Subject: Re: [Unbearable] HTTPSTB updates and respin WGLC

From: =JeffH <[email-masked]>
Date: Thu, 2 Feb 2017 17:15:08 -0800

Please review PR #92:

   HTTPSTB: 'TB key' terminology cleanup, see #87
   https://github.com/TokenBinding/Internet-Drafts/pull/92

In the meantime, am working on issue #88 and reviewing 
draft-campbell-tokbind-tls-term.

=JeffH

---

From: Andrei Popov <[email-masked]>
Date: Fri, 3 Feb 2017 01:51:23 +0000

Thanks, Jeff, for correcting TB key vs. TB ID. A few editorial suggestions below.

I think this needs to be rephrased:
> The Token Binding ID of a TLS connection is constructed using  
> the public key OF a private-public key pair, OF which  
> the client proves possession OF the private key to  
> the server.
Perhaps better to just split this into two sentences: 
The Token Binding ID of a TLS connection is constructed using the public key of a private-public key pair.
The client proves possession of the corresponding private key.

> (clients use different Token Binding key pairs for different...
> The scoping for those Token Binding key pairs generated by Web browsers in...
> browsers MAY use different key pair scoping rules.
> For privacy reasons, clients use different Token Binding key pairs
> of the Token Binding key pair. It is possible that the Token
> <section title="Scoping of Token Binding Key Pairs"...
> Token Binding key pair across such subdomains.
> permissible to use different Token Binding key pair scoping rules, such as...
> using the same Token Binding key pair for both the Relying Party and the Identity...
> <section title="Life Time of Token Binding Key Pairs">
> Token Binding key pairs do not have an expiration time.
> Token Binding key pairs (similar to the affordances provided to delete cookies).
> Binding key pairs from such modes after the session is over. Generally speaking,
> Binding key pairs as they have over cookies or other potential tracking
While not wrong, all these key pairs seem unnecessary. The Token Binding key is asymmetric, so clearly it has a private and public component.
Aesthetically, I'd prefer Token Binding keys, key scoping, etc., to avoid a tautology.

> contains both: a proof of possession of the provided Token Binding  
> ID, as well as a proof of possession of the referred Token Binding  
> ID
It's a proof of possession of a Token Binding key, I think.

Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of =JeffH
Sent: Thursday, February 2, 2017 5:15 PM
To: IETF TokBind WG <[email-masked]>
Subject: Re: [Unbearable] HTTPSTB updates and respin WGLC

Please review PR #92:

In the meantime, am working on issue #88 and reviewing draft-campbell-tokbind-tls-term.

=JeffH

_______________________________________________
Unbearable mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/unbearable