draft-ietf-rtcweb-security-arch-08.txt		draft-ietf-rtcweb-security-arch-09.txt
	RTCWEB E. Rescorla		RTCWEB E. Rescorla
	Internet-Draft RTFM, Inc.		Internet-Draft RTFM, Inc.
	Intended status: Standards Track January 22, 2014		Intended status: Standards Track February 14, 2014
	Expires: July 26, 2014		Expires: August 18, 2014
	WebRTC Security Architecture		WebRTC Security Architecture
	draft-ietf-rtcweb-security-arch-08		draft-ietf-rtcweb-security-arch-09
	Abstract		Abstract
	The Real-Time Communications on the Web (RTCWEB) working group is		The Real-Time Communications on the Web (RTCWEB) working group is
	tasked with standardizing protocols for enabling real-time		tasked with standardizing protocols for enabling real-time
	communications within user-agents using web technologies (commonly		communications within user-agents using web technologies (commonly
	called "WebRTC"). This document defines the security architecture		called "WebRTC"). This document defines the security architecture
	for		for WebRTC.
	Status of this Memo		Status of this Memo
	This Internet-Draft is submitted in full conformance with the		This Internet-Draft is submitted in full conformance with the
	provisions of BCP 78 and BCP 79.		provisions of BCP 78 and BCP 79.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on July 26, 2014.		This Internet-Draft will expire on August 18, 2014.
	Copyright Notice		Copyright Notice
	Copyright (c) 2014 IETF Trust and the persons identified as the		Copyright (c) 2014 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 2, line 45		skipping to change at page 2, line 45
	5.6. Web-Based Peer Authentication . . . . . . . . . . . . . . 18		5.6. Web-Based Peer Authentication . . . . . . . . . . . . . . 18
	5.6.1. Trust Relationships: IdPs, APs, and RPs . . . . . . . 19		5.6.1. Trust Relationships: IdPs, APs, and RPs . . . . . . . 19
	5.6.2. Overview of Operation . . . . . . . . . . . . . . . . 21		5.6.2. Overview of Operation . . . . . . . . . . . . . . . . 21
	5.6.3. Items for Standardization . . . . . . . . . . . . . . 22		5.6.3. Items for Standardization . . . . . . . . . . . . . . 22
	5.6.4. Binding Identity Assertions to JSEP Offer/Answer		5.6.4. Binding Identity Assertions to JSEP Offer/Answer
	Transactions . . . . . . . . . . . . . . . . . . . . . 22		Transactions . . . . . . . . . . . . . . . . . . . . . 22
	5.6.4.1. Input to Assertion Generation Process . . . . . . 22		5.6.4.1. Input to Assertion Generation Process . . . . . . 22
	5.6.4.2. Carrying Identity Assertions . . . . . . . . . . . 23		5.6.4.2. Carrying Identity Assertions . . . . . . . . . . . 23
	5.6.5. IdP Interaction Details . . . . . . . . . . . . . . . 24		5.6.5. IdP Interaction Details . . . . . . . . . . . . . . . 24
	5.6.5.1. General Message Structure . . . . . . . . . . . . 24		5.6.5.1. General Message Structure . . . . . . . . . . . . 24
	5.6.5.2. IdP Proxy Setup . . . . . . . . . . . . . . . . . 25		5.6.5.2. Errors . . . . . . . . . . . . . . . . . . . . . . 25
	5.7. Security Considerations . . . . . . . . . . . . . . . . . 29		5.6.5.3. IdP Proxy Setup . . . . . . . . . . . . . . . . . 25
	5.7.1. Communications Security . . . . . . . . . . . . . . . 29		5.7. Security Considerations . . . . . . . . . . . . . . . . . 30
	5.7.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . 30		5.7.1. Communications Security . . . . . . . . . . . . . . . 30
	5.7.3. Denial of Service . . . . . . . . . . . . . . . . . . 31		5.7.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . 31
	5.7.4. IdP Authentication Mechanism . . . . . . . . . . . . . 32		5.7.3. Denial of Service . . . . . . . . . . . . . . . . . . 32
	5.7.4.1. PeerConnection Origin Check . . . . . . . . . . . 32		5.7.4. IdP Authentication Mechanism . . . . . . . . . . . . . 33
	5.7.4.2. IdP Well-known URI . . . . . . . . . . . . . . . . 33		5.7.4.1. PeerConnection Origin Check . . . . . . . . . . . 33
			5.7.4.2. IdP Well-known URI . . . . . . . . . . . . . . . . 34
	5.7.4.3. Privacy of IdP-generated identities and the		5.7.4.3. Privacy of IdP-generated identities and the
	hosting site . . . . . . . . . . . . . . . . . . . 33		hosting site . . . . . . . . . . . . . . . . . . . 34
	5.7.4.4. Security of Third-Party IdPs . . . . . . . . . . . 34		5.7.4.4. Security of Third-Party IdPs . . . . . . . . . . . 34
	5.7.4.5. Web Security Feature Interactions . . . . . . . . 34		5.7.4.5. Web Security Feature Interactions . . . . . . . . 34
	5.8. IANA Considerations . . . . . . . . . . . . . . . . . . . 34		5.8. IANA Considerations . . . . . . . . . . . . . . . . . . . 35
	6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 35		6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 35
	7. Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 35		7. Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
	7.1. Changes since -06 . . . . . . . . . . . . . . . . . . . . 35		7.1. Changes since -06 . . . . . . . . . . . . . . . . . . . . 35
	7.2. Changes since -05 . . . . . . . . . . . . . . . . . . . . 35		7.2. Changes since -05 . . . . . . . . . . . . . . . . . . . . 36
	7.3. Changes since -03 . . . . . . . . . . . . . . . . . . . . 35		7.3. Changes since -03 . . . . . . . . . . . . . . . . . . . . 36
	7.4. Changes since -03 . . . . . . . . . . . . . . . . . . . . 35		7.4. Changes since -03 . . . . . . . . . . . . . . . . . . . . 36
	7.5. Changes since -02 . . . . . . . . . . . . . . . . . . . . 36		7.5. Changes since -02 . . . . . . . . . . . . . . . . . . . . 36
	8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 36		8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 36
	8.1. Normative References . . . . . . . . . . . . . . . . . . . 36		8.1. Normative References . . . . . . . . . . . . . . . . . . . 36
	8.2. Informative References . . . . . . . . . . . . . . . . . . 37		8.2. Informative References . . . . . . . . . . . . . . . . . . 38
