Subject: [Webpush] FW: [webpush-protocol] Sender and client authentication (#44)

From: Brian Raymor <[email-masked]>
Date: Tue, 18 Aug 2015 20:47:11 +0000

Costin opened a new design issue on github - https://github.com/webpush-wg/webpush-protocol/issues/44 - I'm forwarding it to the mailing list for awareness and further discussion.

Peter - are you still considering a draft? Earlier - https://mailarchive.ietf.org/arch/msg/webpush/Io1yymV26nmNy3K4_O01R7vN6dI - you mentioned that you were working on 
an early draft related to:

  > The large open topic for us is encryption, and how this ties in to
  > one-to-many distribution of messages by the push service. Also related to
  > this is the subject of authentication, notably of the sender (application
  > server).

From: Costin Manolache [mailto:[email-masked]] 
Sent: Friday, August 14, 2015 2:57 PM
To: webpush-wg/webpush-protocol <[email-masked]>
Subject: [webpush-protocol] Sender and client authentication (#44)

Push services may require authentication of UA, when they connect to the push service to subscribe or poll, and of application servers.
The spec should define one such mechanism - for example by using a key pair for each UA and for each application server, and using one of the common mechanisms - TLS client auth, JWT tokens - to authenticate.
Using a key pair also allows ApplicationServers to talk with multiple push services using a single identity. 
The key of the sender can be made available to the UA and webapplication by the push service - or can be used as an extra authentication in the encrypted content - for example signing the ephemeral key.
—
Reply to this email directly or view it on GitHub.

---

From: Miguel Garcia <[email-masked]>
Date: Wed, 19 Aug 2015 10:15:54 +0100

Just a quick note to mention that Peter is OOO and will only be back next
week. He is still considering a draft indeed.

On Tue, Aug 18, 2015 at 9:47 PM, Brian Raymor <[email-masked]>
wrote:

> Costin opened a new design issue on github -
> https://github.com/webpush-wg/webpush-protocol/issues/44 - I'm forwarding
> it to the mailing list for awareness and further discussion.
>
> Peter - are you still considering a draft? Earlier -
> https://mailarchive.ietf.org/arch/msg/webpush/Io1yymV26nmNy3K4_O01R7vN6dI
> - you mentioned that you were working on
> Push services may require authentication of UA, when they connect to the
> push service to subscribe or poll, and of application servers.
> The spec should define one such mechanism - for example by using a key
> pair for each UA and for each application server, and using one of the
> common mechanisms - TLS client auth, JWT tokens - to authenticate.
> The key of the sender can be made available to the UA and webapplication
> by the push service - or can be used as an extra authentication in the
> encrypted content - for example signing the ephemeral key.
> —
> _______________________________________________
> Webpush mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webpush
>