<div dir="ltr">We will get back to you. </div><div class="gmail_extra"><br><div class="gmail_quote">2015-11-05 1:45 GMT+09:00 Preibisch, Sascha H <span dir="ltr"><<a href="mailto:Sascha.Preibisch@ca.com" target="_blank">Sascha.Preibisch@ca.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>I guess the meeting already happened, correct?</div>
<div><br>
</div>
<div>Unfortunately I cannot/ couldn't join but as others I am certainly interested in the outcome.</div>
<div><br>
</div>
<div>Sascha</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>> on behalf of John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>><br>
<span style="font-weight:bold">Date: </span>Monday, November 2, 2015 at 4:04 AM<br>
<span style="font-weight:bold">To: </span>Nat Sakimura <<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a> Ab" <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><span class=""><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-ab] Securing token requests when discovery service is used<br>
</span></div>
<div><br>
</div>
<div>
<div style="word-wrap:break-word"><span class="">
5 is OK with me. We should be able to use 313 again.
<div><br>
</div>
</span><div><br>
<div>
<blockquote type="cite"><span class="">
<div>On Nov 2, 2015, at 8:42 PM, Nat Sakimura <<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>> wrote:</div>
<br>
</span><div>
<div dir="auto"><span class="">
<div>Any prospect of a meeting room? </div>
<div>We'll probably need a white board. </div>
<div>Unfortunately, it is a public holiday so I cannot offer NRI's meeting rooms in Yokohama... <br>
<br>
=nat via iPhone</div>
<div><br>
2015/11/02 20:07、nov matake <<a href="mailto:nov@matake.jp" target="_blank">nov@matake.jp</a>> のメッセージ:<br>
<br>
</div>
</span><blockquote type="cite">
<div><span class="">
<div>It works for me too.</div>
<br>
</span><div>
<blockquote type="cite"><span class="">
<div>On Nov 2, 2015, at 19:43, Justin Richer <<a href="mailto:jricher@mit.edu" target="_blank">jricher@mit.edu</a>> wrote:</div>
<br>
</span><div>
<div style="word-wrap:break-word"><span class="">
That works for me, too (it’s just after the COSE meeting).
<div><br>
</div>
<div> — Justin</div>
</span><div><br>
<div>
<blockquote type="cite"><span class="">
<div>On Nov 2, 2015, at 7:25 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>> wrote:</div>
<br>
</span><div>
<div><span class="">
<div>
<div style="font-family:Calibri,sans-serif;font-size:11pt">5pm tomorrow works for me. Meet at the IETF registration desk?</div>
</div>
</span><div dir="ltr">
<hr>
<span style="font-family:Calibri,sans-serif;font-size:11pt;font-weight:bold">From:
</span><span style="font-family:Calibri,sans-serif;font-size:11pt"><a href="mailto:sakimura@gmail.com" target="_blank">Nat Sakimura</a></span><br>
<span style="font-family:Calibri,sans-serif;font-size:11pt;font-weight:bold">Sent:
</span><span style="font-family:Calibri,sans-serif;font-size:11pt">11/2/2015 6:54 PM</span><div><div class="h5"><br>
<span style="font-family:Calibri,sans-serif;font-size:11pt;font-weight:bold">To:
</span><span style="font-family:Calibri,sans-serif;font-size:11pt"><a href="mailto:nov@matake.jp" target="_blank">nov matake</a></span><br>
<span style="font-family:Calibri,sans-serif;font-size:11pt;font-weight:bold">Cc:
</span><span style="font-family:Calibri,sans-serif;font-size:11pt"><a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a></span><br>
<span style="font-family:Calibri,sans-serif;font-size:11pt;font-weight:bold">Subject:
</span><span style="font-family:Calibri,sans-serif;font-size:11pt">Re: [Openid-specs-ab] Securing token requests when discovery service is used</span><br>
<br>
</div></div></div>
<div><div><div class="h5">
<div dir="ltr">What about 5pm and before the social? </div>
</div></div><div class="gmail_extra"><br>
<div class="gmail_quote"><div><div class="h5">2015-11-02 18:40 GMT+09:00 nov matake <span dir="ltr">
<<a href="mailto:nov@matake.jp" target="_blank">nov@matake.jp</a>></span>:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="auto"><div><div class="h5">
<div>Does the f2f happen tomorrow in Yokohama?</div>
<div>Then I can join :)<span><font color="#888888"><br>
<br>
nov</font></span></div>
</div></div><div>
<div><div><div class="h5">
<div><br>
On Nov 2, 2015, at 11:29, Nat Sakimura <<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>> wrote:<br>
<br>
</div>
</div></div><blockquote type="cite">
<div><div><div class="h5">perhaps do a<span></span> f2f adhoc this week?
