draft-ietf-rtcweb-security-arch-08.txt   draft-ietf-rtcweb-security-arch-09.txt 
RTCWEB E. Rescorla RTCWEB E. Rescorla
Internet-Draft RTFM, Inc. Internet-Draft RTFM, Inc.
Intended status: Standards Track January 22, 2014 Intended status: Standards Track February 14, 2014
Expires: July 26, 2014 Expires: August 18, 2014
WebRTC Security Architecture WebRTC Security Architecture
draft-ietf-rtcweb-security-arch-08 draft-ietf-rtcweb-security-arch-09
Abstract Abstract
The Real-Time Communications on the Web (RTCWEB) working group is The Real-Time Communications on the Web (RTCWEB) working group is
tasked with standardizing protocols for enabling real-time tasked with standardizing protocols for enabling real-time
communications within user-agents using web technologies (commonly communications within user-agents using web technologies (commonly
called "WebRTC"). This document defines the security architecture called "WebRTC"). This document defines the security architecture
for for WebRTC.
Status of this Memo Status of this Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 26, 2014. This Internet-Draft will expire on August 18, 2014.
Copyright Notice Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 45 skipping to change at page 2, line 45
5.6. Web-Based Peer Authentication . . . . . . . . . . . . . . 18 5.6. Web-Based Peer Authentication . . . . . . . . . . . . . . 18
5.6.1. Trust Relationships: IdPs, APs, and RPs . . . . . . . 19 5.6.1. Trust Relationships: IdPs, APs, and RPs . . . . . . . 19
5.6.2. Overview of Operation . . . . . . . . . . . . . . . . 21 5.6.2. Overview of Operation . . . . . . . . . . . . . . . . 21
5.6.3. Items for Standardization . . . . . . . . . . . . . . 22 5.6.3. Items for Standardization . . . . . . . . . . . . . . 22
5.6.4. Binding Identity Assertions to JSEP Offer/Answer 5.6.4. Binding Identity Assertions to JSEP Offer/Answer
Transactions . . . . . . . . . . . . . . . . . . . . . 22 Transactions . . . . . . . . . . . . . . . . . . . . . 22
5.6.4.1. Input to Assertion Generation Process . . . . . . 22 5.6.4.1. Input to Assertion Generation Process . . . . . . 22
5.6.4.2. Carrying Identity Assertions . . . . . . . . . . . 23 5.6.4.2. Carrying Identity Assertions . . . . . . . . . . . 23
5.6.5. IdP Interaction Details . . . . . . . . . . . . . . . 24 5.6.5. IdP Interaction Details . . . . . . . . . . . . . . . 24
5.6.5.1. General Message Structure . . . . . . . . . . . . 24 5.6.5.1. General Message Structure . . . . . . . . . . . . 24
5.6.5.2. IdP Proxy Setup . . . . . . . . . . . . . . . . . 25 5.6.5.2. Errors . . . . . . . . . . . . . . . . . . . . . . 25
5.7. Security Considerations . . . . . . . . . . . . . . . . . 29 5.6.5.3. IdP Proxy Setup . . . . . . . . . . . . . . . . . 25
5.7.1. Communications Security . . . . . . . . . . . . . . . 29 5.7. Security Considerations . . . . . . . . . . . . . . . . . 30
5.7.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . 30 5.7.1. Communications Security . . . . . . . . . . . . . . . 30
5.7.3. Denial of Service . . . . . . . . . . . . . . . . . . 31 5.7.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . 31
5.7.4. IdP Authentication Mechanism . . . . . . . . . . . . . 32 5.7.3. Denial of Service . . . . . . . . . . . . . . . . . . 32
5.7.4.1. PeerConnection Origin Check . . . . . . . . . . . 32 5.7.4. IdP Authentication Mechanism . . . . . . . . . . . . . 33
5.7.4.2. IdP Well-known URI . . . . . . . . . . . . . . . . 33 5.7.4.1. PeerConnection Origin Check . . . . . . . . . . . 33
5.7.4.2. IdP Well-known URI . . . . . . . . . . . . . . . . 34
5.7.4.3. Privacy of IdP-generated identities and the 5.7.4.3. Privacy of IdP-generated identities and the
hosting site . . . . . . . . . . . . . . . . . . . 33 hosting site . . . . . . . . . . . . . . . . . . . 34
5.7.4.4. Security of Third-Party IdPs . . . . . . . . . . . 34 5.7.4.4. Security of Third-Party IdPs . . . . . . . . . . . 34
5.7.4.5. Web Security Feature Interactions . . . . . . . . 34 5.7.4.5. Web Security Feature Interactions . . . . . . . . 34
5.8. IANA Considerations . . . . . . . . . . . . . . . . . . . 34 5.8. IANA Considerations . . . . . . . . . . . . . . . . . . . 35
6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 35 6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 35
7. Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 7. Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
7.1. Changes since -06 . . . . . . . . . . . . . . . . . . . . 35 7.1. Changes since -06 . . . . . . . . . . . . . . . . . . . . 35
7.2. Changes since -05 . . . . . . . . . . . . . . . . . . . . 35 7.2. Changes since -05 . . . . . . . . . . . . . . . . . . . . 36
7.3. Changes since -03 . . . . . . . . . . . . . . . . . . . . 35 7.3. Changes since -03 . . . . . . . . . . . . . . . . . . . . 36
7.4. Changes since -03 . . . . . . . . . . . . . . . . . . . . 35 7.4. Changes since -03 . . . . . . . . . . . . . . . . . . . . 36
7.5. Changes since -02 . . . . . . . . . . . . . . . . . . . . 36 7.5. Changes since -02 . . . . . . . . . . . . . . . . . . . . 36
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 36 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 36
8.1. Normative References . . . . . . . . . . . . . . . . . . . 36 8.1. Normative References . . . . . . . . . . . . . . . . . . . 36
8.2. Informative References . . . . . . . . . . . . . . . . . . 37 8.2. Informative References . . . . . . . . . . . . . . . . . . 38
Appendix A. Example IdP Bindings to Specific Protocols . . . . . 38 Appendix A. Example IdP Bindings to Specific Protocols . . . . . 39
