{"action":"opened","issue":{"url":"https://api.github.com/repos/usnistgov/800-63-3/issues/184","repository_url":"https://api.github.com/repos/usnistgov/800-63-3","labels_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/184/labels{/name}","comments_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/184/comments","events_url":"https://api.github.com/repos/usnistgov/800-63-3/issues/184/events","html_url":"https://github.com/usnistgov/800-63-3/issues/184","id":168315933,"number":184,"title":"Holder-of-key assertion security","user":{"login":"lineumann","id":20724397,"avatar_url":"https://avatars.githubusercontent.com/u/20724397?v=3","gravatar_id":"","url":"https://api.github.com/users/lineumann","html_url":"https://github.com/lineumann","followers_url":"https://api.github.com/users/lineumann/followers","following_url":"https://api.github.com/users/lineumann/following{/other_user}","gists_url":"https://api.github.com/users/lineumann/gists{/gist_id}","starred_url":"https://api.github.com/users/lineumann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lineumann/subscriptions","organizations_url":"https://api.github.com/users/lineumann/orgs","repos_url":"https://api.github.com/users/lineumann/repos","events_url":"https://api.github.com/users/lineumann/events{/privacy}","received_events_url":"https://api.github.com/users/lineumann/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-07-29T12:39:40Z","updated_at":"2016-07-29T12:39:40Z","closed_at":null,"body":"**Organization**:2\r\n \r\n**Type**:\r\n \r\n**Document (63-3, 63A, 63B, or 63C)**: 63C\r\n\r\n**Reference (Include section and paragraph number)**:\r\n5.1.1. Holder-of-Key Assertions\r\n \r\n**Comment (Include rationale for comment)**:\r\n The definition of a holder-of-key assertion is not consistent with the security evaluation. \r\nThe definition do not include any relation of the key with authentication made by CSP. The attacker can use its own key and misuse the assertion e.g. if attacker is MITM on the channel between victim’s browser and CSP.\r\n\r\n**Suggested Change**:\r\nChange definition or security evaluation. \r\n \r\n---\r\n \r\nOrganization: 1 = Federal, 2 = Industry, 3 = Other \r\n\r\n"}}
{"actor":{"display_login":"lineumann"}}