	Appendix A. Example IdP Bindings to Specific Protocols . . . . . 38		Appendix A. Example IdP Bindings to Specific Protocols . . . . . 39
	A.1. BrowserID . . . . . . . . . . . . . . . . . . . . . . . . 38		A.1. BrowserID . . . . . . . . . . . . . . . . . . . . . . . . 39
	A.2. OAuth . . . . . . . . . . . . . . . . . . . . . . . . . . 41		A.2. OAuth . . . . . . . . . . . . . . . . . . . . . . . . . . 42
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 42		Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 43
	1. Introduction		1. Introduction
	The Real-Time Communications on the Web (WebRTC) working group is		The Real-Time Communications on the Web (WebRTC) working group is
	tasked with standardizing protocols for real-time communications		tasked with standardizing protocols for real-time communications
	between Web browsers. The major use cases for WebRTC technology are		between Web browsers. The major use cases for WebRTC technology are
	real-time audio and/or video calls, Web conferencing, and direct data		real-time audio and/or video calls, Web conferencing, and direct data
	transfer. Unlike most conventional real-time systems, (e.g., SIP-		transfer. Unlike most conventional real-time systems, (e.g., SIP-
	based[RFC3261] soft phones) WebRTC communications are directly		based[RFC3261] soft phones) WebRTC communications are directly
	controlled by some Web server, via a JavaScript (JS) API as shown in		controlled by some Web server, via a JavaScript (JS) API as shown in
	skipping to change at page 22, line 11		skipping to change at page 22, line 11
	1. The browser (the PeerConnection component) instantiates an IdP		1. The browser (the PeerConnection component) instantiates an IdP
	proxy with its source at the IdP. This allows the IdP to load		proxy with its source at the IdP. This allows the IdP to load
	whatever JS is necessary into the proxy, which runs in the IdP's		whatever JS is necessary into the proxy, which runs in the IdP's
	security context.		security context.
	2. If the user is not already logged in, the IdP does whatever is		2. If the user is not already logged in, the IdP does whatever is
	required to log them in, such as soliciting a username and		required to log them in, such as soliciting a username and
	password.		password.
	3. Once the user is logged in, the IdP proxy notifies the browser		3. Once the user is logged in, the IdP proxy notifies the browser
	that it is ready.		that it is ready.
	4. The browser and the IdP proxy communicate via a standardized		4. The browser and the IdP proxy communicate via a standardized
	series of messages delivered via postMessage. For instance, the		series of messages delivered via a MessageChannel [WebMessaging].
	browser might request the IdP proxy to sign or verify a given		For instance, the browser might request the IdP proxy to sign or
	identity assertion.		verify a given identity assertion.
	This approach allows us to decouple the browser from any particular		This approach allows us to decouple the browser from any particular
	identity provider; the browser need only know how to load the IdP's		identity provider; the browser need only know how to load the IdP's
	JavaScript--which is deterministic from the IdP's identity--and the		JavaScript--which is deterministic from the IdP's identity--and the
	generic protocol for requesting and verifying assertions. The IdP		generic protocol for requesting and verifying assertions. The IdP
	provides whatever logic is necessary to bridge the generic protocol		provides whatever logic is necessary to bridge the generic protocol
	to the IdP's specific requirements. Thus, a single browser can		to the IdP's specific requirements. Thus, a single browser can
	support any number of identity protocols, including being forward		support any number of identity protocols, including being forward
	compatible with IdPs which did not exist at the time the browser was		compatible with IdPs which did not exist at the time the browser was
	written.		written.
	skipping to change at page 22, line 46		skipping to change at page 22, line 46
	specify the IdP to use to generate assertions and to discover what		specify the IdP to use to generate assertions and to discover what
	assertions were received.		assertions were received.
	The first two items are defined in this document. The final one is		The first two items are defined in this document. The final one is
	defined in the companion W3C WebRTC API specification [webrtc-api].		defined in the companion W3C WebRTC API specification [webrtc-api].
	5.6.4. Binding Identity Assertions to JSEP Offer/Answer Transactions		5.6.4. Binding Identity Assertions to JSEP Offer/Answer Transactions
	5.6.4.1. Input to Assertion Generation Process		5.6.4.1. Input to Assertion Generation Process
	As discussed above, an identity assertion binds the user's identity		An identity assertion binds the user's identity (as asserted by the
	(as asserted by the IdP) to the JSEP offer/exchange transaction and		IdP) to the JSEP offer/exchange transaction and specifically to the
	specifically to the media. In order to achieve this, the		media. In order to achieve this, the PeerConnection must provide the
	PeerConnection must provide the DTLS-SRTP fingerprint to be bound to		DTLS-SRTP fingerprint to be bound to the identity. This is provided
	the identity. This is provided in a JSON structure for		as a JavaScript object (also known as a dictionary or hash) with a
	extensibility, as shown below:		single "fingerprint" key, as shown below:
	{		{
	"fingerprint" :		"fingerprint": {
	{		"algorithm": "sha-256",
	"algorithm":"SHA-1",		"digest": "4A:AD:B9:B1:3F:...:E5:7C:AB"
	"digest":"4A:AD:B9:B1:3F:...:E5:7C:AB"
	}		}
	}		}
	The "algorithm" and digest values correspond directly to the		This object is encoded in a JSON [RFC4627] string for passing to the
			IdP.
