Hi Torsten,
On 22 Nov 2019, at 12:15, Torsten Lodderstedt <tors...@lodderstedt.net> wrote:
>
> Hi Neil,
>
>> On 22. Nov 2019, at 18:08, Neil Madden <neil.mad...@forgerock.com> wrote:
>>
>> I think the phrase "token replay" is ambiguous. Traditionally it refers to
>> an attacker being able to capture a token (or whole requests) in use and
>> then replay it against the same RS. This is already protected against by the
>> use of normal TLS on the connection between the client and the RS. I think
>> instead you are referring to a malicious/compromised RS replaying the token
>> to a different RS - which has more of the flavour of a man in the middle
>> attack (of the phishing kind).
>
> I would argue TLS basically prevents leakage and not replay.
It also protects against replay. If you capture TLS-encrypted packets with
Wireshark you not only cannot decipher them but also cannot replay them because
they include specific anti-replay measures at the record level in the form of
unique session keys and record sequence numbers included in the MAC
calculations. This is essential to the security of TLS.
> The threats we try to cope with can be found in the Security BCP. There are
> multiple ways access tokens can leak, including referrer headers, mix-up,
> open redirection, browser history, and all sorts of access token leakage at
> the resource server
>
> Please have a look at
> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-4
> <https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-4>.
>
> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-4.8
> <https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-4..8>
> also has an extensive discussion of potential counter measures, including
> audience restricted access tokens and a conclusion to recommend sender
> constrained access tokens over other mechanisms.
OK, good - these are threats beyond token replay (at least as I understand that
term). It would be good to explicitly add them to the DPoP document motivation.
Note that most of these ways that an access token can leak also apply equally
to leak of the DPoP JWT, so the protection afforded by DPoP boils down to how
well the restrictions encoded into the JWT prevent it from being reused in this
case - e.g., restricting the expiry time, audience, scope, linking it to a
specific request (htm/htu) etc.
Every single one of those restrictions can be equally well encoded as caveats
on a macaroon access token without any need for public key signatures or
additional tokens and headers.
>> But if that's the case then there are much simpler defences than those
>> proposed in the current draft:
>>
>> 1. Get separate access tokens for each RS with correct audience and scopes.
>> The consensus appears to be that this is hard to do in some cases, hence the
>> draft.
>
> How many deployments do you know that today are able to issue RS-specific
> access tokens?
> BTW: how would you identify the RS?
>
> I agree that would be an alternative and I’m a great fan of such tokens (and
> used them a lot at Deutsche Telekom) but in my perception this pattern needs
> still to be established in the market. Moreover, they basically protect from
> a rough RS (if the URL is used as audience) replaying the token someplace
> else, but they do not protect from all other kinds of leakage/replay (e.g.
> log files).
Many services already do this. For example, Google encodes the intended RS into
the scopes on GCP
(https://developers.google.com/identity/protocols/googlescopes
<https://developers.google.com/identity/protocols/googlescopes>). A client can
do a single authorization flow to authorize all the scopes it needs and then
use repeated calls to the refresh token endpoint to obtain individual access
tokens with subsets of the authorized scopes for each endpoint.
(I think Brian also mentioned this pattern at OSW, but it might have been
somebody else).
>
>> 2. Make the DPoP token be a simple JWT with an "iat" and the origin of the
>> RS. This stops the token being reused elsewhere but the client can reuse it
>> (replay it) for many requests.
>> 3. Issue a macaroon-based access token and the client can add a correct
>> audience and scope restrictions at the point of use.
>
> Why is this needed if the access token is already audience restricted? Or do
> you propose this as alternative?
These are all alternatives. Any one of them prevents the specific attack of
replay by the RS to another RS.
-- Neil
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