A.1. BrowserID . . . . . . . . . . . . . . . . . . . . . . . . 38 A.1. BrowserID . . . . . . . . . . . . . . . . . . . . . . . . 39
A.2. OAuth . . . . . . . . . . . . . . . . . . . . . . . . . . 41 A.2. OAuth . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 42 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 43
1. Introduction 1. Introduction
The Real-Time Communications on the Web (WebRTC) working group is The Real-Time Communications on the Web (WebRTC) working group is
tasked with standardizing protocols for real-time communications tasked with standardizing protocols for real-time communications
between Web browsers. The major use cases for WebRTC technology are between Web browsers. The major use cases for WebRTC technology are
real-time audio and/or video calls, Web conferencing, and direct data real-time audio and/or video calls, Web conferencing, and direct data
transfer. Unlike most conventional real-time systems, (e.g., SIP- transfer. Unlike most conventional real-time systems, (e.g., SIP-
based[RFC3261] soft phones) WebRTC communications are directly based[RFC3261] soft phones) WebRTC communications are directly
controlled by some Web server, via a JavaScript (JS) API as shown in controlled by some Web server, via a JavaScript (JS) API as shown in
skipping to change at page 22, line 11 skipping to change at page 22, line 11
1. The browser (the PeerConnection component) instantiates an IdP 1. The browser (the PeerConnection component) instantiates an IdP
proxy with its source at the IdP. This allows the IdP to load proxy with its source at the IdP. This allows the IdP to load
whatever JS is necessary into the proxy, which runs in the IdP's whatever JS is necessary into the proxy, which runs in the IdP's
security context. security context.
2. If the user is not already logged in, the IdP does whatever is 2. If the user is not already logged in, the IdP does whatever is
required to log them in, such as soliciting a username and required to log them in, such as soliciting a username and
password. password.
3. Once the user is logged in, the IdP proxy notifies the browser 3. Once the user is logged in, the IdP proxy notifies the browser
that it is ready. that it is ready.
4. The browser and the IdP proxy communicate via a standardized 4. The browser and the IdP proxy communicate via a standardized
series of messages delivered via postMessage. For instance, the series of messages delivered via a MessageChannel [WebMessaging].
browser might request the IdP proxy to sign or verify a given For instance, the browser might request the IdP proxy to sign or
identity assertion. verify a given identity assertion.
This approach allows us to decouple the browser from any particular This approach allows us to decouple the browser from any particular
identity provider; the browser need only know how to load the IdP's identity provider; the browser need only know how to load the IdP's
JavaScript--which is deterministic from the IdP's identity--and the JavaScript--which is deterministic from the IdP's identity--and the
generic protocol for requesting and verifying assertions. The IdP generic protocol for requesting and verifying assertions. The IdP
provides whatever logic is necessary to bridge the generic protocol provides whatever logic is necessary to bridge the generic protocol
to the IdP's specific requirements. Thus, a single browser can to the IdP's specific requirements. Thus, a single browser can
support any number of identity protocols, including being forward support any number of identity protocols, including being forward
compatible with IdPs which did not exist at the time the browser was compatible with IdPs which did not exist at the time the browser was
written. written.
skipping to change at page 22, line 46 skipping to change at page 22, line 46
specify the IdP to use to generate assertions and to discover what specify the IdP to use to generate assertions and to discover what
assertions were received. assertions were received.
The first two items are defined in this document. The final one is The first two items are defined in this document. The final one is
defined in the companion W3C WebRTC API specification [webrtc-api]. defined in the companion W3C WebRTC API specification [webrtc-api].
5.6.4. Binding Identity Assertions to JSEP Offer/Answer Transactions 5.6.4. Binding Identity Assertions to JSEP Offer/Answer Transactions
5.6.4.1. Input to Assertion Generation Process 5.6.4.1. Input to Assertion Generation Process
As discussed above, an identity assertion binds the user's identity An identity assertion binds the user's identity (as asserted by the
(as asserted by the IdP) to the JSEP offer/exchange transaction and IdP) to the JSEP offer/exchange transaction and specifically to the
specifically to the media. In order to achieve this, the media. In order to achieve this, the PeerConnection must provide the
PeerConnection must provide the DTLS-SRTP fingerprint to be bound to DTLS-SRTP fingerprint to be bound to the identity. This is provided
the identity. This is provided in a JSON structure for as a JavaScript object (also known as a dictionary or hash) with a
extensibility, as shown below: single "fingerprint" key, as shown below:
{ {
"fingerprint" : "fingerprint": {
{ "algorithm": "sha-256",
"algorithm":"SHA-1", "digest": "4A:AD:B9:B1:3F:...:E5:7C:AB"
"digest":"4A:AD:B9:B1:3F:...:E5:7C:AB"
} }
} }
The "algorithm" and digest values correspond directly to the This object is encoded in a JSON [RFC4627] string for passing to the
IdP.
