<div dir="ltr">I'd think any security considerations need to say that the RP really needs to check that the received ACR meets its requirements. Relying on the content of the request and a successful response from the OP isn't sufficient in enough/most cases so shouldn't ever be relied on. <br></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Mon, Apr 7, 2025 at 11:51 AM Michael Jones via Openid-specs-eap <<a href="mailto:openid-specs-eap@lists.openid.net">openid-specs-eap@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg1736539369666176527">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_1736539369666176527WordSection1">
<p class="MsoNormal"><span style="font-size:11pt">I’ve created <a href="https://bitbucket.org/openid/eap/pull-requests/2" target="_blank">
https://bitbucket.org/openid/eap/pull-requests/2</a>, which adds Security Considerations on preventing downgrade attacks by using signed requests.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div>
<div style="border-width:1pt medium medium;border-style:solid none none;border-color:rgb(225,225,225) currentcolor currentcolor;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> Openid-specs-eap <<a href="mailto:openid-specs-eap-bounces@lists.openid.net" target="_blank">openid-specs-eap-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>Michael Jones via Openid-specs-eap<br>
<b>Sent:</b> Saturday, March 29, 2025 3:54 PM<br>
<b>To:</b> Andrii Deinega <<a href="mailto:andrii.deinega@gmail.com" target="_blank">andrii.deinega@gmail.com</a>><br>
<b>Cc:</b> Joni Brennan <<a href="mailto:jonibrennan@gmail.com" target="_blank">jonibrennan@gmail.com</a>>; <a href="mailto:leifj@sunet.se" target="_blank">leifj@sunet.se</a>; <a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">openid-specs-eap@lists.openid.net</a><br>
<b>Subject:</b> Re: [OpenID-specs-EAP] WGLC for OpenID Connect EAP ACR Values spec<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:11pt">We could add a reference to RFC 9191 in the Security Considerations, and in particular, cite the
<a href="https://www.rfc-editor.org/rfc/rfc9101.html#name-downgrade-attack" target="_blank">Downgrade Attack</a> considerations. What do others think?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div style="border-width:1pt medium medium;border-style:solid none none;border-color:rgb(225,225,225) currentcolor currentcolor;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> Andrii Deinega <<a href="mailto:andrii.deinega@gmail.com" target="_blank">andrii.deinega@gmail.com</a>>
<br>
<b>Sent:</b> Thursday, March 27, 2025 3:13 PM<br>
<b>To:</b> Michael Jones <<a href="mailto:michael_b_jones@hotmail.com" target="_blank">michael_b_jones@hotmail.com</a>><br>
<b>Cc:</b> Joni Brennan <<a href="mailto:jonibrennan@gmail.com" target="_blank">jonibrennan@gmail.com</a>>;
<a href="mailto:leifj@sunet.se" target="_blank">leifj@sunet.se</a>; <a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">
openid-specs-eap@lists.openid.net</a>; Dean Saxe <<a href="mailto:dean.saxe@beyondidentity.com" target="_blank">dean.saxe@beyondidentity.com</a>><br>
<b>Subject:</b> Re: [OpenID-specs-EAP] WGLC for OpenID Connect EAP ACR Values spec<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Mike, I’m curious whether the security considerations section in this spec should recommend passing request parameters (especially those that include acr_values) as
<a href="https://www.rfc-editor.org/rfc/rfc9101.html" target="_blank">JWT-Secured Authorization Requests (JAR)</a>, or as <a href="https://datatracker.ietf.org/doc/html/rfc9126" target="_blank">Pushed Authorization Requests (PAR)</a>.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Otherwise, parameter acr_values could be removed without detection on an OP side.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">PARs and encrypted JARs also allow to hide from others what's specifically requested from an RP to an OP.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">All the best,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Andrii<u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Thu, Mar 27, 2025 at 7:53<span style="font-family:"Arial",sans-serif"> </span>AM Dean Saxe via Openid-specs-eap <<a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">openid-specs-eap@lists.openid.net</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentcolor currentcolor currentcolor rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt">
<div>
<div>
<p class="MsoNormal">I support progressing this spec to final.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">-dhs<br clear="all">
<u></u><u></u></p>
<div>
<div>
<div>
<p class="MsoNormal">--<u></u><u></u></p>
<div>
<p class="MsoNormal">Dean H. Saxe, <a href="https://idpro.org/cidpro/" target="_blank">
