Subject: [Acme] Add an external secret field to registration

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Wed, 17 Aug 2016 17:51:58 -0700

Here's one version of what it might look like to add the token Andy
proposed:

https://github.com/ietf-wg-acme/acme/pull/172

Let me know what you think!

---

From: Andy Ligg <[email-masked]>
Date: Fri, 19 Aug 2016 11:26:25 +0000

We checked the draft that the  external_secret (optional, string) description is same as Contact.

Another issue we think is how to guarantee this token's security, we plan to limit this token that it will expire at the short time. Please advise, thanks.

Regards,

Andy

> On 18 Aug 2016, at 08:58, Jacob Hoffman-Andrews <[email-masked]> wrote:
>

---

From: Karthikeyan Bhargavan <[email-masked]>
Date: Fri, 19 Aug 2016 08:28:42 -0400

Could you clarify the security goal of the external secret?
Is it meant to be the *only* authentication client an ACME client
needs to present in order to take over some user’s existing StartCom acount?

In that case, this is subject to the same security considerations as account recovery,
and potentially offers significantly lower security than other ACME mechanisms.

Best,
Karthik

> On 19 Aug 2016, at 07:26, Andy Ligg <[email-masked]> wrote:
> 
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme

---

From: Andy Ligg <[email-masked]>
Date: Fri, 19 Aug 2016 13:28:47 +0000

No, not this case.
User must post the token with the right email and certificate to server.
What I mean is StartCom system will send the token to customer's email account, but if this email account info is stolen by hacker, then it can be used to access this token's subscriber's account. My suggestion is limit this token expiration time, any good solution for this issue?

Regards,

Andy

> On 19 Aug 2016, at 20:36, Karthikeyan Bhargavan <[email-masked]> wrote:
>

---

From: Daniel McCarney <[email-masked]>
Date: Fri, 19 Aug 2016 11:29:30 -0400

> We checked the draft that the  external_secret (optional, string)
description is same as Contact.

This was fixed:
https://github.com/ietf-wg-acme/acme/pull/172#discussion_r75344194

On Fri, Aug 19, 2016 at 7:26 AM, Andy Ligg <[email-masked]> wrote:

> Another issue we think is how to guarantee this token's security, we plan
> to limit this token that it will expire at the short time. Please advise,
> thanks.
>
> Regards,
>
> Andy
>

---

From: Daniel McCarney <[email-masked]>
Date: Fri, 19 Aug 2016 12:08:50 -0400

> We checked the draft that the  external_secret (optional, string)
description is same as Contact.

This was fixed: https://github.com/ietf-wg-acme/acme/pull/172#
discussion_r75344194

---

From: Andy Ligg <[email-masked]>
Date: Mon, 22 Aug 2016 01:54:58 +0000

Sorry, the document still not update in “Registration Objects”, still same as Contact.

contact (optional, array of string): : An array of URIs that the server can use to contact the client for issues related to this authorization. For example, the server may wish to notify the client about server-initiated revocation.
external_secret (optional, string): : An array of URIs that the server can use to contact the client for issues related to this authorization. For example, the server may wish to notify the client about server-initiated revocation.

Best Regards,

Andy

From: Daniel McCarney [mailto:[email-masked]]
Sent: Friday, August 19, 2016 11:30 PM
To: Andy Ligg <[email-masked]>
Cc: Jacob Hoffman-Andrews <[email-masked]>; [email-masked]
Subject: Re: [Acme] Add an external secret field to registration

> We checked the draft that the  external_secret (optional, string) description is same as Contact.

This was fixed: https://github.com/ietf-wg-acme/acme/pull/172#discussion_r75344194

On Fri, Aug 19, 2016 at 7:26 AM, Andy Ligg <[email-masked]<mailto:[email-masked]>> wrote:
We checked the draft that the  external_secret (optional, string) description is same as Contact.

Regards,

Andy

> On 18 Aug 2016, at 08:58, Jacob Hoffman-Andrews <[email-masked]<mailto:[email-masked]>> wrote:
>

_______________________________________________
Acme mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/acme