<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>I guess the meeting already happened, correct?</div>
<div><br>
</div>
<div>Unfortunately I cannot/ couldn't join but as others I am certainly interested in the outcome.</div>
<div><br>
</div>
<div>Sascha</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a>> on behalf of John Bradley <<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>><br>
<span style="font-weight:bold">Date: </span>Monday, November 2, 2015 at 4:04 AM<br>
<span style="font-weight:bold">To: </span>Nat Sakimura <<a href="mailto:sakimura@gmail.com">sakimura@gmail.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a> Ab" <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-ab] Securing token requests when discovery service is used<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
5 is OK with me. We should be able to use 313 again.
<div class=""><br class="">
</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Nov 2, 2015, at 8:42 PM, Nat Sakimura <<a href="mailto:sakimura@gmail.com" class="">sakimura@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="auto" class="">
<div class="">Any prospect of a meeting room? </div>
<div class="">We'll probably need a white board. </div>
<div class="">Unfortunately, it is a public holiday so I cannot offer NRI's meeting rooms in Yokohama... <br class="">
<br class="">
=nat via iPhone</div>
<div class=""><br class="">
2015/11/02 20:07¡¢nov matake <<a href="mailto:nov@matake.jp" class="">nov@matake.jp</a>> ¤Î¥á¥Ã¥»©`¥¸:<br class="">
<br class="">
</div>
<blockquote type="cite" class="">
<div class="">
<div class="">It works for me too.</div>
<br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On Nov 2, 2015, at 19:43, Justin Richer <<a href="mailto:jricher@mit.edu" class="">jricher@mit.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
That works for me, too (it¡¯s just after the COSE meeting).
<div class=""><br class="">
</div>
<div class=""> ¡ª Justin</div>
<div class=""><br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On Nov 2, 2015, at 7:25 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" class="">Michael.Jones@microsoft.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<meta content="text/html; charset=utf-8" class="">
<div class="">
<div class="">
<div style="font-family:Calibri,sans-serif; font-size:11pt" class="">5pm tomorrow works for me. Meet at the IETF registration desk?</div>
</div>
<div dir="ltr" class="">
<hr class="">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; font-weight: bold;" class="">From:
</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class=""><a href="mailto:sakimura@gmail.com" class="">Nat Sakimura</a></span><br class="">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; font-weight: bold;" class="">Sent:
</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class="">11/2/2015 6:54 PM</span><br class="">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; font-weight: bold;" class="">To:
</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class=""><a href="mailto:nov@matake.jp" class="">nov matake</a></span><br class="">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; font-weight: bold;" class="">Cc:
</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class=""><a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a></span><br class="">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; font-weight: bold;" class="">Subject:
</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class="">Re: [Openid-specs-ab] Securing token requests when discovery service is used</span><br class="">
<br class="">
</div>
<div class="">
<div dir="ltr" class="">What about 5pm and before the social? </div>
<div class="gmail_extra"><br class="">
<div class="gmail_quote">2015-11-02 18:40 GMT+09:00 nov matake <span dir="ltr" class="">
<<a href="mailto:nov@matake.jp" target="_blank" class="">nov@matake.jp</a>></span>:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="auto" class="">
<div class="">Does the f2f happen tomorrow in Yokohama?</div>
<div class="">Then I can join :)<span class="HOEnZb"><font color="#888888" class=""><br class="">
<br class="">
nov</font></span></div>
<div class="">
<div class="h5">
<div class=""><br class="">
On Nov 2, 2015, at 11:29, Nat Sakimura <<a href="mailto:sakimura@gmail.com" target="_blank" class="">sakimura@gmail.com</a>> wrote:<br class="">
<br class="">
</div>
<blockquote type="cite" class="">
<div class="">perhaps do a<span class=""></span> f2f adhoc this week?
<div class=""><br class="">
</div>
<div class=""><br class="">
<br class="">
2015Äê11ÔÂ2ÈÕÔÂê×ÈÕ¡¢John Bradley<<a href="mailto:ve7jtb@ve7jtb.com" target="_blank" class="">ve7jtb@ve7jtb.com</a>>¤µ¤ó¤Ï•ø¤¤Þ¤·¤¿:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div style="word-wrap:break-word" class="">The attack is not on the authentication, it is on intercepting the code and being able to replay it.
