Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: apply Mike Jones' feedback (#96)

From: =JeffH <[email-masked]>
Date: Tue, 18 Apr 2017 15:51:16 -0700

equalsJeffH commented on this pull request.

> @@ -391,16 +389,19 @@
         the encompassing application. 
         </t>
         
-        <t>The scoping for those Token Binding key pairs generated by Web browsers in 
-        the context of the first-party and federation use cases defined in this 
-        specification (below), and to be used for binding HTTP cookies MUST be at the 
-        granularity of "effective top-level domain (public suffix) + 1" (eTLD+1), 
-          i.e., at the same granularity at which cookies can be set 
-          (see <xref target="RFC6265"/>).  Key pairs used to bind other application
+        <t>The scoping of Token Binding key pairs generated by Web browsers for use in 
+        first-party and federation use cases defined in this 
+        specification (<xref target="federation"/>, below), and intended for 
+        binding HTTP cookies, MUST be at the 

done.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/pull/96#discussion_r112082891

---

From: =JeffH <[email-masked]>
Date: Tue, 18 Apr 2017 15:51:28 -0700

>  	assertion).</t>
 	<t>To better protect the security of the identity token, the
 	Identity Provider may wish to bind the identity token to the TLS
 	connection between the client and the Relying Party, thus
-	ensuring that only said client can use the identity token: The
-	Relying Party will compare the Token Binding ID in the identity
-	token with the Token Binding ID of the TLS connection between it
-	and the client.</t>
+	ensuring that only said client can use the identity token; the
+	Relying Party will compare the Token Binding ID (or a cryptographic 
+	hash of it) in the identity token with the Token Binding ID of the 

done, i think.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/pull/96#discussion_r112082913

---

From: =JeffH <[email-masked]>
Date: Tue, 18 Apr 2017 15:51:39 -0700

>            any redirect URL issued by the Token Consumer (as well as with any
           Javascript running in the origin of the Token Consumer). The goal of
-          the man-in-the-middle is to trick the Token Provider to issue a token
-          bound to <spanx style="emph">its</spanx> Token Binding ID, not to
+          the man-in-the-middle is to trick the Token Provider to issuing a token

done, thx.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/pull/96#discussion_r112082945

---

From: =JeffH <[email-masked]>
Date: Tue, 18 Apr 2017 15:52:57 -0700

@equalsJeffH pushed 1 commit.

6f2c838  incorp @Andrei-Popov's comments - thx!

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/pull/96/files/7a8aea7cca2499e45c66be3c25e06aabd75dceb9..6f2c8386164172778e7de174d5b6dc0abfd40c1f

---

From: =JeffH <[email-masked]>
Date: Tue, 18 Apr 2017 15:53:49 -0700

@Andrei-Popov's comments incorp'd -- thx!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/TokenBinding/Internet-Drafts/pull/96#issuecomment-295008224