Subject: [kitten] Channel binding questions.

From: William Mills <[email-masked]>
Date: Wed, 2 Mar 2011 13:09:24 -0800

For Channel Binding I have a few questions:

In the standard mechanism (non-CB) is defense against downgrade attacks required? (I think this is a yes).

Is it OK to put the downgrade defense in the same message that auth credentials would go in, or is it required that the CB negotiation/messaging happen first before any credentials are transmitted?

Would it be reasonable in the context of the OAUTH mechanism to overload the channel binding message into the HTTP Authorization header?  For this I'd probably define an Authorization scheme for this.

Another alternative in the context of the tunneled HTTP that the OAUTH mechanism is becoming is to define a pseudo location /channel-binding and have a client that supports channel binding send that request first.  The use of HTTP style here is simply to fall back on a single, well understood,  message format.

Thanks,

-bill