CIDPRO</a> (he/him)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Principal Engineer<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Office of the CTO<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Beyond Identity<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="mailto:dean.saxe@beyondidentity.com" target="_blank">dean.saxe@beyondidentity.com</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mar 25, 2025 at 5:49:29<span style="font-family:"Arial",sans-serif"> </span>PM, Michael Jones via Openid-specs-eap <<a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">openid-specs-eap@lists.openid.net</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentcolor currentcolor currentcolor rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt">
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">This message starts a 2-week Working Group Last Call for the
<a href="https://openid.net/specs/openid-connect-eap-acr-values-1_0.html" target="_blank">
OpenID Connect Extended Authentication Profile (EAP) ACR Values 1.0</a> specification, prior to submitting it to Foundation-wide review for Final status. The Context Class values “</span><span style="font-size:11pt;font-family:"Courier New"">phr</span><span style="font-size:11pt">”
and “</span><span style="font-size:11pt;font-family:"Courier New"">phrh</span><span style="font-size:11pt">” are now registered in the IANA “Level of Assurance (LoA) Profiles” registry at
<a href="https://www.iana.org/assignments/loa-profiles/" target="_blank">https://www.iana.org/assignments/loa-profiles/</a>.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt">The WGLC ends on Tuesday, April 8<sup>th</sup>. Please reply-all to this e-mail indicating whether you support progressing the specification to Final
status.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt">After it becomes Final, we anticipate closing the
<a href="https://openid.net/wg/eap/" target="_blank">EAP working group</a>.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> Thanks,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> -- Mike</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span><u></u><u></u></p>
<div>
<div style="border-width:1pt medium medium;border-style:solid none none;border-color:rgb(225,225,225) currentcolor currentcolor;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> Michael Jones
<br>
<b>Sent:</b> Sunday, March 23, 2025 11:07 PM<br>
<b>To:</b> <a href="mailto:openid-specs-eap@lists.openid.net" target="_blank">openid-specs-eap@lists.openid.net</a><br>
<b>Cc:</b> <a href="mailto:leifj@sunet.se" target="_blank">leifj@sunet.se</a>; Joni Brennan <<a href="mailto:jonibrennan@gmail.com" target="_blank">jonibrennan@gmail.com</a>>; John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>><br>
<b>Subject:</b> Context Class values added to OpenID EAP ACR Values spec</span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt">I’ve updated the
<a href="https://openid.net/specs/openid-connect-eap-acr-values-1_0.html" target="_blank">
OpenID Connect Extended Authentication Profile (EAP) ACR Values 1.0</a> specification to add the Context Class values needed to enable registration of the two ACR values indicating that phishing-resistant authentication or phishing-resistant-hardware-backed
authentication is being requested or has been performed. Thanks to Leif Johansson for explaining how to create the Context Class files. They can both be found at
<a href="https://bitbucket.org/openid/eap/src/master/" target="_blank">https://bitbucket.org/openid/eap/src/master/</a>.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt">The IANA registrations have been requested – with tracking number [IANA #1415585].</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt">Once these registrations occur, unless working group members want other updates to the spec, we should be able to take the specification to Final
status.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> -- Mike</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt"> </span><u></u><u></u></p>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-eap mailing list<br>
<a href="mailto:Openid-specs-eap@lists.openid.net" target="_blank">Openid-specs-eap@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-eap" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-eap</a><u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-eap mailing list<br>
<a href="mailto:Openid-specs-eap@lists.openid.net" target="_blank">Openid-specs-eap@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-eap" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-eap</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-eap mailing list<br>
<a href="mailto:Openid-specs-eap@lists.openid.net" target="_blank">Openid-specs-eap@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-eap" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-eap</a><br>
</div></blockquote></div>
<br>
<i style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:rgb(255,255,255);font-family:proxima-nova-zendesk,system-ui,-apple-system,system-ui,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;color:rgb(85,85,85)"><span style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600"><font size="2">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</font></span></i>