			The "algorithm" and "digest" values correspond directly to the
	algorithm and digest values in the a=fingerprint line of the SDP.		algorithm and digest values in the a=fingerprint line of the SDP.
	[RFC4572].		[RFC4572].
	Note: this structure does not need to be interpreted by the IdP or		Note: this structure does not need to be interpreted by the IdP or
	the IdP proxy. It is consumed solely by the RP's browser. The IdP		the IdP proxy. It is consumed solely by the RP's browser. The IdP
	merely treats it as an opaque value to be attested to. Thus, new		merely treats it as an opaque value to be attested to. Thus, new
	parameters can be added to the assertion without modifying the IdP.		parameters can be added to the assertion without modifying the IdP.
	5.6.4.2. Carrying Identity Assertions		5.6.4.2. Carrying Identity Assertions
	Once an IdP has generated an assertion, it is attached to the JSEP		Once an IdP has generated an assertion, it is attached to the SDP
	message. This is done by adding a new a-line to the SDP, of the form		message. This is done by adding a new a-line to the SDP, of the form
	a=identity. The sole contents of this value are a base-64-encoded		a=identity. The sole contents of this value are a base-64 encoded
	version of the identity assertion. For example:		[RFC4848] identity assertion. For example:
	v=0		v=0
	o=- 1181923068 1181923196 IN IP4 ua1.example.com		o=- 1181923068 1181923196 IN IP4 ua1.example.com
	s=example1		s=example1
	c=IN IP4 ua1.example.com		c=IN IP4 ua1.example.com
	a=setup:actpass		a=setup:actpass
	a=fingerprint:sha-1 \		a=fingerprint:sha-1 \
	4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E:5D:49:6B:19:E5:7C:AB		4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E:5D:49:6B:19:E5:7C:AB
	a=identity:\		a=identity:\
	ImlkcCI6eyJkb21haW4iOiAiZXhhbXBsZS5vcmciLCAicHJvdG9jb2wiOiAiYm9n\		ImlkcCI6eyJkb21haW4iOiAiZXhhbXBsZS5vcmciLCAicHJvdG9jb2wiOiAiYm9n\
	dXMifSwiYXNzZXJ0aW9uIjpcIntcImlkZW50aXR5XCI6XCJib2JAZXhhbXBsZS5v\		dXMifSwiYXNzZXJ0aW9uIjpcIntcImlkZW50aXR5XCI6XCJib2JAZXhhbXBsZS5v\
	cmdcIixcImNvbnRlbnRzXCI6XCJhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3l6XCIs\		cmdcIixcImNvbnRlbnRzXCI6XCJhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3l6XCIs\
	XCJzaWduYXR1cmVcIjpcIjAxMDIwMzA0MDUwNlwifSJ9Cg==		XCJzaWduYXR1cmVcIjpcIjAxMDIwMzA0MDUwNlwifSJ9Cg==
	t=0 0		t=0 0
	m=audio 6056 RTP/SAVP 0		m=audio 6056 RTP/SAVP 0
	a=sendrecv		a=sendrecv
	...		...
	Each identity attribute should be paired (and attests to) with an		Each identity attribute should be paired (and attests to) with an
	a=fingerprint attribute and therefore can exist either at the session		"a=fingerprint" attribute and therefore can exist either at the
	or media level. Multiple identity attributes may appear at either		session or media level. Multiple identity attributes may appear at
	level, though it is RECOMMENDED that implementations not do this,		either level, though it is RECOMMENDED that implementations not do
	because it becomes very unclear what security claim that they are		this, because it becomes very unclear what security claim that they
	making and the UI guidelines above become unclear. Browsers MAY		are making and the UI guidelines above become unclear. Browsers MAY
	choose refuse to display any identity indicators in the face of		choose refuse to display any identity indicators in the face of
	multiple identity attributes with different identities but SHOULD		multiple identity attributes with different identities but SHOULD
	process multiple attributes with the same identity as described		process multiple attributes with the same identity as described
	above.		above.
			TODO: write up paragraph on the consequences of multiple
			a=fingerprint attributes.
	5.6.5. IdP Interaction Details		5.6.5. IdP Interaction Details
	5.6.5.1. General Message Structure		5.6.5.1. General Message Structure
	Messages between the PeerConnection object and the IdP proxy are		Messages between the PeerConnection object and the IdP proxy are
	formatted using JSON [RFC4627]. For instance, the PeerConnection		JavaScript objects, shown in examples using JSON [RFC4627]. For
	would request a signature with the following "SIGN" message:		instance, the PeerConnection would request a signature with the
			following "SIGN" message:
	{		{
	"type":"SIGN",		"type": "SIGN",
	"id": "1",		"id": "1",
	"origin":"https://calling-site.example.com",		"origin": "https://calling-site.example.com",
	"message":"012345678abcdefghijkl"		"message": "012345678abcdefghijkl"
	}		}
	All messages MUST contain a "type" field which indicates the general		All messages MUST contain a "type" field which indicates the general
	meaning of the message.		meaning of the message.
