[Openid-specs-risc] RISC Notes 3/19

Marius Scurtescu mscurtescu at google.com
Sat Mar 24 19:34:25 UTC 2018


Attached is the updated risc-event-types.txt, based on feedback from past
two meetings.

Another question came up, do we really need both "Opt In" and "Opt Out
Cancelled". Both signal that the account is back to Opt In state, the only
difference is from what state did the transition happened. Maybe just "Opt
In" with an optional attribute like "previous-state", if that is important?

Happy weekend and safe travels for those returning from IETF 101,
Marius

PS Working on OAuth events, will send later today or tomorrow.


Marius

On Mon, Mar 19, 2018 at 5:19 PM, Luke Camery via Openid-specs-risc <
openid-specs-risc at lists.openid.net> wrote:

> *Summary*
> Thanks everyone for attending despite the busy week with IETF. We will
> continue next week at 3:30pm PST with a discussion of the updated specs and
> updates on the issues in the tracker.
>
> *Attendees*= [Luke Camery, Tushar Pradhan, Marius Scurtescu, Adam Dawes]
>
> *ACTION ITEMS*
> *- AI: Marius will renew this document by next week*
> * - AI: Marius to take on figuring out oauth events*
> * - AI: Marius remind Annabelle and Chair to resolve this at secevents*
>
> *FULL NOTES*
> - Opt out / opt in / opt in cancel / opt out requested
> - Most likely opt out will become an extra hijacking signal
> - Four state change give you a great picture
> - Tushar: Publish some timeframe to make abuse work easier
> - Recovery Activated
> - Positive sentiment from google
> - Confusion about identifier versus recovery
> - Need to clarify this in a description body
> - Recovery Information Change
> - Positive sentiment from google
> - Token and Sessions Revoked
> - Not risk (or risc) events
> - Token lifecycle / oauth events
> - oauth client disabled or recycled
> - oauth IETF working group or RISC working group?
> - Tushar agrees in separating it out and linking oauth specific events to
> oauth
> - Tushar agrees it's important though with a different mechanism
> * - AI: Marius will renew this document by next week*
> * - AI: Marius to take on figuring out oauth events*
> - Update: Marius and Phil discussed the delivery spec
> - Multiple delivery methods required one mandatory (Phil)
> - Others disagree with Phil on this point
> - AI: Raise issues with the chairs on mandatory to implement
> - Phil is thinking of hybrid method that covers both
> - Marius thinks hybrid could be better than polling, but push is by far
> the best and needs to be preserved
> * - AI: Marius remind Annabelle and Chair to resolve this at secevents*
> - Update on secevents work for RISC, but not working group AIs
>
> --
>
> *  •  **Luke Camery*
> *  •  *Associate Product Manager
> *  •  *Federated Identity
>
>
> _______________________________________________
> Openid-specs-risc mailing list
> Openid-specs-risc at lists.openid.net
> http://lists.openid.net/mailman/listinfo/openid-specs-risc
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-risc/attachments/20180324/6041c95a/attachment-0001.html>
-------------- next part --------------




                                                            M. Scurtescu
                                                                  Google
                                                              A. Backman
                                                                  Amazon
                                                                 P. Hunt
                                                                  Oracle
                                                              J. Bradley
                                                                  Yubico
                                                          March 24, 2018


                            RISC Event Types
                          risc-event-types-00

Abstract

   This document defines the RTISC Event Types.  Event Types are
   introduced and defined in Security Event Token (SET) [SET].

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   1
     1.1.  Notational Conventions  . . . . . . . . . . . . . . . . .   2
   2.  Event Types . . . . . . . . . . . . . . . . . . . . . . . . .   2
     2.1.  Account Credential Change Required  . . . . . . . . . . .   2
     2.2.  Account Purged  . . . . . . . . . . . . . . . . . . . . .   3
     2.3.  Account Disabled  . . . . . . . . . . . . . . . . . . . .   3
     2.4.  Account Enabled . . . . . . . . . . . . . . . . . . . . .   4
     2.5.  Identifier Changed  . . . . . . . . . . . . . . . . . . .   4
     2.6.  Identifier Recycled . . . . . . . . . . . . . . . . . . .   5
     2.7.  Opt Out . . . . . . . . . . . . . . . . . . . . . . . . .   6
       2.7.1.  Opt In  . . . . . . . . . . . . . . . . . . . . . . .   7
       2.7.2.  Opt Out Initiated . . . . . . . . . . . . . . . . . .   7
       2.7.3.  Opt Out Cancelled . . . . . . . . . . . . . . . . . .   8
       2.7.4.  Opt Out Effective . . . . . . . . . . . . . . . . . .   8
     2.8.  Recovery Activated  . . . . . . . . . . . . . . . . . . .   8
     2.9.  Recovery Information Changed  . . . . . . . . . . . . . .   8
     2.10. Sessions Revoked  . . . . . . . . . . . . . . . . . . . .   9
   3.  Normative References  . . . . . . . . . . . . . . . . . . . .   9
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   9

1.  Introduction

   This specification is based on RISC Profile [RISC-PROFILE] and uses
   the subject identifiers defined there.






