[{"author": "Hannes Tschofenig", "text": "

I am taking notes. Feel free to help me...

", "time": "2025-01-27T17:05:30Z"}, {"author": "Justin Richer", "text": "

Mike Jones, you're on mic still

", "time": "2025-01-27T17:05:35Z"}, {"author": "Brian Campbell", "text": "

nobody watches those tho

", "time": "2025-01-27T17:07:33Z"}, {"author": "Aaron Parecki", "text": "

i do! :eyes:

", "time": "2025-01-27T17:07:57Z"}, {"author": "Brian Campbell", "text": "

where nobody is not very many people

", "time": "2025-01-27T17:08:14Z"}, {"author": "Deb Cooley", "text": "

I know one person who does not.

", "time": "2025-01-27T17:09:13Z"}, {"author": "Deb Cooley", "text": "

but that person doesn't know what oauth is, let alone jwk

", "time": "2025-01-27T17:10:07Z"}, {"author": "Michael Jones", "text": "

Vulnerability Disclosure - Please do not post publicly: https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf

", "time": "2025-01-27T17:10:12Z"}, {"author": "Justin Richer", "text": "

The chat is part of the recording fyi ....

", "time": "2025-01-27T17:10:33Z"}, {"author": "Justin Richer", "text": "

There's a difference in making it \"public\" here and drawing attention to it in more public forums.

", "time": "2025-01-27T17:11:13Z"}, {"author": "Brian Campbell", "text": "

^ what Justin said

", "time": "2025-01-27T17:11:28Z"}, {"author": "Aaron Parecki", "text": "

Right, I think what is being asked is to not publicize this beyond this working group. No blog posts or press releases yet please.

", "time": "2025-01-27T17:11:43Z"}, {"author": "Michael Jones", "text": "

Correct

", "time": "2025-01-27T17:11:54Z"}, {"author": "Hannes Tschofenig", "text": "

Fair. Just wanted to make sure the implications of posting stuff in the chat or saying during this meeting are well understood.

", "time": "2025-01-27T17:12:28Z"}, {"author": "Brian Campbell", "text": "

i tell the story because much of it is my fault

", "time": "2025-01-27T17:13:05Z"}, {"author": "Hannes Tschofenig", "text": "

Noted!

", "time": "2025-01-27T17:13:25Z"}, {"author": "Brian Campbell", "text": "

JAR is NOT my fault

", "time": "2025-01-27T17:14:56Z"}, {"author": "Brian Campbell", "text": "

for the record

", "time": "2025-01-27T17:15:01Z"}, {"author": "Brian Campbell", "text": "

:)

", "time": "2025-01-27T17:15:05Z"}, {"author": "Michael Jones", "text": "

How we got \"should\" past the working group and the RFC Editor is beyond me. Life and learn!

", "time": "2025-01-27T17:15:34Z"}, {"author": "Pieter Kasselman", "text": "

aha - so the attacker is in the middle and now have an assertion it can use to authenticate with

", "time": "2025-01-27T17:17:21Z"}, {"author": "Pieter Kasselman", "text": "

?

", "time": "2025-01-27T17:17:28Z"}, {"author": "Michael Jones", "text": "

Yes, Pieter

", "time": "2025-01-27T17:17:34Z"}, {"author": "Brian Campbell", "text": "

not in the middle exactly but yes

", "time": "2025-01-27T17:17:39Z"}, {"author": "Brian Campbell", "text": "

kinda on the side

", "time": "2025-01-27T17:17:52Z"}, {"author": "Pieter Kasselman", "text": "

yes - almost like a kind of phishing attack...

