Token Binding Support in TLS extension

[inthirakumaaran]

I need token binding support in TLS and it is not implemented in the BCJSSE.But in the extensions, it has been recognized, So will it be implemented?

[peterdettman]

What do you mean here: "But in the extensions, it has been recognized"?

Assuming you are talking about https://tools.ietf.org/html/draft-ietf-tokbind-protocol-16, It's on our TODO list, but that list is long, and this is still a draft specification.

Also, since there doesn't appear to be a JSSE API for it yet, the functionality could initially only be available in BCJSSE through a BC-specific extension API.

If you meant channel bindings, we have support already for tls-unique via an extension interface in BCJSSE.

[inthirakumaaran]

Thanks for the quick response, I meant the Token Binding specification which is still in the draft version."But in the extensions, it has been recognized"- In the extension type class token binding extension id has been written
public static final int DRAFT_token_binding = 24;

I know there is no Java implementation for this and only nginx , apache httpd server and chrome have support for this.But I am an intern and need this support for a project(I am running in a short timeframe).

Earlier I just want to know, you have already started to work on this or not and your reasoning is fair and square regarding it.However, I need this support, If I am able to write the support for token binding in BC (through BC-specific extension API and in your conventions), Is it possible to send a PR to BC? I know we can send PR for small issues but I am not sure whether public can send PR for implementations.

[peterdettman]

Yes we accept PRs for new implementations. Please ensure you understand the terms of the BC license, and have permission from any actual or potential rights-holders (of the software). Also please understand that it can take significant time for us to review contributions.

[inthirakumaaran]

Thanks, I'll look into license and permissions.Time is not a problem I just want everyone to benefit from it.

[inthirakumaaran]

I started implementing token binding in client side and having some trouble with getting the negotiated values to the user. In the token binding implementation, we have to provide the user with negotiated key parameter and EKM.Currently, I am saving the key parameter in security parameters of Tls client protocol.But this cannot be accessed from the socket, So how should I do this?
I think if I finish this I could send an early PR with client-side implementation.

[inthirakumaaran]

Hi,
I have sent an initial PR to add the token binding extension(client side), can you have look on that?

[kasunbg]

@peterdettman thank you for looking into this. Inthirakumaaran did this implementation while working at WSO2. This work is provided under the MIT license, and therefore does not violate the BC license.

The pull request is here: #261

Thanks,
KasunG