Create security and privacy consideration for FAPI 2.0 Security Profile

[Nat Sakimura]

The content is empty right now.

For the next I-D, we definitely need to have it.

[Nat Sakimura]

It may belong to 4.5 instead, but in the security consideration, it would be good to explain why it was ok to deviate/relax from FAPI 1.0’s design principles: BCM principles, namely:

1. All messages are authenticated.
2. All message sources are authenticated.
3. All message destinations are authenticated.
4. All the messages in a protocol run are threaded using nonce so that replacing any of them will be detected.
5. All messages are distinct so that they are not going to be mixed up with another message within FAPI 1.0 or other protocols.

‌

‌

[Daniel Fett]

We need to say that instead of defining measures (“messages are authenticated”) we are defining the goals (Authentication/Authorization/Session Integrity) as defined in the attacker model.

[Dave Tonge]

for the privacy considerations, do we want to pull in what we had in FAPI 1?

https://openid.net/specs/openid-financial-api-part-2-1_0.html#privacy-considerations

[Dave Tonge]

@Daniel Fett and @Nat Sakimura what do you think about pulling in the same privacy considerations as FAPI 1?

[Daniel Fett]

Yes, that’s a good starting point. I created a PR based on FAPI 1 including some changes: https://bitbucket.org/openid/fapi/pull-requests/359/privacy-considerations-based-on-fapi-1

[Dave Tonge]

PR merged