The "algorithm" and "digest" values correspond directly to the
algorithm and digest values in the a=fingerprint line of the SDP. algorithm and digest values in the a=fingerprint line of the SDP.
[RFC4572]. [RFC4572].
Note: this structure does not need to be interpreted by the IdP or Note: this structure does not need to be interpreted by the IdP or
the IdP proxy. It is consumed solely by the RP's browser. The IdP the IdP proxy. It is consumed solely by the RP's browser. The IdP
merely treats it as an opaque value to be attested to. Thus, new merely treats it as an opaque value to be attested to. Thus, new
parameters can be added to the assertion without modifying the IdP. parameters can be added to the assertion without modifying the IdP.
5.6.4.2. Carrying Identity Assertions 5.6.4.2. Carrying Identity Assertions
Once an IdP has generated an assertion, it is attached to the JSEP Once an IdP has generated an assertion, it is attached to the SDP
message. This is done by adding a new a-line to the SDP, of the form message. This is done by adding a new a-line to the SDP, of the form
a=identity. The sole contents of this value are a base-64-encoded a=identity. The sole contents of this value are a base-64 encoded
version of the identity assertion. For example: [RFC4848] identity assertion. For example:
v=0 v=0
o=- 1181923068 1181923196 IN IP4 ua1.example.com o=- 1181923068 1181923196 IN IP4 ua1.example.com
s=example1 s=example1
c=IN IP4 ua1.example.com c=IN IP4 ua1.example.com
a=setup:actpass a=setup:actpass
a=fingerprint:sha-1 \ a=fingerprint:sha-1 \
4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E:5D:49:6B:19:E5:7C:AB 4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E:5D:49:6B:19:E5:7C:AB
a=identity:\ a=identity:\
ImlkcCI6eyJkb21haW4iOiAiZXhhbXBsZS5vcmciLCAicHJvdG9jb2wiOiAiYm9n\ ImlkcCI6eyJkb21haW4iOiAiZXhhbXBsZS5vcmciLCAicHJvdG9jb2wiOiAiYm9n\
dXMifSwiYXNzZXJ0aW9uIjpcIntcImlkZW50aXR5XCI6XCJib2JAZXhhbXBsZS5v\ dXMifSwiYXNzZXJ0aW9uIjpcIntcImlkZW50aXR5XCI6XCJib2JAZXhhbXBsZS5v\
cmdcIixcImNvbnRlbnRzXCI6XCJhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3l6XCIs\ cmdcIixcImNvbnRlbnRzXCI6XCJhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3l6XCIs\
XCJzaWduYXR1cmVcIjpcIjAxMDIwMzA0MDUwNlwifSJ9Cg== XCJzaWduYXR1cmVcIjpcIjAxMDIwMzA0MDUwNlwifSJ9Cg==
t=0 0 t=0 0
m=audio 6056 RTP/SAVP 0 m=audio 6056 RTP/SAVP 0
a=sendrecv a=sendrecv
... ...
Each identity attribute should be paired (and attests to) with an Each identity attribute should be paired (and attests to) with an
a=fingerprint attribute and therefore can exist either at the session "a=fingerprint" attribute and therefore can exist either at the
or media level. Multiple identity attributes may appear at either session or media level. Multiple identity attributes may appear at
level, though it is RECOMMENDED that implementations not do this, either level, though it is RECOMMENDED that implementations not do
because it becomes very unclear what security claim that they are this, because it becomes very unclear what security claim that they
making and the UI guidelines above become unclear. Browsers MAY are making and the UI guidelines above become unclear. Browsers MAY
choose refuse to display any identity indicators in the face of choose refuse to display any identity indicators in the face of
multiple identity attributes with different identities but SHOULD multiple identity attributes with different identities but SHOULD
process multiple attributes with the same identity as described process multiple attributes with the same identity as described
above. above.
TODO: write up paragraph on the consequences of multiple
a=fingerprint attributes.
5.6.5. IdP Interaction Details 5.6.5. IdP Interaction Details
5.6.5.1. General Message Structure 5.6.5.1. General Message Structure
Messages between the PeerConnection object and the IdP proxy are Messages between the PeerConnection object and the IdP proxy are
formatted using JSON [RFC4627]. For instance, the PeerConnection JavaScript objects, shown in examples using JSON [RFC4627]. For
would request a signature with the following "SIGN" message: instance, the PeerConnection would request a signature with the
following "SIGN" message:
{ {
"type":"SIGN", "type": "SIGN",
"id": "1", "id": "1",
"origin":"https://calling-site.example.com", "origin": "https://calling-site.example.com",
"message":"012345678abcdefghijkl" "message": "012345678abcdefghijkl"
} }
All messages MUST contain a "type" field which indicates the general All messages MUST contain a "type" field which indicates the general
meaning of the message. meaning of the message.
All requests from the PeerConnection object MUST contain an "id" All requests from the PeerConnection object MUST contain an "id"
field which MUST be unique for that PeerConnection object. Any field which MUST be unique within the scope of the interaction
responses from the IdP proxy MUST contain the same id in response, between the browser and the IdP instance. Responses from the IdP
which allows the PeerConnection to correlate requests and responses, proxy MUST contain the same "id" in response, which allows the
in case there are multiple requests/responses outstanding to the same PeerConnection to correlate requests and responses, in case there are
proxy. multiple requests/responses outstanding to the same proxy.