<div><br>
</div>
</div></div><div><div><div class="h5"><br>
<br>
2015年11月2日月曜日、John Bradley<<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>>さんは書きました:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><div><div class="h5">The attack is not on the authentication, it is on intercepting the code and being able to replay it.
<div><br>
</div>
<div>Using a key the client is given from registration to authenticate the request to the token endpoint won’t help because that can just be man in the middled by the attacker as well.</div>
<div><br>
</div>
<div>This is also not specific to dynamic client registration. It just makes it easier. I could make the client come to a site to register and give it bad endpoints as well.</div>
<div><br>
</div>
<div>In Connect if you do a id_token code flow the issuer in the returned token would be wrong for the request so that should actually stop the attack on a client that is validating id_token correctly in that flow. (allowing late binding per one proposal
will make this vulnerable as well I think.</div>
<div><br>
</div>
<div>In the code only flow it is much harder to stop because the attacker can register itself and then replay any keys it gets from the real AS.</div>
<div>If the client provides a public key in registration that would help if we used signed requests.</div>
<div><br>
</div>
<div>To stop the attack you really need to send the token endpoint URI in the request to the Authorization server, or use a asymmetric pkce challenge verifier.</div>
<div><br>
</div>
<div>I haven’t had a chance to organize the options yet.</div>
<div><br>
</div>
<div>John B.</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</div></div><div>
<div>
<blockquote type="cite"><div><div class="h5">
<div>On Oct 31, 2015, at 5:14 AM, Mike Jones <<a>Michael.Jones@microsoft.com</a>> wrote:</div>
<br>
</div></div><div>
<div style="word-wrap:break-word;font-size:14px;font-family:Calibri,sans-serif"><div><div class="h5">
<div>
<div style="font-family:Calibri,sans-serif;font-size:11pt">The other thing that can't be faked by an attacker is the OP's keys. If the ID token isn't signed by the right keys, then the RP knows that there's a problem. This points to a possible solution
involving authenticating the jwks_uri value.<br>
<br>
Remember also that the Implicit flows don't use a token endpoint. So solutions that involve authenticating the token endpoint won't work for deployments using only Implicit flows.<br>
<br>
John, Justin, and Nov, when you send in your IIW session notes, can you also please send them here?<br>
<br>
Thanks,<br>
-- Mike</div>
</div>
</div></div><div dir="ltr"><div><div class="h5">
<hr>
<span style="font-family:Calibri,sans-serif;font-size:11pt;font-weight:bold">From:
</span><span style="font-family:Calibri,sans-serif;font-size:11pt"><a>Preibisch, Sascha H</a></span><br>
</div></div><span style="font-family:Calibri,sans-serif;font-size:11pt;font-weight:bold">Sent:
</span><span style="font-family:Calibri,sans-serif;font-size:11pt">10/30/2015 1:00 PM</span><div><div class="h5"><br>
<span style="font-family:Calibri,sans-serif;font-size:11pt;font-weight:bold">To:
</span><span style="font-family:Calibri,sans-serif;font-size:11pt"><a>openid-specs-ab@lists.openid.net</a></span><br>
<span style="font-family:Calibri,sans-serif;font-size:11pt;font-weight:bold">Subject:
</span><span style="font-family:Calibri,sans-serif;font-size:11pt">[Openid-specs-ab] Securing token requests when discovery service is used</span><br>
<br>
</div></div></div><div><div class="h5">
<div>
<div>
<div style="font-family:Consolas,monospace;font-size:12px">Hi!</div>
<div style="font-family:Consolas,monospace;font-size:12px"><br>
</div>
<div style="font-family:Consolas,monospace;font-size:12px">Now that IIW is over I would like to bring up my thoughts regarding the</div>
<div style="font-family:Consolas,monospace;font-size:12px">session we had with John regarding the discovery service issue.</div>
<div style="font-family:Consolas,monospace;font-size:12px"><br>
</div>
<div style="font-family:Consolas,monospace;font-size:12px">If I am the 'bad' discovery service provider I can fake all values within</div>
<div style="font-family:Consolas,monospace;font-size:12px">the discovery response. Except for the /token endpoint. That has to point</div>