	All requests from the PeerConnection object MUST contain an "id"		All requests from the PeerConnection object MUST contain an "id"
	field which MUST be unique for that PeerConnection object. Any		field which MUST be unique within the scope of the interaction
	responses from the IdP proxy MUST contain the same id in response,		between the browser and the IdP instance. Responses from the IdP
	which allows the PeerConnection to correlate requests and responses,		proxy MUST contain the same "id" in response, which allows the
	in case there are multiple requests/responses outstanding to the same		PeerConnection to correlate requests and responses, in case there are
	proxy.		multiple requests/responses outstanding to the same proxy.
	All requests from the PeerConnection object MUST contain an "origin"		All requests from the PeerConnection object MUST contain an "origin"
	field containing the origin of the JS which initiated the PC (i.e.,		field containing the origin of the JS which initiated the PC (i.e.,
	the URL of the calling site). This origin value can be used by the		the URL of the calling site). This origin value can be used by the
	IdP to make access control decisions. For instance, an IdP might		IdP to make access control decisions. For instance, an IdP might
	only issue identity assertions for certain calling services in the		only issue identity assertions for certain calling services in the
	same way that some IdPs require that relying Web sites have an API		same way that some IdPs require that relying Web sites have an API
	key before learning user identity.		key before learning user identity.
	Any message-specific data is carried in a "message" field. Depending		Any message-specific data is carried in a "message" field. Depending
	on the message type, this may either be a string or a richer JSON		on the message type, this may either be a string or any JavaScript
	object.		object that can be conveyed in a message channel. This includes any
			object that is able to be serialized to JSON.
	5.6.5.1.1. Errors		5.6.5.2. Errors
	If an error occurs, the IdP sends a message of type "ERROR". The		If an error occurs, the IdP sends a message of type "ERROR". The
	message MAY have an "error" field containing freeform text data which		message MAY have an "error" field containing freeform text data which
	containing additional information about what happened. For instance:		containing additional information about what happened. For instance:
	{		{
	"id":"1",		"type": "ERROR",
	"type":"ERROR",		"id": "1",
	"error":"Signature verification failed"		"error": "Signature verification failed"
	}		}
	Figure 5: Example error		Figure 5: Example error
	5.6.5.2. IdP Proxy Setup		5.6.5.3. IdP Proxy Setup
	In order to perform an identity transaction, the PeerConnection must		In order to perform an identity transaction, the PeerConnection must
	first create an IdP proxy. While the details of this are specified		first create an IdP proxy. While the details of this are specified
	in the W3C API document, from the perspective of this specification,		in the W3C API document, from the perspective of this specification,
	however, the relevant facts are:		however, the relevant facts are:
	o The JS runs in the IdP's security context with the base page		o The JS runs in the IdP's security context with the base page
	retrieved from the URL specified in Section 5.6.5.2.1		retrieved from the URL specified in Section 5.6.5.3.1.
	o The usual browser sandbox isolation mechanisms MUST be enforced		o The usual browser sandbox isolation mechanisms MUST be enforced
	with respect to the IdP proxy.		with respect to the IdP proxy. The IdP cannot be provided with
			escalated privileges.
	o JS running in the IdP proxy MUST be able to send and receive		o JS running in the IdP proxy MUST be able to send and receive
	messages to the PeerConnection and the PC and IdP proxy are able		messages to the PeerConnection and the PC and IdP proxy are able
	to verify the source and destination of these messages.		to verify the source and destination of these messages.
			o The IdP proxy is unable to interact with the user. This includes
			the creation of popup windows and dialogs.
	Initially the IdP proxy is in an unready state; the IdP JS must be		Initially the IdP proxy is in an unready state; the IdP JS must be
	loaded and there may be several round trips to the IdP server, for		loaded and there may be several round trips to the IdP server to load
	instance to log the user in. When the IdP proxy is ready to receive		and prepare necessary resources.
	commands, it delivers a "ready" message. As this message is
	unsolicited, it simply contains:
	{ "type":"READY" }		When the IdP proxy is ready to receive commands, it delivers a
			"READY" message. As this message is unsolicited, it contains only
			the "type":
			{ "type":"READY" }
	Once the PeerConnection object receives the ready message, it can		Once the PeerConnection object receives the ready message, it can
	send commands to the IdP proxy.		send commands to the IdP proxy.
	5.6.5.2.1. Determining the IdP URI		5.6.5.3.1. Determining the IdP URI
	In order to ensure that the IdP is under control of the domain owner		In order to ensure that the IdP is under control of the domain owner
	rather than someone who merely has an account on the domain owner's		rather than someone who merely has an account on the domain owner's
	server (e.g., in shared hosting scenarios), the IdP JavaScript is		server (e.g., in shared hosting scenarios), the IdP JavaScript is
	hosted at a deterministic location based on the IdP's domain name.		hosted at a deterministic location based on the IdP's domain name.
	Each IdP proxy instance is associated with two values:		Each IdP proxy instance is associated with two values:
	domain name: The IdP's domain name		domain name: The IdP's domain name
	protocol: The specific IdP protocol which the IdP is using. This is		protocol: The specific IdP protocol which the IdP is using. This is
	a completely IdP-specific string, but allows an IdP to implement		a completely IdP-specific string, but allows an IdP to implement
	two protocols in parallel. This value may be the empty string.		two protocols in parallel. This value may be the empty string.
	Each IdP MUST serve its initial entry page (i.e., the one loaded by		Each IdP MUST serve its initial entry page (i.e., the one loaded by
	the IdP proxy) from the well-known URI specified in "/.well-known/		the IdP proxy) from a well-known URI [RFC5785]. The well-known URI
	idp-proxy/<protocol>" on the IdP's web site. This URI MUST be loaded		for an IdP proxy is formed from the following URI components:
	via HTTPS [RFC2818]. For example, for the IdP "identity.example.com"		1. The scheme, "https:". An IdP MUST be loaded using HTTPS
	and the protocol "example", the URL would be:		[RFC2818].