All requests from the PeerConnection object MUST contain an "origin" All requests from the PeerConnection object MUST contain an "origin"
field containing the origin of the JS which initiated the PC (i.e., field containing the origin of the JS which initiated the PC (i.e.,
the URL of the calling site). This origin value can be used by the the URL of the calling site). This origin value can be used by the
IdP to make access control decisions. For instance, an IdP might IdP to make access control decisions. For instance, an IdP might
only issue identity assertions for certain calling services in the only issue identity assertions for certain calling services in the
same way that some IdPs require that relying Web sites have an API same way that some IdPs require that relying Web sites have an API
key before learning user identity. key before learning user identity.
Any message-specific data is carried in a "message" field. Depending Any message-specific data is carried in a "message" field. Depending
on the message type, this may either be a string or a richer JSON on the message type, this may either be a string or any JavaScript
object. object that can be conveyed in a message channel. This includes any
object that is able to be serialized to JSON.
5.6.5.1.1. Errors 5.6.5.2. Errors
If an error occurs, the IdP sends a message of type "ERROR". The If an error occurs, the IdP sends a message of type "ERROR". The
message MAY have an "error" field containing freeform text data which message MAY have an "error" field containing freeform text data which
containing additional information about what happened. For instance: containing additional information about what happened. For instance:
{ {
"id":"1", "type": "ERROR",
"type":"ERROR", "id": "1",
"error":"Signature verification failed" "error": "Signature verification failed"
} }
Figure 5: Example error Figure 5: Example error
5.6.5.2. IdP Proxy Setup 5.6.5.3. IdP Proxy Setup
In order to perform an identity transaction, the PeerConnection must In order to perform an identity transaction, the PeerConnection must
first create an IdP proxy. While the details of this are specified first create an IdP proxy. While the details of this are specified
in the W3C API document, from the perspective of this specification, in the W3C API document, from the perspective of this specification,
however, the relevant facts are: however, the relevant facts are:
o The JS runs in the IdP's security context with the base page o The JS runs in the IdP's security context with the base page
retrieved from the URL specified in Section 5.6.5.2.1 retrieved from the URL specified in Section 5.6.5.3.1.
o The usual browser sandbox isolation mechanisms MUST be enforced o The usual browser sandbox isolation mechanisms MUST be enforced
with respect to the IdP proxy. with respect to the IdP proxy. The IdP cannot be provided with
escalated privileges.
o JS running in the IdP proxy MUST be able to send and receive o JS running in the IdP proxy MUST be able to send and receive
messages to the PeerConnection and the PC and IdP proxy are able messages to the PeerConnection and the PC and IdP proxy are able
to verify the source and destination of these messages. to verify the source and destination of these messages.
o The IdP proxy is unable to interact with the user. This includes
the creation of popup windows and dialogs.
Initially the IdP proxy is in an unready state; the IdP JS must be Initially the IdP proxy is in an unready state; the IdP JS must be
loaded and there may be several round trips to the IdP server, for loaded and there may be several round trips to the IdP server to load
instance to log the user in. When the IdP proxy is ready to receive and prepare necessary resources.
commands, it delivers a "ready" message. As this message is
unsolicited, it simply contains:
{ "type":"READY" } When the IdP proxy is ready to receive commands, it delivers a
"READY" message. As this message is unsolicited, it contains only
the "type":
{ "type":"READY" }
Once the PeerConnection object receives the ready message, it can Once the PeerConnection object receives the ready message, it can
send commands to the IdP proxy. send commands to the IdP proxy.
5.6.5.2.1. Determining the IdP URI 5.6.5.3.1. Determining the IdP URI
In order to ensure that the IdP is under control of the domain owner In order to ensure that the IdP is under control of the domain owner
rather than someone who merely has an account on the domain owner's rather than someone who merely has an account on the domain owner's
server (e.g., in shared hosting scenarios), the IdP JavaScript is server (e.g., in shared hosting scenarios), the IdP JavaScript is
hosted at a deterministic location based on the IdP's domain name. hosted at a deterministic location based on the IdP's domain name.
Each IdP proxy instance is associated with two values: Each IdP proxy instance is associated with two values:
domain name: The IdP's domain name domain name: The IdP's domain name
protocol: The specific IdP protocol which the IdP is using. This is protocol: The specific IdP protocol which the IdP is using. This is
a completely IdP-specific string, but allows an IdP to implement a completely IdP-specific string, but allows an IdP to implement
two protocols in parallel. This value may be the empty string. two protocols in parallel. This value may be the empty string.
Each IdP MUST serve its initial entry page (i.e., the one loaded by Each IdP MUST serve its initial entry page (i.e., the one loaded by
the IdP proxy) from the well-known URI specified in "/.well-known/ the IdP proxy) from a well-known URI [RFC5785]. The well-known URI
idp-proxy/<protocol>" on the IdP's web site. This URI MUST be loaded for an IdP proxy is formed from the following URI components:
via HTTPS [RFC2818]. For example, for the IdP "identity.example.com" 1. The scheme, "https:". An IdP MUST be loaded using HTTPS
and the protocol "example", the URL would be: [RFC2818].
