Security-wise it'd be better to have the initial part of the protocol
work like this:
C->S: here's a client_nonce, gimme a token
S: <compute token = server_key_id || server_nonce ||
MAC(server_key, server_nonce || client_nonce)
S->C: here's your token
Nonces should be at least 64 bits. server_key_id serves as an
expiration time as well, but if desired an explicit expiration can be
added.
This would work with anycasting (servers can validate tokens without
keeping any state other than the server keys). And it'd not bind in
client IP addresses, thus there'd never be problems with mobility or
NAT.
Nico
--
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf