Network Working Group A. Tulshibagwale Internet-Draft SGNL Intended status: Informational 3 July 2024 Expires: 4 January 2025 PushPull Based Security Event Token (SET) Delivery Using HTTP draft-tulshibagwale-pushpull-delivery-00 Abstract In situations where a transmitter of Security Event Tokens (SETs) to a network peer is also a receiver of SETs from the same peer, it is helpful to have an efficient way of sending an receiving SETs in one HTTP transaction. Using current mechanisms such as "Push-Based Delivery of Security Event Tokens (SETs) Using HTTP" or "Poll-Based Delivery of Security Event Tokens (SETs) Using HTTP" both require two or more HTTP connections to exchange SETs between peers. In many cases, such as when using the OpenID Shared Signals Framework (SSF), the situation where each entity is both a transmitter and receiver is getting increasingly common. In addition, this specification enables the transmission and reception of multiple SETs in one HTTP connection. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 4 January 2025. Copyright Notice Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. Tulshibagwale Expires 4 January 2025 [Page 1] Internet-Draft pushpull July 2024 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Notational Conventions . . . . . . . . . . . . . . . . . . . 3 3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 4. Pushpull Endpoint . . . . . . . . . . . . . . . . . . . . . . 3 5. Communication Object . . . . . . . . . . . . . . . . . . . . 3 6. Initiating Communication . . . . . . . . . . . . . . . . . . 4 7. Response Communication . . . . . . . . . . . . . . . . . . . 5 7.1. Success Response . . . . . . . . . . . . . . . . . . . . 5 7.2. Error Response . . . . . . . . . . . . . . . . . . . . . 5 8. Authentication and Authorization . . . . . . . . . . . . . . 5 9. Delivery Reliability . . . . . . . . . . . . . . . . . . . . 5 10. Security Considerations . . . . . . . . . . . . . . . . . . . 6 10.1. Authentication and Authorization . . . . . . . . . . . . 6 10.2. HTTP and TLS . . . . . . . . . . . . . . . . . . . . . . 6 10.3. Denial of Service . . . . . . . . . . . . . . . . . . . 6 11. Privacy Considerations . . . . . . . . . . . . . . . . . . . 6 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 13. Normative References . . . . . . . . . . . . . . . . . . . . 6 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 7 1. Introduction Workloads that exchange SETs [RFC8417] with each other ("Transceivers") can do so efficiently using the protocol defined in this specification. Although this specification works along the lines of the DeliveryPush [RFC8935] and DeliveryPoll [RFC8936] specifications, it makes a few important additions: * A Transceiver initiating a communication can send multiple SETs in one HTTP connection to a Peer * The Transceiver initiating communication can acknowledge previously received SETs in the same HTTP connection to the Peer * The Peer responding to the communication can send multiple SETs in its response to a connection from the Transceiver Tulshibagwale Expires 4 January 2025 [Page 2] Internet-Draft pushpull July 2024 * The Peer responding to the communication can acknowledge previously received SETs in its response to the Transceiver 2. Notational Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 3. Terminology Transceiver A networked workload that can act both as a transmitter of SETs and a receiver of SETs. It communicates with other trusted Transceivers to transmit and receive SETs using the protocol defined herein. Peer Another name for a Transceiver, used to signify the other end of the communication from a Transceiver. Initiator A Transceiver initiating communication with a Peer. Responder A Transceiver responding to communication from a Peer. DeliveryPush The IETF RFC titled "Push-Based Delivery of Security Event Tokens (SETs) Using HTTP" [RFC8935]. DeliveryPoll The IETF RFC titled "Poll-Based Delivery of Security Event Tokens (SETs) Using HTTP" [RFC8936]. 4. Pushpull Endpoint Each Transceiver that supports this specification MUST support a "Pushpull" endpoint. This endpoint MUST be capable of serving HTTP [RFC9110] requests. This endpoint MUST be TLS [RFC8446] enabled and MUST reject any communication not using TLS. 5. Communication Object A Communication Object is a JSON object [RFC8259], and is a unit of communication used in this specification used both in requests and responses. When used in a request, the Initiator MAY have additional fields defined the later sections below. The common fields of this object are: sets OPTIONAL. A JSON object containing key-value pairs in which Tulshibagwale Expires 4 January 2025 [Page 3] Internet-Draft pushpull July 2024 the key of a field is a string that contains the jti value of the SET that is specified in the value of the field. This field MAY be omitted to indicate that no SETs are being delivered by the initiator in this communication. ack OPTIONAL. An array of strings, in which each string is the jti value of a previously received SET that is acknowledged in this object. This array MAY be empty or this field MAY be omitted to indicate that no previously received SETs are being acknowledged in this communication. setErrs OPTIONAL. A JSON object containing key-value pairs in which the key of a field is a string that contains the jti value of a previously received SET that the sender of the communication object was unable to process. The value of the field is a JSON object that has the following fields: err OPTIONAL. The short reason why the specified SET failed to be processed. description OPTIONAL. An explanation of why the SET failed to be processed. 6. Initiating Communication A Transceiver can initiate communication with a Peer in order to: * Acknowledge previously received SETs from the Peer. * Send SETs to the Peer. * Both acknowledge previously received SETs from the Peer and send SETs to the Peer. To initiate communication, the Initiator makes a HTTP POST request to the Responder's Pushpull Endpoint Section 4. The body of this request is of the content type "application/json". It contains a Communication Object Section 5, and the following additional field MAY be present: maxResponseEvents OPTIONAL. A number which specifies the maximum number of events the Responder can include in its response to the Initiator. If this field is absent in the request, the Responder MAY include any number of events in the response. Tulshibagwale Expires 4 January 2025 [Page 4] Internet-Draft pushpull July 2024 7. Response Communication A Responder MUST respond to a communication from an Initiator by sending an HTTP Response. 7.1. Success Response If the Responder is successful in processing the request, it MUST return the HTTP status code 200 (OK). The response MUST have the content-type "application/json" and the response MUST include a Communication Object Section 5. 7.2. Error Response The Responder MUST respond with an error response if it is unable to process the request. The error response MUST include the appropriate error code as described in Section 2.4 of DeliveryPush [RFC8935]. 8. Authentication and Authorization The Initiator MUST verify the identity of the Responder by validating the TLS certification presented by the Responder, and verifying that it is the intended recipient of the request, before sending the Communication Object Section 5. The Initiator MUST attempt to obtain the OAuth Protected Resource Metadata [OPRM] for the Responder endpoint. If such metadata is found, the Initiator MUST obtain an access token using the metadata. If no such metadata is found, then the Initiator MAY use any means to authorize itself to the Responder. The Responder MUST verify the identity and authorization of the Initiator. The Responder MAY use OAuth Protected Resource Metadata [OPRM] for this purpose, but the Responder MAY use other means to authorize the Initiator, which are beyond the scope of this specification. 9. Delivery Reliability A Transceiver MUST attempt to deliver any SETs it has previously attempted to deliver to a Peer until: * It receives an acknowledgement through the ack value for that SET in a subsequent communication with the Peer * It receives a setErrs object for that SET in a subsequent communication with the Peer * It has attempted to deliver the SET a maximum number of times and has failed to communicate either due to communication errors or lack of inclusion in ack or setErrs in subsequent communications that were conducted for the maximum number of times. The maximum number of attempts MAY Tulshibagwale Expires 4 January 2025 [Page 5] Internet-Draft pushpull July 2024 be set by the Transceiver for itself and SHOULD be communicated offline to the Peers. If a Transceiver previously attempted to deliver a SET in a response to a Peer's request, the Transceiver MAY Initiate a request to the Peer in order to retry delivery of the SET. A Peer MUST be able to either provide acks or setErrs for the same SETs either through requests or responses. 10. Security Considerations 10.1. Authentication and Authorization Transceivers MUST follow the procedures described in section Section 8 in order to securely authenticate and authorize Peers 10.2. HTTP and TLS Transceivers MUST use TLS [RFC8446] to communicate with Peers and is subject to the security considerations of HTTP [RFC9110] Section 17. 10.3. Denial of Service A Responder may be vulnerable to denial of service attacks wherein a large number of spurious requests need to be processed. Having efficient authorization mechanisms such as OAuth 2.0 [RFC6749] can mitigate such attacks by leveraging standard infrastructure that is designed to handle such attacks. 11. Privacy Considerations SETs may contain confidential information, and Transceivers receiving SETs must be careful not to log such content or ensure that sensitive information from the SET is redacted before logging. 12. IANA Considerations This specification does not add any new IANA considerations. 13. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . Tulshibagwale Expires 4 January 2025 [Page 6] Internet-Draft pushpull July 2024 [RFC6749] Hardt, D., Ed., "The OAuth 2.0 Authorization Framework", RFC 6749, DOI 10.17487/RFC6749, October 2012, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8259] Bray, T., Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, December 2017, . [RFC8417] Hunt, P., Ed., Jones, M., Denniss, W., and M. Ansari, "Security Event Token (SET)", RFC 8417, DOI 10.17487/RFC8417, July 2018, . [RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, . [RFC8935] Backman, A., Ed., Jones, M., Ed., Scurtescu, M., Ansari, M., and A. Nadalin, "Push-Based Security Event Token (SET) Delivery Using HTTP", RFC 8935, DOI 10.17487/RFC8935, November 2020, . [RFC8936] Backman, A., Ed., Jones, M., Ed., Scurtescu, M., Ansari, M., and A. Nadalin, "Poll-Based Security Event Token (SET) Delivery Using HTTP", RFC 8936, DOI 10.17487/RFC8936, November 2020, . [RFC9110] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, Ed., "HTTP Semantics", STD 97, RFC 9110, DOI 10.17487/RFC9110, June 2022, . [OPRM] Jones, M. B., Hunt, P., and A. Parecki, "OAuth 2.0 Protected Resource Metadata", May 2024, . Author's Address Atul Tulshibagwale SGNL Email: atul@sgnl.ai Tulshibagwale Expires 4 January 2025 [Page 7]