Subject: [Unbearable] HTTPSTB: WGLC: web origin -> eTLD+1

From: =JeffH <[email-masked]>
Date: Tue, 13 Dec 2016 13:07:17 -0800

https://github.com/TokenBinding/Internet-Drafts/issues/85

In section "2.1.  HTTPS Token Binding Key Pair Scoping" 
<https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-2.1> we 
say..

    The Token Binding key pair scoping for those key pairs generated by
    Web browsers in the context of the first-party and federation use
    cases defined in this specification (below), and to be used for
    binding HTTP cookies MUST be at the granularity of "effective top-
    level domain (public suffix) + 1" (eTLD+1), i.e., at the same
    granularity at which cookies can be set (see [RFC6265]).

Note the eTLD+1 requirement above.

Then, in section "5.3.  HTTP Redirects" 
<https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-5.3>, 
we say (emphasis added)..

    The TokenBindingMessage SHOULD contain a TokenBinding with
    TokenBindingType referred_token_binding.  If included, this
    TokenBinding MUST be signed with the Token Binding key used by the
    client for connections between itself and the Token Consumer (more
    specifically, the *web origin* that issued the
    Include-Referred-Token-Binding-ID response header field).  The
    Token Binding ID established by this TokenBinding is called a
    Referred Token Binding ID.

    As described above, the TokenBindingMessage MUST additionally contain
    a Provided Token Binding ID, i.e., a TokenBinding structure with
    TokenBindingType provided_token_binding, which MUST be signed with
    the Token Binding key used by the client for connections between
    itself and the Token Provider (more specifically, the *web origin*
    that the token request is being sent to).

..and note the use of the term "web origin".

In total, there are 7 occurrences of "origin" or "web origin" in HTTPSTB.

I propose to change the occurrences of "web origin" to "eTLD+1".

---

From: =JeffH <[email-masked]>
Date: Tue, 13 Dec 2016 13:24:30 -0800

> https://github.com/TokenBinding/Internet-Drafts/issues/85
[...]
 > I propose to change the occurrences of "web origin" to "eTLD+1".

Oops, sent too soon, have updated the issue to read..

I propose to change the occurrences of "web origin" to "eTLD+1" or 
"server", as appropriate.