NW-PP18 Web Authentication, TLS and phishing

[Lisa: feel free to re-post with a proper PP number.]

Abstract

   Cryptographic user and server authentication, and cryptographic
   transport protection are requirements for dealing with modern threat
   models for the Internet.

   Phish attacks aim to steal credentials, but if not credentials, then
   man-in-the-middle (MITM) access.

   It is important to ensure that user/service authentication and
   cryptographic transport protection are cryptographically bound so as
   to avoid MITM attacks.

   Implied, of course, if authentication stronger than the current
   reigning champion: username&password-over-TLS (which does not, and
   cannot support channel binding).

   Additionally, phishing opportunities must be limited, such as by
   using authentication tokens that cannot be captured and played to
   other relying parties.  One goal is to push phishing opportunities to
   the edge of the system: enrolment.

   "Nigeria scam" type phishing is out of scope for this paper, but
   phishing attacks where a user is directed to a malicious site (e.g.,
   via spam e-mail) or where the user accidentally goes to a malicious
   site (e.g., via typo-squatting) are in scope.

Introduction