Subject: Re: [Unbearable] Potential privacy bug if Include-Referer-Token-Binding-ID is improperly implemented client-side

From: =JeffH <[email-masked]>
Date: Mon, 21 Mar 2016 16:02:31 -0700

> Here's the problem: Suppose the connection to server A is over http.

did you mean 'http' or 'https' in the above?

 > Now a
 > network attacker B injects into some http page (from server C) code that
 > will cause the client to make an http request to server A.

'http' or 'https' ?

 > The attacker B
 > intercepts the request and responds with a redirect to server B (with the
 > Include-Referer-Token-Binding-ID header). The client dutifully follows that
 > request and forwards the TokenBindingID it has for A to the
 > attacker-controlled B. This is a problem, because A never intended to have
 > the client forward its TokenBindingID from A to B.

In any case, part of the way to deal with this sort of issue is to 
normatively stipulate that the client MUST not honor 
Include-Referer-Token-Binding-ID headers that are not received over 
(established error free) secure transport, a la HSTS & HPKP. similarly, the 
server should not honor any (sec-)token-binding header received over 
insecure transport.

-tokbind-https-03 does say in the Intro..

    ...Note that TokenBindingMessages are only defined if the underlying
    transport uses TLS.  This means that Token Binding over HTTP is only
    defined when the HTTP protocol is layered on top of TLS (commonly
    referred to as HTTPS).

..but it doesn't appear to normatively back this up.

HTH,

=JeffH

---

From: Nick Harper <[email-masked]>
Date: Mon, 21 Mar 2016 16:25:15 -0700

> did you mean 'http' or 'https' in the above?

http

> > will cause the client to make an http request to server A.

http

> server should not honor any (sec-)token-binding header received over

The conditions for when a user-agent can honor an
Include-Referer-Token-Binding-ID should be the same conditions for when it
sends a Sec-Token-Binding header. It by necessity must be only for https
connections (because there is no EKM to sign for http connections). It
would certainly be nice for the transport to be established error free, and
to use HSTS and HPKP, but I don't think those need to be made as
requirements for using Token Binding.

> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable
>