", "time": "2025-01-27T17:18:04Z"}, {"author": "Brian Campbell", "text": "

if you squint at it right, yeah

", "time": "2025-01-27T17:18:43Z"}, {"author": "Pieter Kasselman", "text": "

:)

", "time": "2025-01-27T17:18:52Z"}, {"author": "Brian Campbell", "text": "

note that jwt/saml authorization grants are only sent to the token endpoint

", "time": "2025-01-27T17:19:42Z"}, {"author": "Hannes Tschofenig", "text": "

I would not call this a phishing attack because of the requirement for a bank to become malcious

", "time": "2025-01-27T17:19:53Z"}, {"author": "Pieter Kasselman", "text": "

That's fair Hannes

", "time": "2025-01-27T17:20:16Z"}, {"author": "Deb Cooley", "text": "

Isn't the attacker pretending to be bank?

", "time": "2025-01-27T17:20:51Z"}, {"author": "Deb Cooley", "text": "

(a fake bank)

", "time": "2025-01-27T17:21:06Z"}, {"author": "Hannes Tschofenig", "text": "

It has to be a real bank, at least in my understanding.

", "time": "2025-01-27T17:21:43Z"}, {"author": "Aaron Parecki", "text": "

A fake bank is one way to do it, assuming they can get in to the federation somehow

", "time": "2025-01-27T17:21:53Z"}, {"author": "Brian Campbell", "text": "

the attacker has to be an authorization server that the client trusts the same as a legit authorization server

", "time": "2025-01-27T17:22:19Z"}, {"author": "Hannes Tschofenig", "text": "

But if you manage to get yourself added to the federation you are considered to be a bank in that scenario

", "time": "2025-01-27T17:22:28Z"}, {"author": "Daniel Fett", "text": "

That's the same assumption as for the Mix-up Attack. Very possible in some ecosystems, hard to impossible in others.

", "time": "2025-01-27T17:22:42Z"}, {"author": "Hannes Tschofenig", "text": "

Definitely a high-bar for an attacker.

", "time": "2025-01-27T17:23:16Z"}, {"author": "Pieter Kasselman", "text": "

It depends a lot on the quality of the eco-system rules and their adherence/engforcement.

", "time": "2025-01-27T17:23:25Z"}, {"author": "Brian Campbell", "text": "

not necessarily a bank - but yes - that's a vertical where this kind of deployment occurs

", "time": "2025-01-27T17:23:30Z"}, {"author": "Joseph Heenan", "text": "

Yes, exactly. The key requirement is that the fintech trusts the attacker's AS as a place to send their users - federation is one way that could happen but there are definitely many ways. Obtaining control of a legitimate but poorly secured bank as a way to pivot to a high value target is not impossible.

", "time": "2025-01-27T17:24:02Z"}, {"author": "Brian Campbell", "text": "

note again: note that jwt/saml authorization grants are only sent to the token endpoint

", "time": "2025-01-27T17:24:10Z"}, {"author": "Daniel Fett", "text": "

There are 5000 banks in europe; we had ~1100 AS in the yes ecosystem. In both cases, it is not unreasonable to assume that one of those could be compromised.

", "time": "2025-01-27T17:24:25Z"}, {"author": "Kristina Yasuda", "text": "

I guess the same solution decided on here would apply to openid4vc specs too? Since they also use JAR and PAR?

", "time": "2025-01-27T17:25:07Z"}, {"author": "Hannes Tschofenig", "text": "

I read through the OpenID4VC specs and they are full of options. That is a security problem too

", "time": "2025-01-27T17:25:39Z"}, {"author": "Kristina Yasuda", "text": "

RFC6749 is full of options

", "time": "2025-01-27T17:27:42Z"}, {"author": "Brian Campbell", "text": "

saml assertions are used in practice with saml entity ids

", "time": "2025-01-27T17:27:56Z"}, {"author": "Aaron Parecki", "text": "

and that's why we're updating RFC6749 too

", "time": "2025-01-27T17:28:07Z"}, {"author": "Hannes Tschofenig", "text": "

This is something we should be talking about in this meeting.

", "time": "2025-01-27T17:28:31Z"}, {"author": "Brian Campbell", "text": "

is or is not?

