Hi Russ,<div><br></div><div>The attacks you mention are not prevented by encryption at all. Signing is what protects against those attacks, and those are built into the OpenID protocol itself, so you don't even need SSL. What SSL will buy you is privacy (which is not the same thing as user spoofing) and protection against a DNS poisoning attack, which is difficult, but possible in some cases. DNS poisoning can potentially lead to user spoofing, so SSL is definitely worthwhile. But you can protect against the user spoofing via DNS poisoning attack via SSL at the OP side -- the RP being SSL-encrypted is not critical to it AFAIK. So as long as your RP is marked as requireSsl (which requires it of the remote party -- not itself) you're covered from that risk.</div>
<div><br></div><div>As far as risks have been discovered and that I know of, anyway.<br clear="all">--<br>Andrew Arnott<br>"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre<br>
<br><br><div class="gmail_quote">On Thu, Apr 12, 2012 at 7:56 PM, Russ Ferrill <span dir="ltr"><<a href="mailto:rferrill@vendorsafe.com">rferrill@vendorsafe.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="color:#1f497d">Yes, I just want to be sure that nobody can intercept the communication between the OP and RP and cause the RP to believe that an unauthenticated user was actually authenticated or even to change the roles sent
back for an authenticated user. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Is SSL sufficient for this? <u></u>
<u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Is there any stronger way to protect this data transfer?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Thanks.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Russ<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Andrew Arnott [mailto:<a href="mailto:andrewarnott@gmail.com" target="_blank">andrewarnott@gmail.com</a>]
<br>
<b>Sent:</b> Thursday, April 12, 2012 7:51 PM<br>
<b>To:</b> Russ Ferrill; <a href="mailto:openid-code@lists.openid.net" target="_blank">openid-code@lists.openid.net</a><br>
<b>Subject:</b> RE: [Code] Encrypting communication between the OP and the RP<u></u><u></u></span></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">As long as you don't mind the user who is logging in observing the data (not usually considered a problem) then SSL should be fine. And yes, requireSsl=true is a good setting to enforce this.<br>
<br>
Sent from my Windows Phone<u></u><u></u></p>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:
</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Russ Ferrill</span><br>
<b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Sent: </span>
</b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">4/12/2012 1:05 PM</span><br>
<b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">To: </span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""><a href="mailto:openid-code@lists.openid.net" target="_blank">openid-code@lists.openid.net</a></span><br>
<b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Subject: </span>
</b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">[Code] Encrypting communication between the OP and the RP</span><u></u><u></u></p>
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I am implementing an Open ID provider using the DNOA code. I want to be sure that the communication between the OP and the RP is secure. I’m only concerned about authentication requests and authentication responses. As far as I can tell
from looking at the code this is all “indirect” communication accomplished by redirecting the end-user’s browser. I want to be sure that the data included in the authentication request and the authentication response is encrypted. In order to accomplish this,
do I have to do anything other than make the OP endpoint an https url protected by SSL? Would it be a good idea to set the require ssl configuration values to true? Is there anything else specific to the DNOA code that I need to configure or modify in order
to support this?<u></u><u></u></p>
<p class="MsoNormal">Thanks.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Russ Ferrill<u></u><u></u></p>
</div></div></div>
</div>
</blockquote></div><br></div>