Messages - 8. Add Threats and controls

[Nat Sakimura]

At least, the following attacks are missing:

• replay attack
• token substitution attack

They are applicable to code, access_token, id_token, refresh_token.

In particular, explain how 'nonce' helps mitigate some of the problems.

Looking at X.1254 may also help.

[Michael Jones]

Nat will work with Torsten on wording for this

[Nat Sakimura]

Replay has been dealt with http://tools.ietf.org/html/draft-ietf-oauth-v2-threatmodel-06

Token substitution attack is being added to OAuth 2.0 security consideration as Resource Owner Impersonation.

Thus, it is not necessary now to add these to OpenID Connect.

We probably do not want to repeat all the threats and controls in X.1264 | ISO 29115. We could start writing down what the implementation may do as controls, but that will make the security consideration too long. We should just reference it and say appropriate measure should be taken.

Thus, proposed text:

Current:

8.  Security Considerations

OAuth 2.0 Threat Model and Security Considerations [OAuth.Threat] provides an extensive list of threats and controls that applies to this standard as well. In addition, this standard provides additional control measures listed below.

Proposal:

8.  Security Considerations

OAuth 2.0 Threat Model and Security Considerations [OAuth.Threat] provides an extensive list of threats and controls that applies to this standard as well. ITU-T X.1254 | ISO/IEC 29115 also provides threats and controls that implementors should take into account. In addition, this standard provides additional control measures listed below.

[Nat Sakimura]

Fixed #543 - Messages - Security Consideration. Added ref to X.1254 | ISO 29115.

→ 06567cecff76