Re: [whatwg/fetch] Update Fetch to support Token Binding. (#325)

vanupam commented on this pull request.



> +attackers to abuse the capabilities the security token grants.
+This method of associating credentials with a user agent is referred to as
+<dfn export id=concept-token-binding>token binding</dfn>.
+
+<p>The technique is described in
+detail in [[TOKBIND-NEGOTIATION]], [[TOKBIND-PROTOCOL]], and [[TOKBIND-HTTPS]].
+
+<p>A <dfn export id=token-binding-id>token binding ID</dfn> is the representation
+of a <a for=/>token binding</a>, as described in
+<a href="https://tools.ietf.org/html/draft-ietf-tokbind-protocol#section-3.2">section 3.2</a>
+of [[TOKBIND-PROTOCOL]].
+
+<p>At a very high level, a user agent negotiates the use of Token Binding when it
+sets up a TLS connection to a server.
+The user agent maintains a Token Binding key store, where it saves different
+<a for=/>token binding ID</a>s to be used with different servers.

A TLS connection can carry traffic for ALL Subject Alternative Names covered by the cert. TB negotiation locks down the version + key parameters that will be used; however, different eTLD+1s will use different Token Binding Ids.

(I will attempt to clarify that in a subsequent pass)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/325#discussion_r106542276