Subject: Re: [Unbearable] -tokbind-https-02: "Federated token bindings" figures

From: [email-masked]
Date: Fri, 4 Mar 2016 11:38:30 -0700

I've made some very minor editorial changes to the "Token Binding over HTTP:
Federation Use Cases" figure...

Token Binding over HTTP
https://tools.ietf.org/html/draft-ietf-tokbind-https

Diagram of section 3. Federation Use Cases
https://tools.ietf.org/html/draft-ietf-tokbind-https-02#section-3

What:
  Typical HTTP Redirect-based Web Broswer SSO Profile
  (no artifact, no callbacks), featuring binding of,
  e.g., a TLS Token Binding ID into an OpenID Connect "ID Token".

Legend:

  EKM:       TLS Exported Keying Material [RFC5705]

  {EKMn}Ksm: EKM for server "n", signed by private key of TBID "m",
			 where "n" must represent server receiving the ETBMSG,
			 if a conveyed TB's type is provided_token_binding, then
			 m = n, else if TB's type is referred_token_binding, then
			 m != n. E.g., see step 1b in diagram below.

  ETBMSG:    "Token-Binding" HTTP header field conveying an
             EncodedTokenBindingMessage, in turn conveying
             TokenBinding (TB)struct(s), e.g.:
             ETBMSG[[TB]] or ETBMSG[[TB1],[TB2]]

  ID Token:  the "ID Token" in OIDC, it is the semantic equivalent
			 of a SAML "authentication assertion". "ID Token w/TBIDn"
			 denotes a "token bound" ID Token containing TBIDn.

  Ks & Kp:   private (aka secret) key, and public key, respectively,
			 of client-side Token Binding key pair

  OIDC:      Open ID Connect

  TB:        TokenBinding struct containing signed EKM, TBID, and
             TB type, e.g.: [{EKM1}Ks1,TBID1,provided_token_binding]

  TBIDn:     Token Binding ID for client and server n's token-bound
             TLS association. TBIDn contains Kpn.

  Client,                      Token Consumer,       Token Provider, aka:     
                   aka:                  aka:
  User Agent                   OpenID Client,        OpenID Provider,
                               OIDC Relying Party,   OIDC Provider, SAML
Relying Party    SAML Identity Provider [
server "1" ]        [ server "2" ]
  +--------+                        +----+                +-----+
  | Client |                        | TC |                | TP  |
  +--------+                        +----+                +-----+
      |                               |                      |
      |                               |                      |
      |                               |                      |
      | 0. Client interacts w/TC      |                      |
      | over HTTPS, establishes Ks1 & Kp1, TBID1             |
      | ETBMSG[[{EKM1}Ks1,TBID1,provided_token_binding]]     |
      |------------------------------>|                      |
      |                               |                      |
      |                               |                      |
      |                               |                      |
      | 1a. OIDC ID Token request, aka|                      |
      | "Authentication Request", conveyed with              |
      | HTTP response header field of:                       |
      | Include-Referer-Token-Binding-ID:true                |
      | any security-relevant cookies |                      |
      | should contain TBID1          |                      |
    +<- - - - - - - - - - - - - - - - |                      |
    . | (redirect to TP via 301, 302, |                      |
    . |  303, 307, or 308)            |                      |
    . |                               |                      |
    +------------------------------------------------------->|
      | 1b. opens HTTPS w/ TP,                               |
      | establishes Ks2, Kp2, TBID2;                         |
      | sends GET or POST with                               |
      | ETBMSG[[{EKM2}Ks2,TBID2,provided_token_binding],     |
      |       [{EKM2}Ks1,TBID1,referred_token_binding]]      |
      | as well as the ID Token request                      |
      |                               |                      |
      |                               |                      |
      |                               |                      |
      | 2. user authentication (if applicable,               |
      |    methods vary, particulars are out of scope)       |
      |<====================================================>|
      | (TP generates ID Token for TC containing TBID1, may  |
      |  also set cookie(s) containing TBID2 and/or TBID1,   |
      |  details vary, particulars are out of scope)         |
      |                               |                      |
      |                               |                      |
      |                               |                      |
      | 3a. ID Token containing TBID1, issued for TC,        |
      |    conveyed via OIDC "Authentication Response"       |
    +<- - - - - - - - - - - - - - - - - - - - - - - - - - - -|
    . |   (redirect to TC)            |                      |
    . |                               |                      |
    . |                               |                      |
    +-------------------------------->|                      |
      | 3b. HTTPS GET or POST with                           |
      | ETBMSG[[{EKM1}Ks1,TBID1,provided_token_binding]]     |
      | conveying Authn Reponse containing                   |
      | ID Token w/TBID1, issued for TC                      |
      |                               |                      |
      |                               |                      |
      |                               |                      |
      | 4. user is signed-on, any security-relevant cookie(s)|
      | that are set SHOULD contain TBID1                    |
      |<------------------------------|                      |
      |                               |                      |
      |                               |                      |

---

From: [email-masked]
Date: Fri, 4 Mar 2016 11:56:29 -0700

> Federation Use Cases" figure...

apologies, prior msg had some of them sneaky tab chars in there causing
misalignment, I'll have to resend using a different MUA later on...