Subject: Re: [Unbearable] -tokbind-https-02: "Federated token bindings" figures

From: =JeffH <[email-masked]>
Date: Tue, 1 Mar 2016 11:03:52 -0800

I've updated the "Token Binding over HTTP: Federation Use Cases" figure 
adding EKMs & keys and denoting who-signs-what-when, per discussion in the 
"-tokbind-protocol-04: verifying signature(s) in 
TokenBindingMessage.TokenBinding?" thread.

HTH,

=JeffH

Token Binding over HTTP
https://tools.ietf.org/html/draft-ietf-tokbind-https

Diagram of section 3. Federation Use Cases
https://tools.ietf.org/html/draft-ietf-tokbind-https-02#section-3

What:
   Typical HTTP Redirect-based Web Broswer SSO Profile
   (no artifact, no callbacks), featuring binding of
   a TLS Token Binding ID into an OpenID Connect "ID Token".

Legend:

   EKM:       TLS Exported Keying Material [RFC5705]

   {EKMn}Ksm: EKM for server "n", signed by private key of TBID "m",
	     where "n" must represent server receiving the ETBMSG.
	     if a conveyed TB's type is provided_token_binding, then
	     m = n, else if TB's type is referred_token_binding, then
	     m != n. E.g., see step 1b in diagram below.

   ETBMSG:    "Token-Binding" HTTP header field conveying an
              EncodedTokenBindingMessage, in turn conveying
              TokenBinding (TB)struct(s), e.g.:
              ETBMSG[[TB]] or ETBMSG[[TB1],[TB2]]			
			
   ID Token:  the "ID Token" in OIDC, it is the semantic equivalent
	     of a SAML "authentication assertion". "ID Token w/TBIDn"
	     denotes a "token bound" ID Token containing TBIDn.
			
   Ks & Kp:   private (aka secret) key, and public key, respectively,
	     of client-side Token Binding key pair
	
   OIDC:      Open ID Connect

   TB:        TokenBinding struct containing signed EKM, TBID, and
              TB type, e.g.: [{EKM1}Ks1,TBID1,provided_token_binding]
	
   TBIDn:     Token Binding ID for client and server n's token-bound
              TLS association

   Client,                      Token Consumer,       Token Provider,
   aka:                         aka:                  aka:
   User Agent                   OpenID Client,        OpenID Provider,
                                OIDC Relying Party,   OIDC Provider,
                                SAML Relying Party    SAML Identity Provider
                                [ server "1" ]        [ server "2" ]
   +--------+                        +----+                +-----+
   | Client |                        | TC |                | TP  |
   +--------+                        +----+                +-----+
       |                               |                      |
       |                               |                      |
       |                               |                      |
       | 0. Client interacts w/TC      |                      |
       | over HTTPS, establishes Ks1 & Kp1, TBID1             |
       | ETBMSG[[{EKM1}Ks1,TBID1,provided_token_binding]]     |
       |------------------------------>|                      |
       |                               |                      |
       |                               |                      |
       |                               |                      |
       | 1a. OIDC ID Token request, aka|                      |
       | "Authentication Request", conveyed with              |
       | HTTP response header field of:                       |
       | Include-Referer-Token-Binding-ID:true                |
       | any security-relevant cookies |                      |
       | should contain TBID1          |                      |
     +<- - - - - - - - - - - - - - - - |                      |
     . | (redirect to TP via 301, 302, |                      |
     . |  303, 307, or 308)            |                      |
     . |                               |                      |
     +------------------------------------------------------->|
       | 1b. opens HTTPS & establishes Ks2, Kp2, TBID2;       |
       | sends GET or POST with                               |
       | ETBMSG[[{EKM2}Ks2,TBID2,provided_token_binding],     |
       |       [{EKM2}Ks1,TBID1,referred_token_binding]]      |
       | as well as the ID Token request                      |
       |                               |                      |
       |                               |                      |
       |                               |                      |
       | 2. user authentication (if applicable,               |
       |    methods vary, particulars are out of scope)       |
       |<====================================================>|
       | (TP generates ID Token for TC containing TBID1, may  |
       |  also set cookie(s) containing TBID2 and/or TBID1,   |
       |  details vary, particulars are out of scope)         |
       |                               |                      |
       |                               |                      |
       |                               |                      |
       | 3a. ID Token containing TBID1, issued for TC,        |
       |    conveyed via OIDC "Authentication Response"       |
     +<- - - - - - - - - - - - - - - - - - - - - - - - - - - -|
     . |   (redirect to TC)            |                      |
     . |                               |                      |
     . |                               |                      |
     +-------------------------------->|                      |
       | 3b. HTTPS GET or POST with                           |
       | ETBMSG[[{EKM1}Ks1,TBID1,provided_token_binding]]     |
       | conveying Authn Reponse containing                   |
       | ID Token w/TBID1, issued for TC                      |
       |                               |                      |
       |                               |                      |
       |                               |                      |
       | 4. user is signed-on, any security-relevant cookie(s)|
       | that are set SHOULD contain TBID1                    |
       |<------------------------------|                      |
       |                               |                      |
       |                               |                      |