", "time": "2025-01-27T17:28:56Z"}, {"author": "Kristina Yasuda", "text": "

And thats why rfc6749 has FAPI and openid4vc has HAIP

", "time": "2025-01-27T17:30:00Z"}, {"author": "Kristina Yasuda", "text": "

but any comments on those please raise in DCP wg

", "time": "2025-01-27T17:30:14Z"}, {"author": "Kristina Yasuda", "text": "

Don\u2019t think my original question was answered but I\u2019ll take it as a yes, this applies there too

", "time": "2025-01-27T17:30:40Z"}, {"author": "Pieter Kasselman", "text": "

Kristina, what does HAIP stand for (asking for a friend ;))

", "time": "2025-01-27T17:30:45Z"}, {"author": "Kristina Yasuda", "text": "

High assurance interoperability profile

", "time": "2025-01-27T17:31:09Z"}, {"author": "Kristina Yasuda", "text": "

It should have been high-assurance API, so that\u2019s it\u2019s HAPI

", "time": "2025-01-27T17:31:28Z"}, {"author": "Pieter Kasselman", "text": "

:) thanks

", "time": "2025-01-27T17:31:52Z"}, {"author": "Brian Campbell", "text": "

I want to be HAPI ...

", "time": "2025-01-27T17:32:11Z"}, {"author": "Joseph Heenan", "text": "

I'm not sure too many people are/will use openid4vc will use private_key_jwt, but yes the same change could be used there too / will automatically apply there when the RFCs are updated.

", "time": "2025-01-27T17:32:23Z"}, {"author": "Brian Campbell", "text": "

no

", "time": "2025-01-27T17:36:20Z"}, {"author": "Brian Campbell", "text": "

^ on the sec BCP

", "time": "2025-01-27T17:36:32Z"}, {"author": "Justin Richer", "text": "

^-- what brian said

", "time": "2025-01-27T17:36:41Z"}, {"author": "Hannes Tschofenig", "text": "

I would add a reference to the paper

", "time": "2025-01-27T17:36:47Z"}, {"author": "Daniel Fett", "text": "

We can't add a reference without describing the problem.

", "time": "2025-01-27T17:37:09Z"}, {"author": "Brian Campbell", "text": "

^ what Dr. Fett said

", "time": "2025-01-27T17:37:33Z"}, {"author": "Hannes Tschofenig", "text": "

But there is a line between a reference and reproducing the paper

", "time": "2025-01-27T17:37:35Z"}, {"author": "Daniel Fett", "text": "

I don't understand.

", "time": "2025-01-27T17:37:49Z"}, {"author": "Hannes Tschofenig", "text": "

Will explain later

", "time": "2025-01-27T17:37:56Z"}, {"author": "Brian Campbell", "text": "

what Justin's saying

", "time": "2025-01-27T17:38:07Z"}, {"author": "Dean Saxe", "text": "

I agree with Justin.

", "time": "2025-01-27T17:38:30Z"}, {"author": "Brian Campbell", "text": "

now less what Justin's saying

", "time": "2025-01-27T17:39:15Z"}, {"author": "Brian Campbell", "text": "

the scope thing is real

", "time": "2025-01-27T17:40:11Z"}, {"author": "Aaron Parecki", "text": "

I like the idea of a tightly scoped edit to several documents

", "time": "2025-01-27T17:40:14Z"}, {"author": "Hannes Tschofenig", "text": "

If there are no proposals for other changes, then the scope discussion is artificial

", "time": "2025-01-27T17:40:40Z"}, {"author": "Justin Richer", "text": "

There will be proposals once the door is opened unless the chairs say not to do that.

", "time": "2025-01-27T17:41:06Z"}, {"author": "Dean Saxe", "text": "

I'm not sure it's artificial - it's a way to prevent others from trying to add scope.

", "time": "2025-01-27T17:41:09Z"}, {"author": "Joseph Heenan", "text": "

I think the scope discussion could, for example, determine how you word the working group last call message.

