Subject: Re: [Unbearable] Alice & Bob Collusion (ABC) attack (was: reference in HTTPSTB to TBPROTO out of sync

From: =JeffH <[email-masked]>
Date: Fri, 30 Dec 2016 14:07:46 -0800

> I think it would be helpful for the editors if some security
 > consideration text were proposed to clarify that token binding
 > prevents unauthorized replay of security tokens but not authorized
 > replay of security tokens, when there is collusion between the
 > parties.

sounds nominally reasonable to me. see also..

Re: [Unbearable] Re : Re : Answer to WGLC for core document set
https://www.ietf.org/mail-archive/web/unbearable/current/msg01018.html

=JeffH

---

From: Andrei Popov <[email-masked]>
Date: Fri, 30 Dec 2016 23:18:31 +0000

I will not object against adding a mention of collusion between clients to the security considerations in TBPROTO, if folks think this is useful.

Denis, please feel free to suggest text (as a PR or in e-mail), so that the WG can consider.

Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of =JeffH
Sent: Friday, December 30, 2016 2:08 PM
To: John Bradley <[email-masked]>
Cc: IETF TokBind WG <[email-masked]>
Subject: Re: [Unbearable] Alice & Bob Collusion (ABC) attack (was: reference in HTTPSTB to TBPROTO out of sync

 > I think it would be helpful for the editors if some security  > consideration text were proposed to clarify that token binding  > prevents unauthorized replay of security tokens but not authorized  > replay of security tokens, when there is collusion between the  > parties.

Re: [Unbearable] Re : Re : Answer to WGLC for core document set https://www.ietf.org/mail-archive/web/unbearable/current/msg01018.html

=JeffH		

_______________________________________________
Unbearable mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/unbearable