2. The authority, which is the IdP domain name. The authority MAY
contain a non-default port number. Any port number is removed
when determining if an asserted identity matches the name of the
IdP. The authority MUST NOT include a userinfo sub-component.
3. The path, starting with "/.well-known/idp-proxy/" and appended
with the IdP protocol. Note that the separator characters '/'
(%2F) and '\' (%5C) MUST NOT be permitted in the protocol field,
lest an attacker be able to direct requests outside of the
controlled "/.well-known/" prefix. Query and fragment values MAY
be used by including '?' or '#' characters.
For example, for the IdP "identity.example.com" and the protocol
"example", the URL would be:
https://example.com/.well-known/idp-proxy/example https://example.com/.well-known/idp-proxy/example
5.6.5.2.1.1. Authenticating Party 5.6.5.3.1.1. Authenticating Party
How an AP determines the appropriate IdP domain is out of scope of How an AP determines the appropriate IdP domain is out of scope of
this specification. In general, however, the AP has some actual this specification. In general, however, the AP has some actual
account relationship with the IdP, as this identity is what the IdP account relationship with the IdP, as this identity is what the IdP
is attesting to. Thus, the AP somehow supplies the IdP information is attesting to. Thus, the AP somehow supplies the IdP information
to the browser. Some potential mechanisms include: to the browser. Some potential mechanisms include:
o Provided by the user directly. o Provided by the user directly.
o Selected from some set of IdPs known to the calling site. E.g., a o Selected from some set of IdPs known to the calling site. E.g., a
button that shows "Authenticate via Facebook Connect" button that shows "Authenticate via Facebook Connect"
5.6.5.2.1.2. Relying Party 5.6.5.3.1.2. Relying Party
Unlike the AP, the RP need not have any particular relationship with Unlike the AP, the RP need not have any particular relationship with
the IdP. Rather, it needs to be able to process whatever assertion the IdP. Rather, it needs to be able to process whatever assertion
is provided by the AP. As the assertion contains the IdP's identity, is provided by the AP. As the assertion contains the IdP's identity,
the URI can be constructed directly from the assertion, and thus the the URI can be constructed directly from the assertion, and thus the
RP can directly verify the technical validity of the assertion with RP can directly verify the technical validity of the assertion with
no user interaction. Authoritative assertions need only be no user interaction. Authoritative assertions need only be
verifiable. Third-party assertions also MUST be verified against verifiable. Third-party assertions also MUST be verified against
local policy, as described in Section 5.6.5.2.3.1. local policy, as described in Section 5.6.5.3.3.1.
5.6.5.2.2. Requesting Assertions 5.6.5.3.2. Requesting Assertions
In order to request an assertion, the PeerConnection sends a "SIGN" In order to request an assertion, the PeerConnection sends a "SIGN"
message. Aside from the mandatory fields, this message has a message. Aside from the mandatory fields, this message has a
"message" field containing a string. The contents of this string are "message" field containing a string. The string contains a JSON-
defined above, but are opaque from the perspective of the IdP. encoded object containing certificate fingerprints but are treated as
opaque from the perspective of the IdP.
A successful response to a "SIGN" message contains a message field A successful response to a "SIGN" message contains a "message" field
which is a JS dictionary consisting of two fields: which is a JavaScript dictionary consisting of two fields:
idp: A dictionary containing the domain name of the provider and the idp: A dictionary containing the domain name of the provider and the
protocol string protocol string.
assertion: An opaque field containing the assertion itself. This is assertion: An opaque value containing the assertion itself. This is
only interpretable by the idp or its proxy. only interpretable by the IdP or its proxy.
Figure 6 shows an example transaction, with the message "abcde..." Figure 6 shows an example transaction, with the message "abcde..."
(remember, the messages are opaque at this layer) being signed and (remember, the messages are opaque at this layer) being signed and
bound to identity "ekr@example.org". In this case, the message has bound to identity "ekr@example.org". In this case, the message has
presumably been digitally signed/MACed in some way that the IdP can presumably been digitally signed/MACed in some way that the IdP can
later verify it, but this is an implementation detail and out of later verify it, but this is an implementation detail and out of
scope of this document. Line breaks are inserted solely for scope of this document. Line breaks are inserted solely for
readability. readability.
PeerConnection -> IdP proxy: PeerConnection -> IdP proxy:
{ {
"type":"SIGN", "type": "SIGN",
"id":1, "id": "1",
"origin":"https://calling-service.example.com/", "origin": "https://calling-service.example.com/",
"message":"abcdefghijklmnopqrstuvwyz" "message": "abcdefghijklmnopqrstuvwyz"
} }
IdPProxy -> PeerConnection: IdPProxy -> PeerConnection:
{ {
"type":"SUCCESS", "type": "SUCCESS",
"id":1, "id": "1",
"message": { "message": {
"idp":{ "idp":{
"domain": "example.org" "domain": "example.org"
"protocol": "bogus" "protocol": "bogus"
}, },
"assertion": "{\"identity\":\"bob@example.org\", "assertion": "{\"identity\":\"bob@example.org\",
\"contents\":\"abcdefghijklmnopqrstuvwyz\", \"contents\":\"abcdefghijklmnopqrstuvwyz\",
\"request_origin\":\"rtcweb://peerconnection\",
\"signature\":\"010203040506\"}" \"signature\":\"010203040506\"}"
} }
} }
Figure 6: Example assertion request Figure 6: Example assertion request
The message structure is serialized, base64-encoded, and placed in an The "message" structure is serialized into JSON, base64-encoded
a=identity attribute. [RFC4848], and placed in an "a=identity" attribute.