", "time": "2025-01-27T17:41:17Z"}, {"author": "Dean Saxe", "text": "

By defining a tight scope now, we can speed up the actions to publish updated RFCs.

", "time": "2025-01-27T17:41:44Z"}, {"author": "Justin Richer", "text": "

my proposal: we start writing the bIS to the BCP now

", "time": "2025-01-27T17:41:50Z"}, {"author": "Hannes Tschofenig", "text": "

I make it clear: Dean, do you want new content in RFC 7523

", "time": "2025-01-27T17:41:53Z"}, {"author": "Justin Richer", "text": "

publish what we have now

", "time": "2025-01-27T17:41:54Z"}, {"author": "Dean Saxe", "text": "

I do not want new content beyond what is being discussed today.

", "time": "2025-01-27T17:42:22Z"}, {"author": "Hannes Tschofenig", "text": "

Then, the answer in your case is no. I have no heard anyone suggesting anything new.

", "time": "2025-01-27T17:42:51Z"}, {"author": "Hannes Tschofenig", "text": "

We are discussing a problem that does not exist

", "time": "2025-01-27T17:43:05Z"}, {"author": "Dean Saxe", "text": "

I see it as preventing scope creep from becoming a problem.

", "time": "2025-01-27T17:43:41Z"}, {"author": "Dean Saxe", "text": "

but I'll defer to the chairs

", "time": "2025-01-27T17:43:51Z"}, {"author": "George Fletcher", "text": "

+1 for publishing the Security BCP

", "time": "2025-01-27T17:43:56Z"}, {"author": "Brian Campbell", "text": "

\"We are discussing a problem that does not exist\" - that is a great metaphor for the problem that will exist

", "time": "2025-01-27T17:48:36Z"}, {"author": "Daniel Fett", "text": "

Can we (later) have a show of hands re the security BCP addition?

", "time": "2025-01-27T17:49:26Z"}, {"author": "Brian Campbell", "text": "

and SAML

", "time": "2025-01-27T17:50:06Z"}, {"author": "Brian Campbell", "text": "

the long answer is no

", "time": "2025-01-27T17:50:51Z"}, {"author": "Brian Campbell", "text": "

which is turns out to be short

", "time": "2025-01-27T17:51:11Z"}, {"author": "Brian Campbell", "text": "

yes, the AS changes only kinda help flush out clients that are not doing the right thing

", "time": "2025-01-27T17:54:18Z"}, {"author": "Pieter Kasselman", "text": "

+1 to brian

", "time": "2025-01-27T17:56:01Z"}, {"author": "Brian Campbell", "text": "

heart Filip

", "time": "2025-01-27T17:56:24Z"}, {"author": "Daniel Fett", "text": "

show of hands before end of session?

", "time": "2025-01-27T17:57:13Z"}, {"author": "Deb Cooley", "text": "

would that show of hands deal with both attacks?

", "time": "2025-01-27T17:57:47Z"}, {"author": "Deb Cooley", "text": "

or just this attack?

", "time": "2025-01-27T17:57:56Z"}, {"author": "Hannes Tschofenig", "text": "

Daniel wants to know how to proceed with the security BCP

", "time": "2025-01-27T17:58:17Z"}, {"author": "Daniel Fett", "text": "

Just this. The other would definitely need even more discussion.

", "time": "2025-01-27T17:58:25Z"}, {"author": "Brian Campbell", "text": "

Daniel is asking for a show of hands for action or not on the BCP in the RFC ed q

", "time": "2025-01-27T17:58:34Z"}, {"author": "Deb Cooley", "text": "

yeah, I understand that (I get those emails)

", "time": "2025-01-27T17:58:54Z"}, {"author": "Brian Campbell", "text": "

i don't, nor does the WG, which was kinda his point but that just got decided and i can't type fast enough

", "time": "2025-01-27T17:59:46Z"}]