			2. The authority, which is the IdP domain name. The authority MAY
			contain a non-default port number. Any port number is removed
			when determining if an asserted identity matches the name of the
			IdP. The authority MUST NOT include a userinfo sub-component.
			3. The path, starting with "/.well-known/idp-proxy/" and appended
			with the IdP protocol. Note that the separator characters '/'
			(%2F) and '\' (%5C) MUST NOT be permitted in the protocol field,
			lest an attacker be able to direct requests outside of the
			controlled "/.well-known/" prefix. Query and fragment values MAY
			be used by including '?' or '#' characters.
			For example, for the IdP "identity.example.com" and the protocol
			"example", the URL would be:
	https://example.com/.well-known/idp-proxy/example		https://example.com/.well-known/idp-proxy/example
	5.6.5.2.1.1. Authenticating Party		5.6.5.3.1.1. Authenticating Party
	How an AP determines the appropriate IdP domain is out of scope of		How an AP determines the appropriate IdP domain is out of scope of
	this specification. In general, however, the AP has some actual		this specification. In general, however, the AP has some actual
	account relationship with the IdP, as this identity is what the IdP		account relationship with the IdP, as this identity is what the IdP
	is attesting to. Thus, the AP somehow supplies the IdP information		is attesting to. Thus, the AP somehow supplies the IdP information
	to the browser. Some potential mechanisms include:		to the browser. Some potential mechanisms include:
	o Provided by the user directly.		o Provided by the user directly.
	o Selected from some set of IdPs known to the calling site. E.g., a		o Selected from some set of IdPs known to the calling site. E.g., a
	button that shows "Authenticate via Facebook Connect"		button that shows "Authenticate via Facebook Connect"
	5.6.5.2.1.2. Relying Party		5.6.5.3.1.2. Relying Party
	Unlike the AP, the RP need not have any particular relationship with		Unlike the AP, the RP need not have any particular relationship with
	the IdP. Rather, it needs to be able to process whatever assertion		the IdP. Rather, it needs to be able to process whatever assertion
	is provided by the AP. As the assertion contains the IdP's identity,		is provided by the AP. As the assertion contains the IdP's identity,
	the URI can be constructed directly from the assertion, and thus the		the URI can be constructed directly from the assertion, and thus the
	RP can directly verify the technical validity of the assertion with		RP can directly verify the technical validity of the assertion with
	no user interaction. Authoritative assertions need only be		no user interaction. Authoritative assertions need only be
	verifiable. Third-party assertions also MUST be verified against		verifiable. Third-party assertions also MUST be verified against
	local policy, as described in Section 5.6.5.2.3.1.		local policy, as described in Section 5.6.5.3.3.1.
	5.6.5.2.2. Requesting Assertions		5.6.5.3.2. Requesting Assertions
	In order to request an assertion, the PeerConnection sends a "SIGN"		In order to request an assertion, the PeerConnection sends a "SIGN"
	message. Aside from the mandatory fields, this message has a		message. Aside from the mandatory fields, this message has a
	"message" field containing a string. The contents of this string are		"message" field containing a string. The string contains a JSON-
	defined above, but are opaque from the perspective of the IdP.		encoded object containing certificate fingerprints but are treated as
			opaque from the perspective of the IdP.
	A successful response to a "SIGN" message contains a message field		A successful response to a "SIGN" message contains a "message" field
	which is a JS dictionary consisting of two fields:		which is a JavaScript dictionary consisting of two fields:
	idp: A dictionary containing the domain name of the provider and the		idp: A dictionary containing the domain name of the provider and the
	protocol string		protocol string.
	assertion: An opaque field containing the assertion itself. This is		assertion: An opaque value containing the assertion itself. This is
	only interpretable by the idp or its proxy.		only interpretable by the IdP or its proxy.
	Figure 6 shows an example transaction, with the message "abcde..."		Figure 6 shows an example transaction, with the message "abcde..."
	(remember, the messages are opaque at this layer) being signed and		(remember, the messages are opaque at this layer) being signed and
	bound to identity "ekr@example.org". In this case, the message has		bound to identity "ekr@example.org". In this case, the message has
	presumably been digitally signed/MACed in some way that the IdP can		presumably been digitally signed/MACed in some way that the IdP can
	later verify it, but this is an implementation detail and out of		later verify it, but this is an implementation detail and out of
	scope of this document. Line breaks are inserted solely for		scope of this document. Line breaks are inserted solely for
	readability.		readability.
	PeerConnection -> IdP proxy:		PeerConnection -> IdP proxy:
	{		{
	"type":"SIGN",		"type": "SIGN",
	"id":1,		"id": "1",
	"origin":"https://calling-service.example.com/",		"origin": "https://calling-service.example.com/",
	"message":"abcdefghijklmnopqrstuvwyz"		"message": "abcdefghijklmnopqrstuvwyz"
	}		}
	IdPProxy -> PeerConnection:		IdPProxy -> PeerConnection:
	{		{
	"type":"SUCCESS",		"type": "SUCCESS",
	"id":1,		"id": "1",
	"message": {		"message": {
	"idp":{		"idp":{
	"domain": "example.org"		"domain": "example.org"
	"protocol": "bogus"		"protocol": "bogus"
	},		},
	"assertion": "{\"identity\":\"bob@example.org\",		"assertion": "{\"identity\":\"bob@example.org\",
	\"contents\":\"abcdefghijklmnopqrstuvwyz\",		\"contents\":\"abcdefghijklmnopqrstuvwyz\",
	\"request_origin\":\"rtcweb://peerconnection\",
	\"signature\":\"010203040506\"}"		\"signature\":\"010203040506\"}"
	}		}
	}		}
	Figure 6: Example assertion request		Figure 6: Example assertion request
	The message structure is serialized, base64-encoded, and placed in an		The "message" structure is serialized into JSON, base64-encoded
	a=identity attribute.		[RFC4848], and placed in an "a=identity" attribute.