5.6.5.2.3. Verifying Assertions 5.6.5.3.3. Verifying Assertions
In order to verify an assertion, an RP sends a "VERIFY" message to In order to verify an assertion, an RP sends a "VERIFY" message to
the IdP proxy containing the assertion supplied by the AP in the the IdP proxy containing the assertion supplied by the AP in the
"message" field. "message" field.
The IdP proxy verifies the assertion. Depending on the identity The IdP proxy verifies the assertion. Depending on the identity
protocol, this may require one or more round trips to the IdP. For protocol, the proxy might contact the IdP server or other servers.
instance, an OAuth-based protocol will likely require using the IdP For instance, an OAuth-based protocol will likely require using the
as an oracle, whereas with BrowserID the IdP proxy can likely verify IdP as an oracle, whereas with BrowserID the IdP proxy can likely
the signature on the assertion without contacting the IdP, provided verify the signature on the assertion without contacting the IdP,
that it has cached the IdP's public key. provided that it has cached the IdP's public key.
Regardless of the mechanism, if verification succeeds, a successful Regardless of the mechanism, if verification succeeds, a successful
response from the IdP proxy MUST contain a message field consisting response from the IdP proxy MUST contain a message field consisting
of a dictionary/hash with the following fields: of a object with the following fields:
identity The identity of the AP from the IdP's perspective. Details identity: The identity of the AP from the IdP's perspective.
of this are provided in Section 5.6.5.2.3.1 Details of this are provided in Section 5.6.5.3.3.1.
contents The original unmodified string provided by the AP in the contents: The original unmodified string provided by the AP in the
original SIGN request. original SIGN request.
request_origin The original origin of the SIGN request on the AP
side as determined by the origin of the PostMessage call. The IdP
MUST somehow arrange to propagate this information as part of the
assertion. The receiving PeerConnection MUST verify that this
value is "rtcweb://peerconnection" (which implies that
PeerConnection must arrange that its messages to the IdP proxy are
from this origin.) See Section 5.7.4.1 for the security purpose
of this field. [[ OPEN ISSUE: Can a URI person help make a better
URI.]]
Figure 7 shows an example transaction. Line breaks are inserted Figure 7 shows an example transaction. Line breaks are inserted
solely for readability. solely for readability.
PeerConnection -> IdP Proxy: PeerConnection -> IdP Proxy:
{ {
"type":"VERIFY", "type": "VERIFY",
"id":2, "id": 2,
"origin":"https://calling-service.example.com/", "origin": "https://calling-service.example.com/",
"message":\"{\"identity\":\"bob@example.org\", "message": "{\"identity\":\"bob@example.org\",
\"contents\":\"abcdefghijklmnopqrstuvwyz\", \"contents\":\"abcdefghijklmnopqrstuvwyz\",
\"request_origin\":\"rtcweb://peerconnection\",
\"signature\":\"010203040506\"}" \"signature\":\"010203040506\"}"
} }
IdP Proxy -> PeerConnection: IdP Proxy -> PeerConnection:
{ {
"type":"SUCCESS", "type": "SUCCESS",
"id":2, "id": 2,
"message": { "message": {
"identity" : { "identity": "bob@example.org",
"name" : "bob@example.org", "contents": "abcdefghijklmnopqrstuvwyz"
"displayname" : "Bob"
},
"request_origin":"rtcweb://peerconnection",
"contents":"abcdefghijklmnopqrstuvwyz"
} }
} }
Figure 7: Example verification request Figure 7: Example verification request
5.6.5.2.3.1. Identity Formats 5.6.5.3.3.1. Identity Formats
Identities passed from the IdP proxy to the PeerConnection are Identities passed from the IdP proxy to the PeerConnection are passed
structured as JSON dictionaries with one mandatory field: "name". in the "identity" field. This field MUST consist of a string
This field MUST consist of an RFC822-formatted string representing representing the user's identity. This string is in the form
the user's identity. [[ OPEN ISSUE: Would it be better to have a "<user>@<domain>", where "user" consists of any character except '@',
typed field? ]] The PeerConnection API MUST check this string as and domain is an internationalized domain name [RFC5890].
follows:
1. If the RHS of the string is equal to the domain name of the IdP The PeerConnection API MUST check this string as follows:
proxy, then the assertion is valid, as the IdP is authoritative 1. If the domain portion of the string is equal to the domain name
for this domain. of the IdP proxy, then the assertion is valid, as the IdP is
2. If the RHS of the string is not equal to the domain name of the authoritative for this domain. Comparison of domain names is
IdP proxy, then the PeerConnection object MUST reject the done using the label equivalence rule defined in Section 2.3.2.4
assertion unless (a) the IdP domain is listed as an acceptable of [RFC5890].
third-party IdP and (b) local policy is configured to trust this 2. If the domain portion of the string is not equal to the domain
IdP domain for the RHS of the identity string. name of the IdP proxy, then the PeerConnection object MUST reject
the assertion unless:
1. the IdP domain is trusted as an acceptable third-party IdP;
and
2. local policy is configured to trust this IdP domain for the
RHS of the identity string.
