Subject: [Unbearable] -tokbind-protocol-04: Security considerations incomplete?

From: =JeffH <[email-masked]>
Date: Thu, 3 Mar 2016 19:00:36 -0800

Hi,

Wrt <https://tools.ietf.org/html/draft-ietf-tokbind-protocol-04#section-8>...

 > 8. Security Considerations
 >
 > 8.1. Security Token Replay
 >
 > The goal of the Token Binding protocol is to prevent attackers from
 > exporting and replaying security tokens, thereby impersonating
 > legitimate users and gaining access to protected resources. Bound
 > tokens can still be replayed by the malware present in the User
 > Agent. In order to export the token to another machine and
 > successfully replay it, the attacker also needs to export the
 > corresponding private key. Token Binding private keys are therefore
 > high-value assets and SHOULD be strongly protected, ideally by
 > generating them in a hardware security module that prevents key
 > export.

The above, wrt an active & external attacker needing to also wield the 
client's TB private key, is succinct but may not be intuitively obvious to 
the reader, plus it does not describe possible consequences/exploit scenarios.

Also, there are not (in TBPROTO) security considerations discussing 
impersonation and MITM scenarios, and thus its sec cons are arguably 
incomplete. C.f. https://tools.ietf.org/html/rfc3552

Overviews of such scenarios could be provided, e.g., by leveraging and 
generalizing the HTTP-specific analysis in -tokbind-https-02 sections 4.4 & 
4.5 which appear to address these issues, and also fill-in some of the 
background for S 8.1 above.

Having complete sec cons in TBPROTO will arguably be helpful to non-HTTP 
protocols/apps employing TLS that may wish to leverage TLS Token Binding, 
and may not review -tokbind-https.

HTH,

=JeffH