	5.6.5.2.3. Verifying Assertions		5.6.5.3.3. Verifying Assertions
	In order to verify an assertion, an RP sends a "VERIFY" message to		In order to verify an assertion, an RP sends a "VERIFY" message to
	the IdP proxy containing the assertion supplied by the AP in the		the IdP proxy containing the assertion supplied by the AP in the
	"message" field.		"message" field.
	The IdP proxy verifies the assertion. Depending on the identity		The IdP proxy verifies the assertion. Depending on the identity
	protocol, this may require one or more round trips to the IdP. For		protocol, the proxy might contact the IdP server or other servers.
	instance, an OAuth-based protocol will likely require using the IdP		For instance, an OAuth-based protocol will likely require using the
	as an oracle, whereas with BrowserID the IdP proxy can likely verify		IdP as an oracle, whereas with BrowserID the IdP proxy can likely
	the signature on the assertion without contacting the IdP, provided		verify the signature on the assertion without contacting the IdP,
	that it has cached the IdP's public key.		provided that it has cached the IdP's public key.
	Regardless of the mechanism, if verification succeeds, a successful		Regardless of the mechanism, if verification succeeds, a successful
	response from the IdP proxy MUST contain a message field consisting		response from the IdP proxy MUST contain a message field consisting
	of a dictionary/hash with the following fields:		of a object with the following fields:
	identity The identity of the AP from the IdP's perspective. Details		identity: The identity of the AP from the IdP's perspective.
	of this are provided in Section 5.6.5.2.3.1		Details of this are provided in Section 5.6.5.3.3.1.
	contents The original unmodified string provided by the AP in the		contents: The original unmodified string provided by the AP in the
	original SIGN request.		original SIGN request.
	request_origin The original origin of the SIGN request on the AP
	side as determined by the origin of the PostMessage call. The IdP
	MUST somehow arrange to propagate this information as part of the
	assertion. The receiving PeerConnection MUST verify that this
	value is "rtcweb://peerconnection" (which implies that
	PeerConnection must arrange that its messages to the IdP proxy are
	from this origin.) See Section 5.7.4.1 for the security purpose
	of this field. [[ OPEN ISSUE: Can a URI person help make a better
	URI.]]
	Figure 7 shows an example transaction. Line breaks are inserted		Figure 7 shows an example transaction. Line breaks are inserted
	solely for readability.		solely for readability.
	PeerConnection -> IdP Proxy:		PeerConnection -> IdP Proxy:
	{		{
	"type":"VERIFY",		"type": "VERIFY",
	"id":2,		"id": 2,
	"origin":"https://calling-service.example.com/",		"origin": "https://calling-service.example.com/",
	"message":\"{\"identity\":\"bob@example.org\",		"message": "{\"identity\":\"bob@example.org\",
	\"contents\":\"abcdefghijklmnopqrstuvwyz\",		\"contents\":\"abcdefghijklmnopqrstuvwyz\",
	\"request_origin\":\"rtcweb://peerconnection\",
	\"signature\":\"010203040506\"}"		\"signature\":\"010203040506\"}"
	}		}
	IdP Proxy -> PeerConnection:		IdP Proxy -> PeerConnection:
	{		{
	"type":"SUCCESS",		"type": "SUCCESS",
	"id":2,		"id": 2,
	"message": {		"message": {
	"identity" : {		"identity": "bob@example.org",
	"name" : "bob@example.org",		"contents": "abcdefghijklmnopqrstuvwyz"
	"displayname" : "Bob"
	},
	"request_origin":"rtcweb://peerconnection",
	"contents":"abcdefghijklmnopqrstuvwyz"
	}		}
	}		}
	Figure 7: Example verification request		Figure 7: Example verification request
	5.6.5.2.3.1. Identity Formats		5.6.5.3.3.1. Identity Formats
	Identities passed from the IdP proxy to the PeerConnection are		Identities passed from the IdP proxy to the PeerConnection are passed
	structured as JSON dictionaries with one mandatory field: "name".		in the "identity" field. This field MUST consist of a string
	This field MUST consist of an RFC822-formatted string representing		representing the user's identity. This string is in the form
	the user's identity. [[ OPEN ISSUE: Would it be better to have a		"<user>@<domain>", where "user" consists of any character except '@',
	typed field? ]] The PeerConnection API MUST check this string as		and domain is an internationalized domain name [RFC5890].
	follows:
	1. If the RHS of the string is equal to the domain name of the IdP		The PeerConnection API MUST check this string as follows:
	proxy, then the assertion is valid, as the IdP is authoritative		1. If the domain portion of the string is equal to the domain name
	for this domain.		of the IdP proxy, then the assertion is valid, as the IdP is
	2. If the RHS of the string is not equal to the domain name of the		authoritative for this domain. Comparison of domain names is
	IdP proxy, then the PeerConnection object MUST reject the		done using the label equivalence rule defined in Section 2.3.2.4
	assertion unless (a) the IdP domain is listed as an acceptable		of [RFC5890].
	third-party IdP and (b) local policy is configured to trust this		2. If the domain portion of the string is not equal to the domain
	IdP domain for the RHS of the identity string.		name of the IdP proxy, then the PeerConnection object MUST reject
			the assertion unless:
			1. the IdP domain is trusted as an acceptable third-party IdP;
			and
			2. local policy is configured to trust this IdP domain for the
			RHS of the identity string.
