Draft: draft-ietf-gnap-core-protocol

Commentary: clarify that user codes are unguessable , - update user code examples , 
 To edit notification comments on pull requests , go to your . 
 This is very minor , but there 's a contradiction between the usercode provided in the example in section 3.3.3 . and the recommendations that are mentioned in the text above it . The text says : And However , the example provided below it goes against these two recommendations , as it contains a special character ( a hyphen ) rather than just letters and numbers , and it 's longer than eight characters in length : I 'd suggest either tweaking the wording , or tweaking the example so that the usercode provided in the example is aligned to the recommendations mentioned in the text . 
 The specification does not require user codes to be unguessable . Section 3.3.3 ( Display of a Short User Code ) states that user codes have to be unique and should be short - lived , but this does not imply that codes should be unguessable . It seems that Section 13.27 ( Exhaustion of Random Value Space ) does not apply to user codes , but to values that are clearly random values " such as nonces , tokens , and randomized URIs " . If attackers can guess user codes , the same attack described in is possible . 
 Good catch ! The intent is for these to be unguessable , so we can add that explicitly .
Paragraph (version A):
If the client instance indicates that it can request-interact-
usercode and the AS supports this mode for the client instance's
request, the AS responds with a "user_code" field.  This field is
string containing a unique short code that the user can type into a
web page.  This string MUST be case-insensitive, MUST consist of only
easily typeable characters (such as letters or numbers).  The time in
which this code will be accepted SHOULD be short lived, such as
several minutes.  It is RECOMMENDED that this code be no more than
eight characters in length.
Paragraph (version B):
If the client instance indicates that it can request-interact-
usercode and the AS supports this mode for the client instance's
request, the AS responds with a "user_code" field.  This field is
string containing a unique short code that the user can type into a
web page.  To facilitate usability, this string MUST be case-
insensitive, MUST consist of only easily typeable characters (such as
letters or numbers).  The string MUST be randomly generated so as to
be unguessable by an attacker within the time it is accepted.  The
time in which this code will be accepted SHOULD be short lived, such
as several minutes.  It is RECOMMENDED that this code be no more than
eight characters in length.
Paragraph (version A):
When the end user is directed to enter a short code through the
response-interact-usercode mode, the client instance communicates the
user code to the end user and directs the end user to enter that code
at an associated URI.  This mode is designed to be used when the
client instance is not able to communicate or facilitate launching an
arbitrary URI.  The associated URI could be statically configured
with the client instance or in the client software's documentation.
As a consequence, these URIs SHOULD be short.  The user code URI MUST
be reachable from the end user's browser, though the URI is usually
be opened on a separate device from the client instance itself.  The
URI MUST be accessible from an HTTP GET request and MUST be protected
by HTTPS or equivalent means.
Paragraph (version B):
When the end user is directed to enter a short code through the
response-interact-usercode mode, the client instance communicates the
user code to the end user and directs the end user to enter that code
at an associated URI.  The client instance MAY format the user code
in such a way as to facilitate memorability and transfer of the code,
so long as this formatting does not alter the value as accepted at
the user code URI.  For example, a client instance receiving the user
code "A1BC3DFF" could choose to display this to the user as "A1BC
3DFF", breaking up the long string into two shorter strings.  In this
example, the space in between the two parts would be removed upon its
entry into the user code URI.
Paragraph (version B):
This mode is designed to be used when the client instance is not able
to communicate or facilitate launching an arbitrary URI.  The
associated URI could be statically configured with the client
instance or in the client software's documentation.  As a
consequence, these URIs SHOULD be short.  The user code URI MUST be
reachable from the end user's browser, though the URI is usually be
opened on a separate device from the client instance itself.  The URI
MUST be accessible from an HTTP GET request and MUST be protected by
HTTPS or equivalent means.
Paragraph (version A):
When the end user is directed to enter a short code through the
response-interact-usercodeuri mode, the client instance communicates
the user code and associated URI to the end user and directs the end
user to enter that code at the URI.  This mode is used when the
client instance is not able to facilitate launching a complex
arbitrary URI but can communicate arbitrary values like URIs.  As a
consequence, these URIs SHOULD be short to allow the URI to be typed
by the end user.  The client instance MUST NOT modify the URI when
communicating it to the end user; in particular the client instance
MUST NOT add any parameters to the URI.  The user code URI MUST be
reachable from the end user's browser, though the URI is usually be
opened on a separate device from the client instance itself.  The URI
MUST be accessible from an HTTP GET request and MUST be protected by
HTTPS or equivalent means.
Paragraph (version B):
When the end user is directed to enter a short code through the
response-interact-usercodeuri mode, the client instance communicates
the user code and associated URI to the end user and directs the end
user to enter that code at the URI.  The client instance MAY format
the user code in such a way as to facilitate memorability and
transfer of the code, so long as this formatting does not alter the
value as accepted at the user code URI.  For example, a client
instance receiving the user code "A1BC3DFF" could choose to display
this to the user as "A1BC 3DFF", breaking up the long string into two
shorter strings.  In this example, the space in between the two parts
would be removed upon its entry into the user code URI.
Paragraph (version B):
This mode is used when the client instance is not able to facilitate
launching a complex arbitrary URI but can communicate arbitrary
values like URIs.  As a consequence, these URIs SHOULD be short to
allow the URI to be typed by the end user.  The client instance MUST
NOT modify the URI when communicating it to the end user; in
particular the client instance MUST NOT add any parameters to the
URI.  The user code URI MUST be reachable from the end user's
browser, though the URI is usually be opened on a separate device
from the client instance itself.  The URI MUST be accessible from an
HTTP GET request and MUST be protected by HTTPS or equivalent means.
Paragraph (version A):
Several parts of the GNAP process make use of unguessable randomized
values, such as nonces, tokens, and randomized URIs.  Since these
values are intended to be unique, a sufficiently powerful attacker
could make a large number of requests to trigger generation of
randomized values in an attempt to exhaust the random number
generation space.  While this attack is particularly applicable to
the AS, client software could likewise be targeted by an attacker
triggering new grant requests against an AS.
Paragraph (version B):
Several parts of the GNAP process make use of unguessable randomized
values, such as nonces, tokens, user codes, and randomized URIs.
Since these values are intended to be unique, a sufficiently powerful
attacker could make a large number of requests to trigger generation
of randomized values in an attempt to exhaust the random number
generation space.  While this attack is particularly applicable to
the AS, client software could likewise be targeted by an attacker
triggering new grant requests against an AS.