Sites which have identities that do not fit into the RFC822 style Sites which have identities that do not fit into the RFC822 style
(for instance, Facebook ids are simple numeric values) SHOULD convert (for instance, identifiers that are simple numeric values, or values
them to this form by appending their IdP domain (e.g., that contain '@' characters) SHOULD convert them to this form by
12345@identity.facebook.com), thus ensuring that they are escaping illegal characters and appending their IdP domain (e.g.,
user%40133@identity.example.com), thus ensuring that they are
authoritative for the identity. authoritative for the identity.
The IdP proxy MAY also include a "displayname" field which contains a
more user-friendly identity assertion. Browsers SHOULD take care in
the UI to distinguish the "name" assertion which is verifiable
directly from the "displayname" which cannot be verified and thus
relies on trust in the IdP. In future, we may define other fields to
allow the IdP to provide more information to the browser. [[OPEN
ISSUE: Should this field exist? Is it confusing? ]]
5.7. Security Considerations 5.7. Security Considerations
Much of the security analysis of this problem is contained in Much of the security analysis of this problem is contained in
[I-D.ietf-rtcweb-security] or in the discussion of the particular [I-D.ietf-rtcweb-security] or in the discussion of the particular
issues above. In order to avoid repetition, this section focuses on issues above. In order to avoid repetition, this section focuses on
(a) residual threats that are not addressed by this document and (b) (a) residual threats that are not addressed by this document and (b)
threats produced by failure/misbehavior of one of the components in threats produced by failure/misbehavior of one of the components in
the system. the system.
5.7.1. Communications Security 5.7.1. Communications Security
skipping to change at page 33, line 30 skipping to change at page 34, line 8
Note that this check only asserts that the browser (or some other Note that this check only asserts that the browser (or some other
entity with access to the user's authentication data) attests to the entity with access to the user's authentication data) attests to the
request and hence to the fingerprint. It does not demonstrate that request and hence to the fingerprint. It does not demonstrate that
the browser has access to the associated private key. However, the browser has access to the associated private key. However,
attaching one's identity to a key that the user does not control does attaching one's identity to a key that the user does not control does
not appear to provide substantial leverage to an attacker, so a proof not appear to provide substantial leverage to an attacker, so a proof
of possession is omitted for simplicity. of possession is omitted for simplicity.
5.7.4.2. IdP Well-known URI 5.7.4.2. IdP Well-known URI
As described in Section 5.6.5.2.1 the IdP proxy HTML/JS landing page As described in Section 5.6.5.3.1 the IdP proxy HTML/JS landing page
is located at a well-known URI based on the IdP's domain name. This is located at a well-known URI based on the IdP's domain name. This
requirement prevents an attacker who can write some resources at the requirement prevents an attacker who can write some resources at the
IdP (e.g., on one's Facebook wall) from being able to impersonate the IdP (e.g., on one's Facebook wall) from being able to impersonate the
IdP. IdP.
5.7.4.3. Privacy of IdP-generated identities and the hosting site 5.7.4.3. Privacy of IdP-generated identities and the hosting site
Depending on the structure of the IdP's assertions, the calling site Depending on the structure of the IdP's assertions, the calling site
may learn the user's identity from the perspective of the IdP. In may learn the user's identity from the perspective of the IdP. In
many cases this is not an issue because the user is authenticating to many cases this is not an issue because the user is authenticating to
skipping to change at page 36, line 28 skipping to change at page 37, line 10
8.1. Normative References 8.1. Normative References
[I-D.ietf-avtcore-6222bis] [I-D.ietf-avtcore-6222bis]
Begen, A., Perkins, C., Wing, D., and E. Rescorla, Begen, A., Perkins, C., Wing, D., and E. Rescorla,
"Guidelines for Choosing RTP Control Protocol (RTCP) "Guidelines for Choosing RTP Control Protocol (RTCP)
Canonical Names (CNAMEs)", draft-ietf-avtcore-6222bis-06 Canonical Names (CNAMEs)", draft-ietf-avtcore-6222bis-06
(work in progress), July 2013. (work in progress), July 2013.
[I-D.ietf-rtcweb-security] [I-D.ietf-rtcweb-security]
Rescorla, E., "Security Considerations for WebRTC", Rescorla, E., "Security Considerations for WebRTC",
draft-ietf-rtcweb-security-05 (work in progress), draft-ietf-rtcweb-security-06 (work in progress),
July 2013. January 2014.
[I-D.ietf-tsvwg-sctp-dtls-encaps] [I-D.ietf-tsvwg-sctp-dtls-encaps]
Tuexen, M., Stewart, R., Jesup, R., and S. Loreto, "DTLS Tuexen, M., Stewart, R., Jesup, R., and S. Loreto, "DTLS
Encapsulation of SCTP Packets", Encapsulation of SCTP Packets",
draft-ietf-tsvwg-sctp-dtls-encaps-02 (work in progress), draft-ietf-tsvwg-sctp-dtls-encaps-03 (work in progress),
October 2013. February 2014.
[I-D.muthu-behave-consent-freshness] [I-D.muthu-behave-consent-freshness]
Perumal, M., Wing, D., R, R., and T. Reddy, "STUN Usage Perumal, M., Wing, D., R, R., and T. Reddy, "STUN Usage
for Consent Freshness", for Consent Freshness",
draft-muthu-behave-consent-freshness-04 (work in draft-muthu-behave-consent-freshness-04 (work in
progress), July 2013. progress), July 2013.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
skipping to change at page 37, line 15 skipping to change at page 37, line 44
[RFC4347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer [RFC4347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer
Security", RFC 4347, April 2006. Security", RFC 4347, April 2006.