	Sites which have identities that do not fit into the RFC822 style		Sites which have identities that do not fit into the RFC822 style
	(for instance, Facebook ids are simple numeric values) SHOULD convert		(for instance, identifiers that are simple numeric values, or values
	them to this form by appending their IdP domain (e.g.,		that contain '@' characters) SHOULD convert them to this form by
	12345@identity.facebook.com), thus ensuring that they are		escaping illegal characters and appending their IdP domain (e.g.,
			user%40133@identity.example.com), thus ensuring that they are
	authoritative for the identity.		authoritative for the identity.
	The IdP proxy MAY also include a "displayname" field which contains a
	more user-friendly identity assertion. Browsers SHOULD take care in
	the UI to distinguish the "name" assertion which is verifiable
	directly from the "displayname" which cannot be verified and thus
	relies on trust in the IdP. In future, we may define other fields to
	allow the IdP to provide more information to the browser. [[OPEN
	ISSUE: Should this field exist? Is it confusing? ]]
	5.7. Security Considerations		5.7. Security Considerations
	Much of the security analysis of this problem is contained in		Much of the security analysis of this problem is contained in
	[I-D.ietf-rtcweb-security] or in the discussion of the particular		[I-D.ietf-rtcweb-security] or in the discussion of the particular
	issues above. In order to avoid repetition, this section focuses on		issues above. In order to avoid repetition, this section focuses on
	(a) residual threats that are not addressed by this document and (b)		(a) residual threats that are not addressed by this document and (b)
	threats produced by failure/misbehavior of one of the components in		threats produced by failure/misbehavior of one of the components in
	the system.		the system.
	5.7.1. Communications Security		5.7.1. Communications Security
	skipping to change at page 33, line 30		skipping to change at page 34, line 8
	Note that this check only asserts that the browser (or some other		Note that this check only asserts that the browser (or some other
	entity with access to the user's authentication data) attests to the		entity with access to the user's authentication data) attests to the
	request and hence to the fingerprint. It does not demonstrate that		request and hence to the fingerprint. It does not demonstrate that
	the browser has access to the associated private key. However,		the browser has access to the associated private key. However,
	attaching one's identity to a key that the user does not control does		attaching one's identity to a key that the user does not control does
	not appear to provide substantial leverage to an attacker, so a proof		not appear to provide substantial leverage to an attacker, so a proof
	of possession is omitted for simplicity.		of possession is omitted for simplicity.
	5.7.4.2. IdP Well-known URI		5.7.4.2. IdP Well-known URI
	As described in Section 5.6.5.2.1 the IdP proxy HTML/JS landing page		As described in Section 5.6.5.3.1 the IdP proxy HTML/JS landing page
	is located at a well-known URI based on the IdP's domain name. This		is located at a well-known URI based on the IdP's domain name. This
	requirement prevents an attacker who can write some resources at the		requirement prevents an attacker who can write some resources at the
	IdP (e.g., on one's Facebook wall) from being able to impersonate the		IdP (e.g., on one's Facebook wall) from being able to impersonate the
	IdP.		IdP.
	5.7.4.3. Privacy of IdP-generated identities and the hosting site		5.7.4.3. Privacy of IdP-generated identities and the hosting site
	Depending on the structure of the IdP's assertions, the calling site		Depending on the structure of the IdP's assertions, the calling site
	may learn the user's identity from the perspective of the IdP. In		may learn the user's identity from the perspective of the IdP. In
	many cases this is not an issue because the user is authenticating to		many cases this is not an issue because the user is authenticating to
	skipping to change at page 36, line 28		skipping to change at page 37, line 10
	8.1. Normative References		8.1. Normative References
	[I-D.ietf-avtcore-6222bis]		[I-D.ietf-avtcore-6222bis]
	Begen, A., Perkins, C., Wing, D., and E. Rescorla,		Begen, A., Perkins, C., Wing, D., and E. Rescorla,
	"Guidelines for Choosing RTP Control Protocol (RTCP)		"Guidelines for Choosing RTP Control Protocol (RTCP)
	Canonical Names (CNAMEs)", draft-ietf-avtcore-6222bis-06		Canonical Names (CNAMEs)", draft-ietf-avtcore-6222bis-06
	(work in progress), July 2013.		(work in progress), July 2013.
	[I-D.ietf-rtcweb-security]		[I-D.ietf-rtcweb-security]
	Rescorla, E., "Security Considerations for WebRTC",		Rescorla, E., "Security Considerations for WebRTC",
	draft-ietf-rtcweb-security-05 (work in progress),		draft-ietf-rtcweb-security-06 (work in progress),
	July 2013.		January 2014.
	[I-D.ietf-tsvwg-sctp-dtls-encaps]		[I-D.ietf-tsvwg-sctp-dtls-encaps]
	Tuexen, M., Stewart, R., Jesup, R., and S. Loreto, "DTLS		Tuexen, M., Stewart, R., Jesup, R., and S. Loreto, "DTLS
	Encapsulation of SCTP Packets",		Encapsulation of SCTP Packets",
	draft-ietf-tsvwg-sctp-dtls-encaps-02 (work in progress),		draft-ietf-tsvwg-sctp-dtls-encaps-03 (work in progress),
	October 2013.		February 2014.
	[I-D.muthu-behave-consent-freshness]		[I-D.muthu-behave-consent-freshness]
	Perumal, M., Wing, D., R, R., and T. Reddy, "STUN Usage		Perumal, M., Wing, D., R, R., and T. Reddy, "STUN Usage
	for Consent Freshness",		for Consent Freshness",
	draft-muthu-behave-consent-freshness-04 (work in		draft-muthu-behave-consent-freshness-04 (work in
	progress), July 2013.		progress), July 2013.
