Token security considerations

core-wg / echo-request-tag

Other

0 stars 0 forks source link

Token security considerations #47

Closed chrysn closed 4 years ago

chrysn commented 4 years ago

This is my take on #43, pointing to the cases when it's possible to reuse tokens, at the same time discouraging it for all other cases.

The acceptable cases are

the ones identified in the last authors' call, and
TLS and OSCORE

I've added in a potential third case in source comments; it's still something we can dig up if people ask for more comprehensive exceptions, but there's so many things that can go wrong that I'd rather not have it in.

chrysn commented 4 years ago

Thanks, merged. I did put in a clarification on the f81c97221a1f0e7571ad06811a8b713659741336 edit -- acutally both CON and NON would be unusable.