search

aws / s2n-tls

An implementation of the TLS/SSL protocols
https://aws.github.io/s2n-tls/usage-guide/
Apache License 2.0
4.51k stars 704 forks source link

Add support for Token Binding negotiation #266

Open travisspencer opened 8 years ago

travisspencer commented 8 years ago

There is a new spec that is nearing completion in the IETF for binding tokens and cookies to the TLS layer using ALPN. From the spec:

Web services generate various security tokens (e.g. HTTP cookies, OAuth tokens, etc.) for web applications to access protected resources. Currently these are bearer tokens, i.e. any party in possession of such token gains access to the protected resource. Attackers export bearer tokens from client machines or from compromised network connections, present these bearer tokens to Web services, and impersonate authenticated users. Token Binding enables defense against such attacks by cryptographically binding security tokens to a secret held by the client.

For more details, the draft spec can be found here: https://datatracker.ietf.org/wg/tokbind/documents/

This spec is already widely supported by Google and Microsoft, the pioneers of the standard. It is also gaining industry traction from other parties. Implementations can be found already in these products:

In the coming weeks, Google will open source a C++ (and/or C) library that will handle all of the Token Binding negotiation. In BoringSSL and OpenSSL, this is offloaded to such a library using a custom extension API. No such API seems to exist in s2n, so either 1 of 2 things is needed:

colmmacc commented 8 years ago

In general s2n aims to be a minimal implementation - only including options and extensions that are broadly used. Every new piece of functionality brings risk, and since this is a very sensitive layer, it needs to be very well justified.

Speaking only for myself: I'm very skeptical about token binding. The mechanism is clearly a layering violation, and doesn't defend against standard channel-auth deficiencies such as request smuggling, or mismatches between the session state and the request state (what happens when a request spans two or more TLS contexts?). So it's a bit of a head-scratcher; if crypto changes are going to be used to defend shared-secrets better, why not move to signed requests? In that model, the tokens would be useless even when stolen.

alexw91 commented 7 years ago

@colmmacc should we close this as wont_fix, leave this on the backlog with low priority, or do something else?

travisspencer commented 7 years ago

As an FYI, if this ticket is marked as wont_fix, we'll have to mark s2n as wont_use :-/

alexw91 commented 6 years ago

Token binding support is being removed from Chrome: https://groups.google.com/a/chromium.org/forum/m/#!topic/blink-dev/OkdLUyYmY1E