Scurtescu, et al.      Expires September 25, 2018               [Page 1]


                            risc-event-types                  March 2018


1.1.  Notational Conventions

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in BCP
   14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

2.  Event Types

   The base URI for RISC event types is:
   http://schemas.openid.net/secevent/risc/event-type/

2.1.  Account Credential Change Required

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/account-
   credential-change-required

   Account Credential Change Required signals that the account
   identified by the subject was required to change a credential.  For
   example the user was required to go through a password change.

   Attributes: none

   {
     "iss": "https://idp.example.com/",
     "jti": "756E69717565206964656E746966696572",
     "iat": 1508184845,
     "aud": "636C69656E745F6964",
     "events": {
       "http://schemas.openid.net/secevent/risc/event-type/\
       account-credential-change-required": {
         "subject": {
           "subject_type": "iss-sub",
           "iss": "https://idp.example.com/",
           "sub": "7375626A656374",
         }
       }
     }
   }

   _(the event type URI is wrapped, the backslash is the continuation
   character)_

           Figure 1: Example: Account Credential Change Required





Scurtescu, et al.      Expires September 25, 2018               [Page 2]


                            risc-event-types                  March 2018


2.2.  Account Purged

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/account-purged

   Account Purged signals that the account identified by the subject has
   been permanently deleted.

   Attributes: none

2.3.  Account Disabled

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/account-disabled

   Account Disabled signals that the account identified by the subject
   has been disabled.  The actual reason why the account was disabled
   might be specified with the nested 'reason' attribute described
   below.  The account may be enabled (Section 2.4) in the future.

   Attributes:

   o  reason - optional, describes why was the account disabled.
      Possible values:

      *  hijacking

      *  bulk-account























Scurtescu, et al.      Expires September 25, 2018               [Page 3]


                            risc-event-types                  March 2018


   {
     "iss": "https://idp.example.com/",
     "jti": "756E69717565206964656E746966696572",
     "iat": 1508184845,
     "aud": "636C69656E745F6964",
     "events": {
       "http://schemas.openid.net/secevent/risc/event-type/\
       account-disabled": {
         "subject": {
           "subject_type": "iss-sub",
           "iss": "https://idp.example.com/",
           "sub": "7375626A656374",
         },
         "reason": "hijacking",
       }
     }
   }

   _(the event type URI is wrapped, the backslash is the continuation
   character)_

                    Figure 2: Example: Account Disabled

2.4.  Account Enabled

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/account-enabled

   Account Enabled signals that the account identified by the subject
   has been enabled.

   Attributes: none

2.5.  Identifier Changed

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/identifier-changed

   Identifier Changed signals that the identifier specified in the
   subject has changed.  The subject's type MUST be either 'email' or
   'phone' and it MUST specify the old value.

   This event SHOULD be issued only by the provider that is
   authoritative over the identifier.  For example, if the person that
   owns "john.doe at example.com" goes through a name change and wants the
   new "john.row at example.com" email then *only* the email provider
   "example.com" SHOULD issue an Identifier Changed event as shown in
   the example below.



Scurtescu, et al.      Expires September 25, 2018               [Page 4]


                            risc-event-types                  March 2018


   If an identifier used as a username or recovery option is changed, at
   a provide that is not authoritative over that identifier, then
   Recovery Information Changed (Section 2.9) SHOULD be used instead.

   Attributes:

   o  new-value - optional, the new value of the identifier.

   {
     "iss": "https://idp.example.com/",
     "jti": "756E69717565206964656E746966696572",
     "iat": 1508184845,
     "aud": "636C69656E745F6964",
     "events": {
       "http://schemas.openid.net/secevent/risc/event-type/\
       identifier-changed": {
         "subject": {
           "subject_type": "email",
           "email": "john.doe at example.com",
         },
         "new-value": "john.roe at example.com",
       }
     }
   }

   The 'foo at example.com' email changed to 'bar at example.com'.  _(the
   event type URI is wrapped, the backslash is the continuation
   character)_

                   Figure 3: Example: Identifier Changed

2.6.  Identifier Recycled

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/identifier-
   recycled

   Identifier Recycled signals that the identifier specified in the
   subject was recycled and now it belongs to a new user.  The subject
   MUST be either 'email' or 'phone-number'.

