Subject: [Unbearable] Auth in the HTTP server

From: Bill Mills <[email-masked]>
Date: Wed, 25 Mar 2015 04:19:41 +0000 (UTC)

If the HTTP server is not the TLS server how does the tls-unique value get communicated to the HTTP server and how/when does the HTTP server validate the transaction?
Simple string comparison of a header inserted by the TLS proxy isn't as simple as it looks.
-bill

---

From: Andrei Popov <[email-masked]>
Date: Wed, 25 Mar 2015 04:38:29 +0000

There are existing mechanisms for HTTP servers to retrieve TLS client cert info, and in some implementations, the tls-unique is similarly available  to the HTTP stack. Where this functionality is missing, it can be added.

There are two validation stages:

1.      Signature verification. This can be performed at the TLS layer or HTTP layer. In the former case, the Token Binding ID has to be plumbed through the HTTP stack to the server app. In the latter case, the tls-unique has to be provided by the TLS layer to the HTTP stack, and the Token Binding ID has to be provided by the HTTP stack to the server app. There may be other architectural options as well.

2.      Bound security token verification (comparison of Token Binding ID in the token with the one established for the connection). This can be performed by the server application (possibly, with the help of a framework such as ASP.NET).

Cheers,

Andrei

From: Unbearable [mailto:[email-masked]] On Behalf Of Bill Mills
Sent: Tuesday, March 24, 2015 11:20 PM
To: Tokbind WG
Subject: [Unbearable] Auth in the HTTP server

-bill

---

From: Tony Arcieri <[email-masked]>
Date: Wed, 25 Mar 2015 01:26:07 -0700

I've still been too lazy to scrutinize this group's charter, but can
someone explain to me in a sentence or less why this group isn't massively
duplicating already deployed efforts like TLS channel ID? It seems like
these are solved problems that you're trying to throw ALPN at for dubious
gains.

On Tue, Mar 24, 2015 at 9:38 PM, Andrei Popov <[email-masked]>
wrote:

>  There are existing mechanisms for HTTP servers to retrieve TLS client
> cert info, and in some implementations, the tls-unique is similarly
> available  to the HTTP stack. Where this functionality is missing, it can
> be added.
>
>
>
> 1.      Signature verification. This can be performed at the TLS layer or
> HTTP layer. In the former case, the Token Binding ID has to be plumbed
> through the HTTP stack to the server app. In the latter case, the
> tls-unique has to be provided by the TLS layer to the HTTP stack, and the
> Token Binding ID has to be provided by the HTTP stack to the server app.
> There may be other architectural options as well.
>
> 2.      Bound security token verification (comparison of Token Binding ID
> in the token with the one established for the connection). This can be
> performed by the server application (possibly, with the help of a framework
> such as ASP.NET).
>
>
>
> Cheers,
>
>
>
> Andrei
>
>
>
> *From:* Unbearable [mailto:[email-masked]] *On Behalf Of *Bill
> Mills
> *Sent:* Tuesday, March 24, 2015 11:20 PM
> *To:* Tokbind WG
> *Subject:* [Unbearable] Auth in the HTTP server
>
>
>
> If the HTTP server is not the TLS server how does the tls-unique value get
> communicated to the HTTP server and how/when does the HTTP server validate
> the transaction?
>
>
>
> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable
>
>

-- 
Tony Arcieri

---

From: Andrei Popov <[email-masked]>
Date: Wed, 25 Mar 2015 14:26:52 +0000

Hi Tony,

It’s probably correct to think of this as the next incarnation of Google’s Channel ID, with negotiable signature algorithms and key lengths, and (at least so far) not requiring TLS protocol changes. The use of ALPN is not really essential to Token Binding, and may change based on the discussion in this WG.

Cheers,

Andrei

From: Tony Arcieri [mailto:[email-masked]]
Sent: Wednesday, March 25, 2015 3:26 AM
To: Andrei Popov
Cc: Bill Mills; Tokbind WG
Subject: Re: [Unbearable] Auth in the HTTP server

I've still been too lazy to scrutinize this group's charter, but can someone explain to me in a sentence or less why this group isn't massively duplicating already deployed efforts like TLS channel ID? It seems like these are solved problems that you're trying to throw ALPN at for dubious gains.

On Tue, Mar 24, 2015 at 9:38 PM, Andrei Popov <[email-masked]<mailto:[email-masked]>> wrote:
There are existing mechanisms for HTTP servers to retrieve TLS client cert info, and in some implementations, the tls-unique is similarly available  to the HTTP stack. Where this functionality is missing, it can be added.

2.      Bound security token verification (comparison of Token Binding ID in the token with the one established for the connection). This can be performed by the server application (possibly, with the help of a framework such as ASP.NET<http://ASP.NET>).

Cheers,

Andrei

From: Unbearable [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Bill Mills
Sent: Tuesday, March 24, 2015 11:20 PM
To: Tokbind WG
Subject: [Unbearable] Auth in the HTTP server

-bill

_______________________________________________
Unbearable mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/unbearable

--
Tony Arcieri

---

From: Dirk Balfanz <[email-masked]>
Date: Wed, 25 Mar 2015 15:25:53 +0000

To echo what Andrei said: we (Google) view Token Binding as the next step
in the Origin-Bound Certificates->Channel ID->Token Binding evolution.

Dirk.

On Wed, Mar 25, 2015 at 7:27 AM Andrei Popov <[email-masked]>
wrote:

>  Hi Tony,
>
>
>
> It’s probably correct to think of this as the next incarnation of Google’s
> Channel ID, with negotiable signature algorithms and key lengths, and (at
> least so far) not requiring TLS protocol changes. The use of ALPN is not
> really essential to Token Binding, and may change based on the discussion
> in this WG.
>
>
>
> Cheers,
>
>
>
> Andrei
>
>
>
> *From:* Tony Arcieri [mailto:[email-masked]]
> *Sent:* Wednesday, March 25, 2015 3:26 AM
> *To:* Andrei Popov
> *Cc:* Bill Mills; Tokbind WG
> *Subject:* Re: [Unbearable] Auth in the HTTP server
>
>
>