<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div><font color="#4F81BD">(to Torsten: please provide these minutes to the list)</font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD">Dear all,</font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD">Please find below the preliminary notes of our call on Jan 13<font size="1"><span style="font-size:7.3pt;"><sup>th</sup></span></font> 2016.</font></div>
<div><font color="#4F81BD">In case of error or misunderstanding, please let me know.</font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD">Participants: Nat, Matthieu, Torsten, Roland, Gonzalo, Sebastian, Philippe</font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD"><u>Agenda: </u></font></div>
<ol style="margin:0;padding-left:36pt;">
<font color="#4F81BD">
<li>Feedback on the authentication document</li><li>debriefing on security issues</li></font>
</ol>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD"><u>Decisions:</u></font></div>
<ul style="margin:0;padding-left:36pt;">
<font color="#4F81BD">
<li>Feedback awaited from the list on the authentication document</li><li>Inform GSMA of the security work</li></font>
</ul>
<div style="padding-left:18pt;"><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD"><u>Discussion:</u></font></div>
<ol style="margin:0;padding-left:36pt;">
<font color="#4F81BD">
<li>Authentication document</li></font>
</ol>
<div><font color="#4F81BD">Torsten explains that the focus has been put on authentication document for priority reasons, having in mind providing GSMA with the result and MWC 2016</font></div>
<div><font color="#4F81BD">The registration specs , concerning the whole lifecycle and registration will follow. (Roland interested in doing OIDC in federations)</font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD">Feedbacks are awaited for this document. Torsten and Philippe have provided their comments/suggestions on the doc.</font></div>
<div><font color="#4F81BD"> </font></div>
<ol start="2" style="margin:0;padding-left:36pt;">
<font color="#4F81BD">
<li>Security issues</li></font>
</ol>
<ol type="a" style="margin:0;padding-left:72pt;">
<font color="#4F81BD">
<li>New kind of OAuth Attack</li></font>
</ol>
<div><font color="#4F81BD">Information published on a German website (initiated by a German university) describing a new kind of attack (on OAuth2), involving the discovery phase.</font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD">In a nutshell, a client thinks he is talking to an IdP, in fact he is talking to another IdP or to an endpoint of the other IdP. Kind of a “man in the middle” attack</font></div>
<div><font color="#4F81BD">A workshop has started on this concern, talks in IETF too with Torsten and Nat, countermeasures are being developed, mainly by applying the authentication of the redirection issuer.</font></div>
<div><font color="#4F81BD">These countermeasures will be standardized in the concerned protocols (OAuth, OIDC if needed).</font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD">Nat: We discussed of this issue in IETF. Solution could be in the code flow to return the URI of the token endpoint</font></div>
<div><font color="#4F81BD"> </font></div>
<ol type="a" start="2" style="margin:0;padding-left:72pt;">
<font color="#4F81BD">
<li>injection of code in the code flow</li></font>
</ol>
<div><font color="#4F81BD">Principle: When an attacker obtains the code, he can impersonate a user.</font></div>
<div><font color="#4F81BD">Relevant for Mobile Connect (as MC uses code flow)</font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD">John Bradley is working on the countermeasure, will be discussed in the next call</font></div>
<div><font color="#4F81BD"> </font></div>
<div><font color="#4F81BD">GSMA will be informed of these security issues and of the work on progress</font></div>
<div><font color="#1F497D"> </font></div>
<div><font color="#1F497D">Kind regards,</font></div>
<div><font color="#1F497D">Philippe</font></div>
<div> </div>
</span></font>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>