[Meta] Propose security mechanisms for Open Screen protocol about openscreenprotocol

[tomoyukilabs]

Fortunately, May 17 14:00 Berlin time slot would be good to me, because I'll be available after 21:00 in Tokyo (14:00 in Berlin) on that day. Many thanks, @anssiko!

[mwatson2]

I think the initial focus, as mentioned in the Charter, should be on ensuring that the target device is the one selected by the user (i.e that there is no man-in-the-middle). Is this what you mean as UA-to-UA ?

[mfoltzgoogle]

Yes. What's in scope for this initial RFP is securing the transport between the controlling and receiving UA, from either passive eavesdropping or MITM; this is explicitly called out in the charter.

Once that layer is specified, additional security layers can be built on top. However, that work is not explicitly listed in the charter, and would likely be considered out of scope without a charter amendment.

[tomoyukilabs]

Is it correct that device paring in Mozilla proposal can be one of the candidate mechanisms, for example?

[chrisn]

I'm not sure I follow where secure transport is explicitly out of scope (I'm reading item 2 under Scope of Work and item 1 under Deliverables in the charter).

[mfoltzgoogle]

@tomoyukilabs Yes the Mozilla proposal is certainly a candidate and they are invited to write it up and submit it here.

@chrisn That was a mistake, thank you for catching it :) I corrected my earlier comment.

[anssiko]

Mozilla's Device Pairing proposal by @schien is being discussed at F2F, minutes:

https://www.w3.org/2017/11/07-webscreens-minutes.html#x14

[mfoltzgoogle]

From https://www.w3.org/2017/11/07-webscreens-minutes.html#x16:

• ACTION: @schien to contribute J-PAKE proposal to repo
• @mfoltzgoogle ACTIONs:
  • review Internet-Draft for ecjpake
  • propose adding identity assertion step to J-PAKE proposal.
  • compare J-PAKE proposal with similar features in Chrome (remote desktop pairing)

[anssiko]

@tomoyukilabs provided a document detailing J-PAKE for discussion (thanks!), see https://github.com/webscreens/openscreenprotocol/blob/gh-pages/j-pake.md

[anssiko]

(@tomoyukilabs, would you prefer the J-PAKE discussion, now May 17 14:00 Berlin time slot, to be moved to F2F Day 2 May 18 to avoid conflict with your another business in Japan on May 17? Remote call in details to be provided shortly.)