<div class=""><br class="">
</div>
<div class="">Using a key the client is given from registration to authenticate the request to the token endpoint won¡¯t help because that can just be man in the middled by the attacker as well.</div>
<div class=""><br class="">
</div>
<div class="">This is also not specific to dynamic client registration. It just makes it easier. I could make the client come to a site to register and give it bad endpoints as well.</div>
<div class=""><br class="">
</div>
<div class="">In Connect if you do a id_token code flow the issuer in the returned token would be wrong for the request so that should actually stop the attack on a client that is validating id_token correctly in that flow. (allowing late binding per one proposal
will make this vulnerable as well I think.</div>
<div class=""><br class="">
</div>
<div class="">In the code only flow it is much harder to stop because the attacker can register itself and then replay any keys it gets from the real AS.</div>
<div class="">If the client provides a public key in registration that would help if we used signed requests.</div>
<div class=""><br class="">
</div>
<div class="">To stop the attack you really need to send the token endpoint URI in the request to the Authorization server, or use a asymmetric pkce challenge verifier.</div>
<div class=""><br class="">
</div>
<div class="">I haven¡¯t had a chance to organize the options yet.</div>
<div class=""><br class="">
</div>
<div class="">John B.</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On Oct 31, 2015, at 5:14 AM, Mike Jones <<a class="">Michael.Jones@microsoft.com</a>> wrote:</div>
<br class="">
<div class="">
<div style="word-wrap:break-word; font-size:14px; font-family:Calibri,sans-serif" class="">
<div class="">
<div style="font-family:Calibri,sans-serif; font-size:11pt" class="">The other thing that can't be faked by an attacker is the OP's keys. If the ID token isn't signed by the right keys, then the RP knows that there's a problem. This points to a possible solution
involving authenticating the jwks_uri value.<br class="">
<br class="">
Remember also that the Implicit flows don't use a token endpoint. So solutions that involve authenticating the token endpoint won't work for deployments using only Implicit flows.<br class="">
<br class="">
John, Justin, and Nov, when you send in your IIW session notes, can you also please send them here?<br class="">
<br class="">
Thanks,<br class="">
-- Mike</div>
</div>
<div dir="ltr" class="">
<hr class="">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; font-weight: bold;" class="">From:
</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class=""><a class="">Preibisch, Sascha H</a></span><br class="">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; font-weight: bold;" class="">Sent:
</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class="">10/30/2015 1:00 PM</span><br class="">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; font-weight: bold;" class="">To:
</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class=""><a class="">openid-specs-ab@lists.openid.net</a></span><br class="">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; font-weight: bold;" class="">Subject:
</span><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class="">[Openid-specs-ab] Securing token requests when discovery service is used</span><br class="">
<br class="">
</div>
<div class="">
<div class="">
<div style="font-family:Consolas,monospace; font-size:12px" class="">Hi!</div>
<div style="font-family:Consolas,monospace; font-size:12px" class=""><br class="">
</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">Now that IIW is over I would like to bring up my thoughts regarding the</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">session we had with John regarding the discovery service issue.</div>
<div style="font-family:Consolas,monospace; font-size:12px" class=""><br class="">
</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">If I am the 'bad' discovery service provider I can fake all values within</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">the discovery response. Except for the /token endpoint. That has to point</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">to my system in order for me to receive the authorization_code and client</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">credentials.</div>
<div style="font-family:Consolas,monospace; font-size:12px" class=""><br class="">
</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">Therefore I believe there are two solutions:</div>
<div style="font-family:Consolas,monospace; font-size:12px" class=""><br class="">
</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">* the discovery response to the client has to include a secret which has to be included</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">in the initial /authorize request. The authorization server validates the</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">value and fails the request if it is invalid. This of course has the</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">drawback that the authorization server has to keep state. As a server guy</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">I would not like to support this flow</div>
<div style="font-family:Consolas,monospace; font-size:12px" class=""><br class="">
</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">* The better solution I see, and as I mentioned during the discussion, is</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">that the client should include the target /token endpoint as an additional</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">request parameter for the initial /authorize request. The authorization</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">server does a simple string comparison and fails if the /token endpoint is</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">not the one as expected</div>
<div style="font-family:Consolas,monospace; font-size:12px" class=""><br class="">
</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">Regards,</div>
<div style="font-family:Consolas,monospace; font-size:12px" class="">Sascha</div>
</div>
</div>
</div>
_______________________________________________<br class="">
Openid-specs-ab mailing list<br class="">
<a class="">Openid-specs-ab@lists.openid.net</a><br class="">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=FlU_e-9cDXuiuApS7juSCLK3lqIvLbj6DBFlO82ztOM&e=" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
<br class="">
-- <br class="">
Nat Sakimura (=nat)
<div class="">Chairman, OpenID Foundation<br class="">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__nat.sakimura.org_&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=uP8Ls0zwqc3Uw2TCt6NaOUDvc-9c9pM6ZHSzD4O8N-o&e=" target="_blank" class="">http://nat.sakimura.org/</a><br class="">
@_nat_en</div>
<br class="">
</div>
</blockquote>
<blockquote type="cite" class="">
<div class=""><span class="">_______________________________________________</span><br class="">
<span class="">Openid-specs-ab mailing list</span><br class="">
<span class=""><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank" class="">Openid-specs-ab@lists.openid.net</a></span><br class="">
<span class=""><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=FlU_e-9cDXuiuApS7juSCLK3lqIvLbj6DBFlO82ztOM&e=" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></span><br class="">
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
<br clear="all" class="">
<div class=""><br class="">
</div>
-- <br class="">
<div class="gmail_signature">Nat Sakimura (=nat)
<div class="">Chairman, OpenID Foundation<br class="">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__nat.sakimura.org_&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=uP8Ls0zwqc3Uw2TCt6NaOUDvc-9c9pM6ZHSzD4O8N-o&e=" target="_blank" class="">http://nat.sakimura.org/</a><br class="">
@_nat_en</div>
</div>
</div>
</div>
</div>
_______________________________________________<br class="">
Openid-specs-ab mailing list<br class="">
<a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=FlU_e-9cDXuiuApS7juSCLK3lqIvLbj6DBFlO82ztOM&e=" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</blockquote>
</div>
_______________________________________________<br class="">
Openid-specs-ab mailing list<br class="">
<a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=CwQFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=FlU_e-9cDXuiuApS7juSCLK3lqIvLbj6DBFlO82ztOM&e=">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</span>
</body>
</html>