   Attributes: none









Scurtescu, et al.      Expires September 25, 2018               [Page 5]


                            risc-event-types                  March 2018


   {
     "iss": "https://idp.example.com/",
     "jti": "756E69717565206964656E746966696572",
     "iat": 1508184845,
     "aud": "636C69656E745F6964",
     "events": {
       "http://schemas.openid.net/secevent/risc/event-type/\
       identifier-recycled": {
         "subject": {
           "subject_type": "email",
           "email": "foo at example.com",
         }
       }
     }
   }

   The 'foo at example.com' email address was recycled.  _(the event type
   URI is wrapped, the backslash is the continuation character)_

                  Figure 4: Example: Identifier Recycled

2.7.  Opt Out

   Users SHOULD be allowed to opt-in and out of RISC events being sent
   for their accounts.  With regards to opt-out an account can be in one
   of these three states:

   1.  opt-in - the account is participating in RISC event exchange.

   2.  opt-out-initiated - the user requested to be excluded from RISC
       event exchanges, but for practical security reasons for a period
       of time RISC events are still exchanged.  The main reason for
       this state is to prevent a hijacker from immediately opting out
       of RISC.

   3.  opt-out - the account is NOT participating in RISC event
       exchange.














Scurtescu, et al.      Expires September 25, 2018               [Page 6]


                            risc-event-types                  March 2018


   State changes trigger Opt-Out Events as represented bellow:

   +--------+  opt-out-initiated  +-------------------+
   |        +--------------------->                   |
   | opt-in |                     | opt-out-initiated |
   |        |  pt-out-cancelled   |                   |
   |        <---------------------+                   |
   +---^----+                     +----------+--------+
       |                                     |
       | opt-in                              | opt-out-effective
       |                                     |
       |                          +----------V--------+
       |                          |                   |
       +--------------------------| opt-out           |
                                  |                   |
                                  +-------------------+

                Figure 5: Opt-Out States and Opt-Out Events

   Both Transmitters and Receivers SHOULD manage Opt-Out state for
   users.  Transmitters should send the events defined in this section
   when the Opt-Out state changes.

2.7.1.  Opt In

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/opt-in

   Opt In signals that the account identified by the subject opted into
   RISC event exchanges.  The account is in the 'opt-in' state.

   Attributes: none

2.7.2.  Opt Out Initiated

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/opt-out-initiated

   Opt Out Initiated signals that the account identified by the subject
   initiated to opt out from RISC event exchanges.  The account is in
   the 'opt-out-initiated' state.

   Attributes: none








Scurtescu, et al.      Expires September 25, 2018               [Page 7]


                            risc-event-types                  March 2018


2.7.3.  Opt Out Cancelled

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/opt-out-cancelled

   Opt Out Cancelled signals that the account identified by the subject
   cancelled the opt out from RISC event exchanges.  The account is in
   the 'opt-in' state.

   Attributes: none

2.7.4.  Opt Out Effective

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/opt-out-effective

   Opt Out Effective signals that the account identified by the subject
   was effectively opted out from RISC event exchanges.  The account is
   in the 'opt-out' state.

   Attributes: none

2.8.  Recovery Activated

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/recovery-activated

   Recovery Activated signals that the account identified by the subject
   activated a recovery flow.

   Attributes: none

2.9.  Recovery Information Changed

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/recovery-
   information-changed

   Recovery Information Changed signals that the account identified by
   the subject has changed some of its recovery information.  For
   example a recovery email address was added or removed.

   Attributes: none








Scurtescu, et al.      Expires September 25, 2018               [Page 8]


                            risc-event-types                  March 2018


2.10.  Sessions Revoked

   Event Type URI:
   http://schemas.openid.net/secevent/risc/event-type/sessions-revoked

   Sessions Revoked signals that all the sessions for the account
   identified by the subject have been revoked.

   Attributes: none

3.  Normative References

   [JSON]     Bray, T., Ed., "The JavaScript Object Notation (JSON) Data
              Interchange Format", RFC 7159, DOI 10.17487/RFC7159, March
              2014, <https://www.rfc-editor.org/info/rfc7159>.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997, <https://www.rfc-
              editor.org/info/rfc2119>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [RISC-PROFILE]
              OpenID Foundation, "RISC Profile".

   [SET]      IETF, "Security Event Token (SET)",
              <https://tools.ietf.org/html/draft-ietf-secevent-token>.

Authors' Addresses

   Marius Scurtescu
   Google

   Email: mscurtescu at google.com


   Annabelle Backman
   Amazon

   Email: richanna at amazon.com








Scurtescu, et al.      Expires September 25, 2018               [Page 9]


                            risc-event-types                  March 2018


   Phil Hunt
   Oracle Corporation

   Email: phil.hunt at yahoo.com


   John Bradley
   Yubico

   Email: secevemt at ve7jtb.com









































Scurtescu, et al.      Expires September 25, 2018              [Page 10]


More information about the Openid-specs-risc mailing list