Subject: [Unbearable] (late) WGLC nit on TBNEGO

From: Brian Campbell <[email-masked]>
Date: Mon, 19 Dec 2016 12:26:12 -0700

TBNEGO sec 6.2
<https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-06#section-6.2>
mentions "these TLS versions" but other than in the section title doesn't
say what those versions are. Astute readers can figure it out from the
section title or also content in section 4 but it does reads somewhat
awkward as it is now. I'd suggest adding wording similar to TBPROTO sec 7.5
<https://tools.ietf.org/html/draft-ietf-tokbind-protocol-11#section-7.5>
and HTTPSTB sec 7.2
<https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-7.2> that
has "in TLS 1.2 and older TLS versions" earlier in the paragraph. And maybe
even going so far as having those three sections just have identical text.

https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-06#section-6.2
6.2.  Triple Handshake Vulnerability in TLS 1.2 and Older TLS Versions

   The Token Binding protocol relies on the TLS Exporters [RFC5705] to
   associate a TLS connection with a Token Binding.  The triple
   handshake attack [TRIPLE-HS] is a known TLS protocol vulnerability
   allowing the attacker to synchronize exported keying material between
   TLS connections.  The attacker can then successfully replay bound
   tokens.  For this reason, the Token Binding protocol MUST NOT be
   negotiated with these TLS versions, unless the Extended Master Secret
   [RFC7627] and Renegotiation Indication [RFC5746] TLS extensions have
   also been negotiated.

https://tools.ietf.org/html/draft-ietf-tokbind-protocol-11#section-7.5
7.5.  Triple Handshake Vulnerability in TLS 1.2 and Older TLS Versions

   The Token Binding protocol relies on the exported keying material
   (EKM) to associate a TLS connection with a Token Binding.  The triple
   handshake attack [TRIPLE-HS] is a known vulnerability in TLS 1.2 and
   older TLS versions, allowing the attacker to synchronize keying
   material between TLS connections.  The attacker can then successfully
   replay bound tokens.  For this reason, the Token Binding protocol
   MUST NOT be negotiated with these TLS versions, unless the Extended
   Master Secret [RFC7627] and Renegotiation Indication [RFC5746] TLS
   extensions have also been negotiated.

https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-7.2
7.2.  Triple Handshake Vulnerability in TLS 1.2 and Older TLS Versions

   The Token Binding protocol relies on the exported key material (EKM)
   value [RFC5705] to associate a TLS connection with a TLS Token
   Binding.  The triple handshake attack [TRIPLE-HS] is a known
   vulnerability in TLS 1.2 and older TLS versions, allowing the
   attacker to synchronize keying material between TLS connections.  The
   attacker can then successfully replay bound tokens.  For this reason,
   the Token Binding protocol MUST NOT be negotiated with these TLS
   versions, unless the Extended Master Secret [RFC7627] and
   Renegotiation Indication [RFC5746] TLS extensions have also been
   negotiated.

---

From: Andrei Popov <[email-masked]>
Date: Mon, 19 Dec 2016 19:39:37 +0000

Good point, thanks, Brian, for catching this. Will fix in the next revision.

Cheers,

Andrei

From: Unbearable [mailto:[email-masked]] On Behalf Of Brian Campbell
Sent: Monday, December 19, 2016 11:26 AM
To: IETF Tokbind WG <[email-masked]>
Subject: [Unbearable] (late) WGLC nit on TBNEGO

TBNEGO sec 6.2<https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-06#section-6.2> mentions "these TLS versions" but other than in the section title doesn't say what those versions are. Astute readers can figure it out from the section title or also content in section 4 but it does reads somewhat awkward as it is now. I'd suggest adding wording similar to TBPROTO sec 7.5<https://tools.ietf.org/html/draft-ietf-tokbind-protocol-11#section-7.5> and HTTPSTB sec 7.2<https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-7.2> that has "in TLS 1.2 and older TLS versions" earlier in the paragraph. And maybe even going so far as having those three sections just have identical text.

---

From: Andrei Popov <[email-masked]>
Date: Fri, 23 Dec 2016 21:32:34 +0000

Updated TBNEGO-07 on GitHub to clarify this.

Cheers,

Andrei

From: Unbearable [mailto:[email-masked]] On Behalf Of Andrei Popov
Sent: Monday, December 19, 2016 11:40 AM
To: Brian Campbell <[email-masked]>; IETF Tokbind WG <[email-masked]>
Subject: Re: [Unbearable] (late) WGLC nit on TBNEGO

Cheers,

Andrei