ks680s1E87y3_9uzpVRXo68BKP0g&s=RQZTzj8SNgzWJCM0DOIr88G0VC9ETYS7ZMt_QKVTT1I&e=> is
>    merged into master) Sending a new-account request (that doesn't have the
>    new "recovery" field or has the new field set to false) with a key that is
>    already used by another account
>

---

From: Richard Barnes <[email-masked]>
Date: Thu, 27 Apr 2017 17:34:00 -0400

I agree we should forbid this behavior.  Draft PR specifying an HTTP error
code but not an ACME one:

https://github.com/ietf-wg-acme/acme/pull/307

On Thu, Apr 20, 2017 at 7:02 PM, Logan Widick <[email-masked]>
wrote:

>> It also seems like attempting to create a second account with the same
>> key would almost always indicate user- or client-error.
>>
>>    - Sending a key-change request with a newKey that is already in use
>>    by another account
>> Should the server respond with an error code? Allow multiple accounts
>> with the same key to coexist? Do something else?
>>
>> Sincerely,
>>
>> Logan Widick
>>
>
>
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>
>