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, March 1997.		Requirement Levels", BCP 14, RFC 2119, March 1997.
	skipping to change at page 37, line 15		skipping to change at page 37, line 44
	[RFC4347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer		[RFC4347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer
	Security", RFC 4347, April 2006.		Security", RFC 4347, April 2006.
	[RFC4572] Lennox, J., "Connection-Oriented Media Transport over the		[RFC4572] Lennox, J., "Connection-Oriented Media Transport over the
	Transport Layer Security (TLS) Protocol in the Session		Transport Layer Security (TLS) Protocol in the Session
	Description Protocol (SDP)", RFC 4572, July 2006.		Description Protocol (SDP)", RFC 4572, July 2006.
	[RFC4627] Crockford, D., "The application/json Media Type for		[RFC4627] Crockford, D., "The application/json Media Type for
	JavaScript Object Notation (JSON)", RFC 4627, July 2006.		JavaScript Object Notation (JSON)", RFC 4627, July 2006.
			[RFC4848] Daigle, L., "Domain-Based Application Service Location
			Using URIs and the Dynamic Delegation Discovery Service
			(DDDS)", RFC 4848, April 2007.
	[RFC5245] Rosenberg, J., "Interactive Connectivity Establishment		[RFC5245] Rosenberg, J., "Interactive Connectivity Establishment
	(ICE): A Protocol for Network Address Translator (NAT)		(ICE): A Protocol for Network Address Translator (NAT)
	Traversal for Offer/Answer Protocols", RFC 5245,		Traversal for Offer/Answer Protocols", RFC 5245,
	April 2010.		April 2010.
	[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security		[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
	(TLS) Protocol Version 1.2", RFC 5246, August 2008.		(TLS) Protocol Version 1.2", RFC 5246, August 2008.
	[RFC5763] Fischl, J., Tschofenig, H., and E. Rescorla, "Framework		[RFC5763] Fischl, J., Tschofenig, H., and E. Rescorla, "Framework
	for Establishing a Secure Real-time Transport Protocol		for Establishing a Secure Real-time Transport Protocol
	(SRTP) Security Context Using Datagram Transport Layer		(SRTP) Security Context Using Datagram Transport Layer
	Security (DTLS)", RFC 5763, May 2010.		Security (DTLS)", RFC 5763, May 2010.
	[RFC5764] McGrew, D. and E. Rescorla, "Datagram Transport Layer		[RFC5764] McGrew, D. and E. Rescorla, "Datagram Transport Layer
	Security (DTLS) Extension to Establish Keys for the Secure		Security (DTLS) Extension to Establish Keys for the Secure
	Real-time Transport Protocol (SRTP)", RFC 5764, May 2010.		Real-time Transport Protocol (SRTP)", RFC 5764, May 2010.
			[RFC5785] Nottingham, M. and E. Hammer-Lahav, "Defining Well-Known
			Uniform Resource Identifiers (URIs)", RFC 5785,
			April 2010.
			[RFC5890] Klensin, J., "Internationalized Domain Names for
			Applications (IDNA): Definitions and Document Framework",
			RFC 5890, August 2010.
	[RFC6454] Barth, A., "The Web Origin Concept", RFC 6454,		[RFC6454] Barth, A., "The Web Origin Concept", RFC 6454,
	December 2011.		December 2011.
			[WebMessaging]
			Hickson, "HTML5 Web Messaging", May 2012,
			<http://www.w3.org/TR/2012/CR-webmessaging-20120501/>.
	[webcrypto]		[webcrypto]
	Dahl, Sleevi, "Web Cryptography API", June 2013.		Dahl, Sleevi, "Web Cryptography API", June 2013.
	Available at http://www.w3.org/TR/WebCryptoAPI/		Available at http://www.w3.org/TR/WebCryptoAPI/
	[webrtc-api]		[webrtc-api]
	Bergkvist, Burnett, Jennings, Narayanan, "WebRTC 1.0:		Bergkvist, Burnett, Jennings, Narayanan, "WebRTC 1.0:
	Real-time Communication Between Browsers", October 2011.		Real-time Communication Between Browsers", October 2011.
	Available at		Available at
	http://dev.w3.org/2011/webrtc/editor/webrtc.html		http://dev.w3.org/2011/webrtc/editor/webrtc.html
	8.2. Informative References		8.2. Informative References
	[I-D.ietf-rtcweb-jsep]		[I-D.ietf-rtcweb-jsep]
	Uberti, J. and C. Jennings, "Javascript Session		Uberti, J. and C. Jennings, "Javascript Session
	Establishment Protocol", draft-ietf-rtcweb-jsep-05 (work		Establishment Protocol", draft-ietf-rtcweb-jsep-06 (work
	in progress), October 2013.		in progress), February 2014.
	[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,		[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
	A., Peterson, J., Sparks, R., Handley, M., and E.		A., Peterson, J., Sparks, R., Handley, M., and E.
	Schooler, "SIP: Session Initiation Protocol", RFC 3261,		Schooler, "SIP: Session Initiation Protocol", RFC 3261,
	June 2002.		June 2002.
	[RFC5705] Rescorla, E., "Keying Material Exporters for Transport		[RFC5705] Rescorla, E., "Keying Material Exporters for Transport
	Layer Security (TLS)", RFC 5705, March 2010.		Layer Security (TLS)", RFC 5705, March 2010.
	[RFC6455] Fette, I. and A. Melnikov, "The WebSocket Protocol",		[RFC6455] Fette, I. and A. Melnikov, "The WebSocket Protocol",
	RFC 6455, December 2011.		RFC 6455, December 2011.
	[XmlHttpRequest]		[XmlHttpRequest]
End of changes. 67 change blocks.
	167 lines changed or deleted		193 lines changed or added
This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/