Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
https://lepidum.co.jp/ Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.
IETF96 Berlin
OAUTH関連レポート
株式会社レピダム
前田 薫...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Agenda
 WG
 oauth
 tokbind
 IETF96
...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
自己紹介
 名前
 前田 薫 @mad_p
 所属
 株式会社レピダム
...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
oauth WG Overview
 月曜日と水曜日の2コマ開催
 Minu...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
oauth WG Presentations (1/2)
 Brian Cam...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
oauth WG Presentations (2/2)
 Mike John...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
OAuth for Native Apps
 Native AppsのためのB...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Mix-up mitigation
 Andrey: Mix-up attac...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
oauth WGまとめ
 OAuth2プロトコル成立後、周辺の拡張、プ
ロファ...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
tokbind WG Overview
 火曜日開催
 Minutes:
h...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
tokbind WG Presentations
 Andrei Popov:...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Token Binding の概要
 参考: http://www.slide...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Token Binding for Refresh Token
 Refres...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Token Binding for ID Token
 ID Token
 ...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Token Binding for Access Token (1/2)
 A...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Token Binding for Access Token (2/2)
 何...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
tokbind WG まとめ
 Token Bindingのコア文書は十分成熟...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
まとめ
 oauth WG
 プロトコルの周辺拡張・プロファイル策定
 攻...
Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
Any Questions? Feedbacks Welcome!
https:...
Upcoming SlideShare
Loading in …5
×

IETF96 Update oauth tokbind

1,267 views

Published on

2016/09/12 ISOC-JP主催のIETF報告会96で発表した資料です

Published in: Internet
  • DOWNLOAD THI5 BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THI5 BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

