Subject: [Unbearable] Re : Re : Answer to WGLC for core document set

From: [email-masked]
Date: Thu, 1 Dec 2016 23:15:35 +0100 (CET)

I believe that there is indeed a solution to defeat the ABC attack.

Saying in the security considerations section that the mechanism is vulnerable while there would exist a mechanism that is immune might not be the best approach.

Whatever kind of cryptography is being used there is not solution without the use of a secure element that does much more than protecting secret or private keys.

The solution cannot be based on the use of TLS. It would need to be based on the use of a specific element contained in the access token. Hence the need to standardize this element,e.g. using the JWT format.

The whole approach or architecture would be quite different from the current approach.

Denis

----- Mail d'origine -----
De: John Bradley <[email-masked]>
À: Denis <[email-masked]>
Envoyé: Thu, 01 Dec 2016 02:54:16 +0100 (CET)
Objet: Re: [Unbearable] Re : Answer to WGLC for core document set

I suppose that Alice could extract the EKM from her session and send it to
Bob to sign and produce the token binding header that Alice would need to
send with the token.

Are you saying that there is a solution to this sort of collision or that
we need to say that we don't prevent it.

I am just north of Patagonia in Chile myself a nice time of year to visit.

Regards
JOHN B

On Nov 30, 2016 22:06, <[email-masked]> wrote:

> Bob's private key needs to be used to sign the EKM for Alice's TLS session
> where she would present the cookie or token.
>
> Otherwise the server that receives the bound token will reject it because
> Alice cannot prove possession of the token binding ID associated with that
> token.
>
> Alice needs to provide her key material to Bob or Bob needs to provide his
> to Alice for your collision to work.
>
> Regards
> John B.
>
> On Nov 30, 2016 21:36, <[email-masked]> wrote:
>
>> For this attack to work Bob would also need to transmit the token binding
>> keys for the issued token to Alice.
>>
>> Is that what you mean by the collision attack?
>>
>> Would addressing in security considerations that this won't protect
>> against user collision unless the token binding keys are stored in some
>> sort of secure storage and not extractable by the user, satisfy your
>> concern, Or are you imagining some other method of binding the token.
>>
>> Regards
>> John B
>>
>> On Nov 30, 2016 19:22, <[email-masked]> wrote:
>>
>>> This set of documents failed to meet the terms of références of the WG
>>> charter.
>>>
>>> It is not resistant to the ABC attack (Alice and Bob collusion attack).
>>> In this attack Bob who is older than 18 colloborates with Alice and
>>> transmits a token to Alice who is only 14 so that she can démonstrateur to
>>> a RS that she is older than 18.
>>>
>>> This kind of attack is not even mentionned in the security
>>> considerations section.
>>>
>>> This set of documents should not be progressed to IETF last call unless
>>> the attack can be countered.
>>>
>>> Denis
>>> >>
>>> >> > This starts a working group last call for the following documents:
>>> >> >
>>> >> > draft-ietf-tokbind-https-06
>>> >> > draft-ietf-tokbind-negotiation-05
>>> >> > draft-ietf-tokbind-protocol-10
>>> >> >
>>> >> > Any comments should be send to the list before EOB November 30th
>>> >>
>>> >>
>>> >> Ok, I have some modest editorial comments/polishing I'm trying to get
>>> >> done, but the 2 week WGLC is sorta short given us american's feast of
>>> >> thanksgiving last week and various end-of-year corporate must-dos.
>>> I'll get
>>> >> my comments in by the end of this week, I trust that'll be ok.
>>> >>
>>> >> thanks,
>>> >>
>>> >> =JeffH
>>> >>
>>> >> _______________________________________________
>>> >> Unbearable mailing list
>>> >> [email-masked]
>>> >> https://www.ietf.org/mailman/listinfo/unbearable
>>> >>
>>> >
>>> >
>>> >
>>> > --
>>> > <https://www.pingidentity.com/>
>>> > <https://www.pingidentity.com/>
>>> > Brian Campbell
>>> > Distinguished Engineer
>>> > [email-masked]
>>> > w: +1 720.317.2061 <(720)%20317-2061>
>>> > c: +1 303.918.9415 <(303)%20918-9415>
>>> > Connect with us: 
>>> > <https://www.glassdoor.com/Overview/Working-at-Ping-Identity
>>> -EI_IE380907.11,24.htm> [image:
>>> > LinkedIn logo] <https://www.linkedin.com/company/21870> [image:
>>> twitter
>>> > logo] <https://twitter.com/pingidentity> 
>>> > <https://www.facebook.com/pingidentitypage> 
>>> > <https://www.youtube.com/user/PingIdentityTV> 
>>> > <https://plus.google.com/u/0/114266977739397708540> 
>>> > <https://www.pingidentity.com/en/blog.html>
>>> > <https://www.pingidentity.com/en/about.html>
>>> > _______________________________________________
>>> > Unbearable mailing list
>>> > [email-masked]
>>> > https://www.ietf.org/mailman/listinfo/unbearable
>>> >
>>> >
>>> >
>>>
>>>
>>> --
>>> <https://www.pingidentity.com>
>>> <https://www.pingidentity.com>
>>> Brian Campbell
>>> Distinguished Engineer
>>> [email-masked]
>>> w: +1 720.317.2061
>>> c: +1 303.918.9415
>>> Connect with us: 
>>> <https://www.glassdoor.com/Overview/Working-at-Ping-Identity
>>> -EI_IE380907.11,24.htm>
>>> [image:
>>> LinkedIn logo] <https://www.linkedin.com/company/21870> [image: twitter
>>> logo] <https://twitter.com/pingidentity> 
>>> <https://www.facebook.com/pingidentitypage> 
>>> <https://www.youtube.com/user/PingIdentityTV> 
>>> <https://plus.google.com/u/0/114266977739397708540> 
>>> <https://www.pingidentity.com/en/blog.html>
>>> <https://www.pingidentity.com/en/about.html>
>>>
>>>

---

From: John Bradley <[email-masked]>
Date: Thu, 1 Dec 2016 19:45:50 -0300

You should probably be looking at the Token binding drafts in the the OAuth WG.

This WG is only defining the method for tying tokens to the transport layer.  

It is up to other protocols like OAuth to define how to use those bindings. 

The JWT PoP spec https://tools.ietf.org/html/rfc7800 <https://tools.ietf.org/html/rfc7800> lays the foundation for a confirmation claim in JWT, and is not specific to token binding.  That may be part of what you are looking for.

As I don’t know what your proposal to address collision is I really cant speculate on it at this point.

Regards
John B.

> On Dec 1, 2016, at 7:15 PM, [email-masked] wrote:
>