[RFC4572] Lennox, J., "Connection-Oriented Media Transport over the [RFC4572] Lennox, J., "Connection-Oriented Media Transport over the
Transport Layer Security (TLS) Protocol in the Session Transport Layer Security (TLS) Protocol in the Session
Description Protocol (SDP)", RFC 4572, July 2006. Description Protocol (SDP)", RFC 4572, July 2006.
[RFC4627] Crockford, D., "The application/json Media Type for [RFC4627] Crockford, D., "The application/json Media Type for
JavaScript Object Notation (JSON)", RFC 4627, July 2006. JavaScript Object Notation (JSON)", RFC 4627, July 2006.
[RFC4848] Daigle, L., "Domain-Based Application Service Location
Using URIs and the Dynamic Delegation Discovery Service
(DDDS)", RFC 4848, April 2007.
[RFC5245] Rosenberg, J., "Interactive Connectivity Establishment [RFC5245] Rosenberg, J., "Interactive Connectivity Establishment
(ICE): A Protocol for Network Address Translator (NAT) (ICE): A Protocol for Network Address Translator (NAT)
Traversal for Offer/Answer Protocols", RFC 5245, Traversal for Offer/Answer Protocols", RFC 5245,
April 2010. April 2010.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, August 2008. (TLS) Protocol Version 1.2", RFC 5246, August 2008.
[RFC5763] Fischl, J., Tschofenig, H., and E. Rescorla, "Framework [RFC5763] Fischl, J., Tschofenig, H., and E. Rescorla, "Framework
for Establishing a Secure Real-time Transport Protocol for Establishing a Secure Real-time Transport Protocol
(SRTP) Security Context Using Datagram Transport Layer (SRTP) Security Context Using Datagram Transport Layer
Security (DTLS)", RFC 5763, May 2010. Security (DTLS)", RFC 5763, May 2010.
[RFC5764] McGrew, D. and E. Rescorla, "Datagram Transport Layer [RFC5764] McGrew, D. and E. Rescorla, "Datagram Transport Layer
Security (DTLS) Extension to Establish Keys for the Secure Security (DTLS) Extension to Establish Keys for the Secure
Real-time Transport Protocol (SRTP)", RFC 5764, May 2010. Real-time Transport Protocol (SRTP)", RFC 5764, May 2010.
[RFC5785] Nottingham, M. and E. Hammer-Lahav, "Defining Well-Known
Uniform Resource Identifiers (URIs)", RFC 5785,
April 2010.
[RFC5890] Klensin, J., "Internationalized Domain Names for
Applications (IDNA): Definitions and Document Framework",
RFC 5890, August 2010.
[RFC6454] Barth, A., "The Web Origin Concept", RFC 6454, [RFC6454] Barth, A., "The Web Origin Concept", RFC 6454,
December 2011. December 2011.
[WebMessaging]
Hickson, "HTML5 Web Messaging", May 2012,
<http://www.w3.org/TR/2012/CR-webmessaging-20120501/>.
[webcrypto] [webcrypto]
Dahl, Sleevi, "Web Cryptography API", June 2013. Dahl, Sleevi, "Web Cryptography API", June 2013.
Available at http://www.w3.org/TR/WebCryptoAPI/ Available at http://www.w3.org/TR/WebCryptoAPI/
[webrtc-api] [webrtc-api]
Bergkvist, Burnett, Jennings, Narayanan, "WebRTC 1.0: Bergkvist, Burnett, Jennings, Narayanan, "WebRTC 1.0:
Real-time Communication Between Browsers", October 2011. Real-time Communication Between Browsers", October 2011.
Available at Available at
http://dev.w3.org/2011/webrtc/editor/webrtc.html http://dev.w3.org/2011/webrtc/editor/webrtc.html
8.2. Informative References 8.2. Informative References
[I-D.ietf-rtcweb-jsep] [I-D.ietf-rtcweb-jsep]
Uberti, J. and C. Jennings, "Javascript Session Uberti, J. and C. Jennings, "Javascript Session
Establishment Protocol", draft-ietf-rtcweb-jsep-05 (work Establishment Protocol", draft-ietf-rtcweb-jsep-06 (work
in progress), October 2013. in progress), February 2014.
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
A., Peterson, J., Sparks, R., Handley, M., and E. A., Peterson, J., Sparks, R., Handley, M., and E.
Schooler, "SIP: Session Initiation Protocol", RFC 3261, Schooler, "SIP: Session Initiation Protocol", RFC 3261,
June 2002. June 2002.
[RFC5705] Rescorla, E., "Keying Material Exporters for Transport [RFC5705] Rescorla, E., "Keying Material Exporters for Transport
Layer Security (TLS)", RFC 5705, March 2010. Layer Security (TLS)", RFC 5705, March 2010.
[RFC6455] Fette, I. and A. Melnikov, "The WebSocket Protocol", [RFC6455] Fette, I. and A. Melnikov, "The WebSocket Protocol",
RFC 6455, December 2011. RFC 6455, December 2011.
[XmlHttpRequest] [XmlHttpRequest]
 End of changes. 67 change blocks. 
167 lines changed or deleted 193 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/