IETF96 Update oauth tokbind

  1. 1. https://lepidum.co.jp/ Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved. IETF96 Berlin OAUTH関連レポート 株式会社レピダム 前田 薫 (@mad_p) IETF96報告会 2016/09/12 IETF96報告会 2016/09/12
  2. 2. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Agenda  WG  oauth  tokbind  IETF96  Berlin, DE  Jul 17-22, 2016 IETF96報告会 2016/09/12
  3. 3. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ 自己紹介  名前  前田 薫 @mad_p  所属  株式会社レピダム シニアプログラマ マネージャ  コミュニティー活動  Lightweight Language  Identity Conference  http2study  業務領域  認証・認可、デジタル アイデンティティー、 プライバシー  標準化支援  ソフトウェアセキュリ ティー、脆弱性  IETFとの関わり  IETF89 Londonより  ART, SECエリア中心 IETF96報告会 2016/09/12
  4. 4. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
  5. 5. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ oauth WG Overview  月曜日と水曜日の2コマ開催  Minutes  https://www.ietf.org/proceedings/96/minutes/minutes-96- oauth  サポートドキュメントは順調  Mix-up Attackに対するmitigationとメタデータについ て議論  前週にドイツTrierでOAuth Security WS開催  OAuth2プロトコルのFormal Verification結果報告  IETFで仕様化したプロトコルの前段での問題  OAuth2向けToken Bindingでもめる(後半で解説) IETF96報告会 2016/09/12
  6. 6. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ oauth WG Presentations (1/2)  Brian Campbell: Token exchange  すでに得ている認可トークンを利用して権限委譲や偽装を行 うトークンを得る  use caseをわかりやすく  William Dennis: OAuth for Native Apps → WGLC  スマホなどのネイティブアプリでのOAuth/OpenID Connectフ ローにおけるベストプラクティス  William Dennis: OAuth Device Flow  TVなど入力装置がないが表示装置はあるデバイス。スマホや PCから表示されたコードを入力して認可を行う  Mike Johns: AMR Values → WGLC  認可に際し、使用した認証手段(パスワード、指紋など)を表 現するための語彙 IETF96報告会 2016/09/12
  7. 7. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ oauth WG Presentations (2/2)  Mike Johns: OAuth 2.0 Authorization Server Discovery Metadata  IdP Mix-up Attackに対する緩和策として、エンドポイント情 報をサーバーメタデータとして提供する形式を定める  Andrey Labunets: Mix-up mitigation  IdP Mix-up Attackの緩和手法について、セキュリティープロ パティー(Authentication, Containment)とプロバイダ・クライ アントでの実装コスト、移行コストから評価  Mike Johns: Token Binding for OAuth and OpenID Connect and Implementations for the Token Binding Protocol  tokbind WGの成果に対応し、token bindingのOAuthシナリオで の使い所を議論 IETF96報告会 2016/09/12
  8. 8. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ OAuth for Native Apps  Native AppsのためのBCP  WebView (WebView UI element, UIWebView/WKWebView)でなく、 device browser (Chrome Custom Tabs SFSafariViewController)を使う  各プラットフォームでのデモ(cmd窓も)  ライブラリ  GoogleへのOAuth2リクエストでは、WebViewを近々 deprecateする予定  https://developers.googleblog.com/2016/08/modernizing- oauth-interactions-in-native-apps.html IETF96報告会 2016/09/12
  9. 9. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Mix-up mitigation  Andrey: Mix-up attackのmitigation手法を評価  POSTすると多くのブラウザでOriginヘッダが自動的につ く  まずはmitigationのBCP → OAuth Specの次バージョンで normativeにする  既知のアタックをすべて網羅する必要があるだろう IETF96報告会 2016/09/12 Authentication Containment Development Cost Deprecation Cost iss + client_id 部分的 ○ 中 なし POST binding + Origin check ○ ○ 中 大
  10. 10. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ oauth WGまとめ  OAuth2プロトコル成立後、周辺の拡張、プ ロファイルなどの策定が進む  OAuth2に対する攻撃が報告され、緩和策が 提案されている  BCPとしてまとめる  わかっている問題をすべて網羅したい  その後、normative changeとして改訂版のOAuth プロトコルとする IETF96報告会 2016/09/12
  11. 11. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
  12. 12. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ tokbind WG Overview  火曜日開催  Minutes: https://www.ietf.org/proceedings/96/minutes/minutes- 96-tokbind  Token Bindingのコアドキュメントは順調  プライバシーレビューを経てWGLCへ  OAuth2向けToken BindingとAPI要件でもめる  OAuth WGで検討を続ける IETF96報告会 2016/09/12
  13. 13. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ tokbind WG Presentations  Andrei Popov: Token Binding Protocol I-D Changes Since IETF 95  コア文書はほぼWGLCに行ける品質  Dirk Balfanz: Token Binding over HTTPS  デモ Chrome Canary - Google IdP  fetch() API(W3C WHATWG)へのToken Bindingの取り込み  Mike Johns: Token Binding for OAuth and OpenID Connect  OAuth2、OpenID Connectにおけるtoken bindingの使い方  Referred Token Binding IDを指定するAPIが必要  OAuth特有の問題でありOAuth WGで検討すべし  Brian Campbell: A Token Binding method for OAuth 2.0 PKCE  OAuth2のPKCEにtoken bindingを使う方法 IETF96報告会 2016/09/12
  14. 14. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding の概要  参考: http://www.slideshare.net/KaoruMaeda/tokbindfido IETF96報告会 2016/09/12 TLS接続 Exported Key Material (EKM) EKM EKMを秘密鍵で署名、 TokenBindingID(公開鍵)と セットにして送る もらった公開鍵と EKMで署名検証 • いま話してる相手が • この公開鍵に対応した 秘密鍵を持っている • トークンとTBIDを関連 づける TokenBinding サーバーごとに 鍵ペアを生成
  15. 15. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding for Refresh Token  Refresh Token  2-party 1-TLS  かんたん IETF96報告会 2016/09/12 Client AS codeを送る refresh_token TBID にbind refresh_tokenを使う TBID 検証
  16. 16. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding for ID Token  ID Token  3-party 2-TLS  draft-ietf-tokbind-httpsでカバー  302 redirectでReferred-TBIDを出す . IETF96報告会 2016/09/12 RP IdP ①認証要求(302 redirect) TBID 検証ブラ ウザ ②認証(Referred TBID-RP) ③ID Tokenを返す(302) TBID-RP にbind ④ID Tokenを渡す 302とヘッダを トリガとして RP用のTBID をIdPに送る Include-Referred-Token-Binding-ID: true
  17. 17. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding for Access Token (1/2)  Access Token  3-party 3-TLS  Client, RS, AS  ??? IETF96報告会 2016/09/12 RS AS Client ブラ ウザ ⑤access_token使用 ①認可要求 ②code (302) ③codeからaccess_token要求 Referred TBID-RS を送る TBID 検証 何をトリガとして 何を送る??? ④ID Tokenを返す TBID-RS にbind
  18. 18. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding for Access Token (2/2)  何が問題か  302 + Include-RTBIDのような明確なトリガがない  どのTBIDを送ってよいのかわからない  ClientのOAuthレイヤからHTTPSレイヤに「オリジン rs.example.com 用のTBIDをReferredとしてas.example.comに送れ」と指示したい  HTTPSレイヤにReferred TBIDを指定するための何らかの APIが必要  APIのあり方について長~~い議論となった  APIの実装まで規定したくない(それはW3Cのお仕事)  機能要求として、コア文書に書けばよい。さらっと1文追加  問題: これをtoken bindingのコア文書に書くべきか?  それともHTTPS文書に書くべきか?  → 結論: OAuth WGでToken Bindingの文書を作ればよい IETF96報告会 2016/09/12
  19. 19. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ tokbind WG まとめ  Token Bindingのコア文書は十分成熟  プライバシーレビュー後WGLC  OAuth向けシナリオを検討した結果、十分考え られていない部分が発覚  HTTPS層に対してReferred-TBIDを指定するAPIが必要  APIの機能要求だけをコア文書には記述  OAuth向けの詳細な活用はOAuth WGで検討  さらっとWGLCに入ってWG完了と思いきや、 意外な伏兵で議論が炎上した IETF96報告会 2016/09/12
  20. 20. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/
  21. 21. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ まとめ  oauth WG  プロトコルの周辺拡張・プロファイル策定  攻撃ベクターと緩和策BCP文書の必要性  Token Bindingシナリオへの対応  tokbind WG  コア文書が十分な品質に  プライバシーレビュー → WGLC  API問題には深入りせず IETF96報告会 2016/09/12
  22. 22. Copyright © 2004-2016 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Any Questions? Feedbacks Welcome! https://lepidum.co.jp/ mailto:maeda@lepidum.co.jp / twitter: @mad_p IETF96報告会 2016/09/12

×