Subject: [Unbearable] matching TBNEGO and TokenBinding algorithm and key lengths

From: Ron Monzillo <[email-masked]>
Date: Mon, 01 Jun 2015 15:21:34 -0400

from 
https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/?include_text=1

section 3.

> At least one TokenBinding MUST be
>     included in the Token Binding message.  The signature and hash
>     algorithm and key length used in the TokenBinding MUST match the
>     parameters negotiated via [TBNEGO].
the values for hash and signature algorithm are

enum {
     sha256(4), (255)
} HashAlgorithm;

enum {
     rsa(1), ecdsap256(3), (255)
} SignatureAlgorithm;

struct {
     HashAlgorithm hash;
     SignatureAlgorithm signature;
} SignatureAndHashAlgorithm;

in https://tools.ietf.org/html/draft-popov-tokbind-negotiation-00#page-2

there are values that appear to define combinations of algorithm with 
key length

enum {
     rsa2048_pkcs1.5_sha256(0), rsa2048_pss_sha256(1), ecdsap256_sha256(2), (255)
} TokenBindingKeyParameters;

Are you planning to adopt a common scheme in both specs?

---

From: Andrei Popov <[email-masked]>
Date: Mon, 1 Jun 2015 22:46:19 +0000

Hi Ron,

I think the 1-byte IDs used in [TBNEGO] have the advantage of simplicity. If the WG agrees with the approach taken in [TBNEGO], then it makes sense to update [TBPROTO] to use the same.

Cheers,

Andrei

From: Unbearable [mailto:[email-masked]] On Behalf Of Ron Monzillo
Sent: Monday, June 1, 2015 12:22 PM
To: [email-masked]
Subject: [Unbearable] matching TBNEGO and TokenBinding algorithm and key lengths

from https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/?include_text=1

section 3.

enum {

    sha256(4), (255)

} HashAlgorithm;

enum {

} SignatureAlgorithm;

struct {

    HashAlgorithm hash;

there are values that appear to define combinations of algorithm with key length

enum {