<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi Dave,<br class=""><div><blockquote type="cite" class=""><div class="">Am 13.11.2017 um 17:29 schrieb Dave Tonge <<a href="mailto:dave.tonge@momentumft.co.uk" class="">dave.tonge@momentumft.co.uk</a>>:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;">Hi Torsten</div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;"><br class=""></div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;">Good question. So the general principle was not relying purely on a bearer token from the OP to the Client. </div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;">From my perspective the threat model is something like this:</div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;"> - The client_notification_endpoint is only protected by a bearer token</div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;"> - This bearer token could leak which could allow a malicious actor to deliver the wrong access token to the client</div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;"> - For example, a MITM between the OP and the Client could intercept two CIBA notification callbacks and swap the access tokens. The proposal would at least bind the access token to the id token.</div></div></div></blockquote><div><br class=""></div>TLS server authentication was invented to solve MITM, right? :-)</div><div><br class=""></div><div>To me this sounds like the well-known discussion about bearer vs. PoP tokens. Would it be possible to utilize any of the solutions being developed at the OAuth WG (Token Binding, mTLS for OAuth, ...). For a discussion of the attack angle, you may take a look into <a href="https://tools.ietf.org/html/draft-ietf-oauth-security-topics-04#section-4.7" class="">https://tools.ietf.org/html/draft-ietf-oauth-security-topics-04#section-4.7</a>. Just change the roles and make the CIBA RP the RS and the CIBA OP the client.</div><div><br class=""></div><div>Best regards,</div><div>Torsten.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;"><br class=""></div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;">To fully prevent the above attack the auth_req_id (or a hash of it should probably also be included in the id_token).</div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;"><br class=""></div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;">John or Nat may have a view on this as well?</div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;"><br class=""></div><div class="gmail_default" style="font-family: 'trebuchet ms', sans-serif;">Dave</div></div><div class="gmail_extra" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br class=""><div class="gmail_quote">On 12 November 2017 at 04:01, Torsten Lodderstedt<span class="Apple-converted-space"> </span><span dir="ltr" class=""><<a href="mailto:torsten@lodderstedt.net" target="_blank" class="">torsten@lodderstedt.net</a>></span><span class="Apple-converted-space"> </span>wrote:<br class=""><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;"><div style="word-wrap: break-word;" class="">Hi Dave,<div class=""><span class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">Am 07.11.2017 um 00:35 schrieb Dave Tonge <<a href="mailto:dave.tonge@momentumft.co.uk" target="_blank" class="">dave.tonge@momentumft.co.uk</a>>:</div><br class="m_2659463447971474373Apple-interchange-newline"><div class=""><span style="font-family: 'trebuchet ms', sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline !important;" class="">he token response sent to this endpoint has an id_token. We suggested that this id_token should include an `at_hash`. This will give the client greater assurance that the token response is from the OpenID Provider and of the integrity of the payload.<span class="m_2659463447971474373Apple-converted-space"> </span></span></div></blockquote><br class=""></div></span><div class="">can you elaborate on the threat model underpinning this decision? </div><div class=""><br class=""></div><div class="">best regards,</div><div class="">Torsten.</div><br class=""></div></div></blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>--<span class="Apple-converted-space"> </span><br class=""><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div style="font-size: 1em; font-weight: bold; line-height: 1.4;" class=""><div style="color: rgb(97, 97, 97); font-family: 'Open Sans'; font-size: 14px; font-weight: normal; line-height: 21px;" class=""><div style="font-family: Arial, Helvetica, sans-serif; font-size: 0.925em; line-height: 1.4; color: rgb(220, 41, 30); font-weight: bold;" class=""><div style="font-size: 14px; font-weight: normal; color: rgb(51, 51, 51); font-family: lato, 'open sans', arial, sans-serif; line-height: normal;" class=""><div style="color: rgb(0, 164, 183); font-weight: bold; font-size: 1em; line-height: 1.4;" class="">Dave Tonge</div><div style="font-size: 0.8125em; line-height: 1.4;" class="">CTO</div><div style="font-size: 0.8125em; line-height: 1.4; margin: 0px;" class=""><a href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A" target="_blank" style="color: rgb(131, 94, 165); text-decoration: none;" class=""><img alt="Moneyhub Enterprise" height="50" src="http://content.moneyhub.co.uk/images/teal_Moneyhub-Ent_logo_200x50.png" title="Moneyhub Enterprise" width="200" style="border: none; padding: 0px; border-top-left-radius: 2px; border-top-right-radius: 2px; border-bottom-right-radius: 2px; border-bottom-left-radius: 2px; margin: 7px;" class=""></a></div><div style="padding: 8px 0px;" class=""><span style="color: rgb(0, 164, 183); font-size: 11px; background-color: transparent;" class="">10 Temple Back, Bristol, BS1 6FL</span></div><span style="font-size: 11px; line-height: 15.925px; color: rgb(0, 164, 183); font-weight: bold;" class="">t: </span><span style="font-size: 11px; line-height: 15.925px;" class="">+44 (0)117 280 5120</span><br class=""></div><div style="color: rgb(97, 97, 97); font-size: 14px; font-weight: normal; font-family: lato, 'open sans', arial, sans-serif;" class=""><font color="#00a4b7" class=""><span style="font-size: 11px; line-height: 15.925px;" class=""><br class=""></span></font><div style="color: rgb(51, 51, 51); line-height: 1.4;" class=""><span style="font-size: 0.75em;" class="">Moneyhub Enterprise is a trading style of Momentum Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority ("FCA"). Momentum Financial Technology is entered on the Financial Services Register </span><span style="font-size: 0.75em; background-color: transparent;" class="">(FRN </span><span style="font-size: 0.75em; background-color: transparent; color: rgb(0, 164, 183); font-weight: bold;" class="">561538</span><span style="font-size: 0.75em; background-color: transparent;" class="">) at<span class="Apple-converted-space"> </span><a href="http://fca.org.uk/register" target="_blank" class="">fca.org.uk/register</a>. Momentum Financial Technology is registered in England & Wales, company registration number </span><span style="font-size: 0.75em; color: rgb(0, 164, 183); font-weight: bold; background-color: transparent;" class="">06909772</span><span style="font-size: 0.75em; background-color: transparent;" class=""> </span><span style="color: rgb(34, 34, 34); font-family: arial, sans-serif; background-color: transparent;" class=""><font size="1" class="">©</font></span><span style="font-size: 0.75em; background-color: transparent;" class=""> . </span><span style="background-color: transparent; font-size: 0.75em;" class="">Momentum Financial Technology Limited 2016. </span><span style="background-color: transparent; font-size: 0.75em; color: rgb(136, 136, 136);" class="">DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Limited or of any other group company.</span></div></div></div></div></div></div></div></div></div></div></div></div></div></blockquote></div><br class=""></body></html>