Transaction token Discovery Security Considerations #153
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Security Considerations for Transaction Token Discovery (#95 )
gffletch
reviewed
Jan 31, 2025
| @@ -635,10 +635,13 @@ The authorization model within a trust domain boundary is most often quite diffe | |||
| ## Identifying Call Chains | |||
| A Txn-token typically represents the call-chain of workloads necessary to complete a logical function initiated by an external or internal workload. The `txn` claim in the Txn-token provides a unique identifier that when logged by the TTS and each subsequent workload can provide both discovery and auditability of successful and failed transactions. It is therefore strongly RECOMMENDED to use an identifier, unique within the trust domain, for the `txn` value. | |||
|
|
|||
| ## Transaction Token Service Discovery | |||
| A workload may use a variety of mechanisms to determine the Transaction Token Service it should interact with. Workloads should only retrieve configuration information indicating which Transaction Token Service it should interact with from a trusted location to minimize the risk of a threat actor inserting configuration information pointing to a Transaction Token Service under it's control, which it may use to collect Access Tokens sent to it as part of the Txn-Token Request message. The workload should authenticate the service providing the configuration information and verify the integrity of the information to prevent a threat actor from inserting configuration information for a Trust Domain Service under its control. The wokrload may use TLS to authenticate the end-point and protect the request at the transport layer, and may use additional application layer signatures or message authentication codes to detect tampering with the configuration information. | |||
gffletch
reviewed
Jan 31, 2025
tulshi
reviewed
Feb 3, 2025
| @@ -635,10 +635,13 @@ The authorization model within a trust domain boundary is most often quite diffe | |||
| ## Identifying Call Chains | |||
| A Txn-token typically represents the call-chain of workloads necessary to complete a logical function initiated by an external or internal workload. The `txn` claim in the Txn-token provides a unique identifier that when logged by the TTS and each subsequent workload can provide both discovery and auditability of successful and failed transactions. It is therefore strongly RECOMMENDED to use an identifier, unique within the trust domain, for the `txn` value. | |||
|
|
|||
| ## Transaction Token Service Discovery | |||
| A workload may use a variety of mechanisms to determine the Transaction Token Service it should interact with. Workloads should only retrieve configuration information indicating which Transaction Token Service it should interact with from a trusted location to minimize the risk of a threat actor inserting configuration information pointing to a Transaction Token Service under it's control, which it may use to collect Access Tokens sent to it as part of the Txn-Token Request message. The workload should authenticate the service providing the configuration information and verify the integrity of the information to prevent a threat actor from inserting configuration information for a Trust Domain Service under its control. The wokrload may use TLS to authenticate the end-point and protect the request at the transport layer, and may use additional application layer signatures or message authentication codes to detect tampering with the configuration information. | |||
There was a problem hiding this comment.
Can we say "should use TLS" or "must use TLS" instead of "may use TLS"?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Security Considerations for Transaction Token Discovery (#95 )