<div style="font-family:Consolas,monospace;font-size:12px">to my system in order for me to receive the authorization_code and client</div>
<div style="font-family:Consolas,monospace;font-size:12px">credentials.</div>
<div style="font-family:Consolas,monospace;font-size:12px"><br>
</div>
<div style="font-family:Consolas,monospace;font-size:12px">Therefore I believe there are two solutions:</div>
<div style="font-family:Consolas,monospace;font-size:12px"><br>
</div>
<div style="font-family:Consolas,monospace;font-size:12px">* the discovery response to the client has to include a secret which has to be included</div>
<div style="font-family:Consolas,monospace;font-size:12px">in the initial /authorize request. The authorization server validates the</div>
<div style="font-family:Consolas,monospace;font-size:12px">value and fails the request if it is invalid. This of course has the</div>
<div style="font-family:Consolas,monospace;font-size:12px">drawback that the authorization server has to keep state. As a server guy</div>
<div style="font-family:Consolas,monospace;font-size:12px">I would not like to support this flow</div>
<div style="font-family:Consolas,monospace;font-size:12px"><br>
</div>
<div style="font-family:Consolas,monospace;font-size:12px">* The better solution I see, and as I mentioned during the discussion, is</div>
<div style="font-family:Consolas,monospace;font-size:12px">that the client should include the target /token endpoint as an additional</div>
<div style="font-family:Consolas,monospace;font-size:12px">request parameter for the initial /authorize request. The authorization</div>
<div style="font-family:Consolas,monospace;font-size:12px">server does a simple string comparison and fails if the /token endpoint is</div>
<div style="font-family:Consolas,monospace;font-size:12px">not the one as expected</div>
<div style="font-family:Consolas,monospace;font-size:12px"><br>
</div>
<div style="font-family:Consolas,monospace;font-size:12px">Regards,</div>
<div style="font-family:Consolas,monospace;font-size:12px">Sascha</div>
</div>
</div>
</div></div></div><div><div class="h5">
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a>Openid-specs-ab@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=FlU_e-9cDXuiuApS7juSCLK3lqIvLbj6DBFlO82ztOM&e=" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</div></div></div>
</blockquote>
</div>
<br>
</div>
</div>
</blockquote>
</div><div><div class="h5">
<br>
<br>
-- <br>
Nat Sakimura (=nat)
<div>Chairman, OpenID Foundation<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__nat.sakimura.org_&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=uP8Ls0zwqc3Uw2TCt6NaOUDvc-9c9pM6ZHSzD4O8N-o&e=" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</div>
<br>
</div></div></div>
</blockquote><div><div class="h5">
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>Openid-specs-ab mailing list</span><br>
<span><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a></span><br>
<span><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=FlU_e-9cDXuiuApS7juSCLK3lqIvLbj6DBFlO82ztOM&e=" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></span><br>
</div>
</blockquote>
</div></div></div>
</div>
</div>
</blockquote>
</div><div><div class="h5">
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div>Nat Sakimura (=nat)
<div>Chairman, OpenID Foundation<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__nat.sakimura.org_&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=uP8Ls0zwqc3Uw2TCt6NaOUDvc-9c9pM6ZHSzD4O8N-o&e=" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</div>
</div>
</div></div></div>
</div>
</div><div><div class="h5">
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=CwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=FlU_e-9cDXuiuApS7juSCLK3lqIvLbj6DBFlO82ztOM&e=" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</div></div></div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</blockquote>
</div><div><div class="h5">
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=CwQFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=bOTOfTxEmIQTjiRHPC3i3r2EPT_oWedSENfSi8VwmdA&s=FlU_e-9cDXuiuApS7juSCLK3lqIvLbj6DBFlO82ztOM&e=" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</div></div></div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</span>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>@_nat_en</div></div>
</div>