]> Google

scott@shendrickson.com

Cloudflare, Inc.

caw@heapingbits.net

Security Privacy Pass token extensions This document describes an extension for Privacy Pass that allows tokens to encode expiration information. About This Document Status information for this document may be found at . Discussion of this document takes place on the Privacy Pass Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction Some Privacy Pass token types support binding additional information to the tokens, often referred to as public metadata. describes an extension parameter to the basic PrivateToken HTTP authentication scheme for supplying this metadata alongside a token. describes variants of the basic Privacy Pass issuance protocols that support issuing tokens with public metadata. This document describes an extension for Privacy Pass that allows tokens to encode expiration information. The use case and deployment considerations, especially with respect to the resulting privacy impact, are also discussed.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Expiration Extension The expiration extension is used to convey the expiration for an issued token. It is useful for Privacy Pass deployments that make use of cached tokens, i.e., those that are not bound to a specific TokenChallenge redemption context, when they want to limit token lifetime without having to frequently rotate issuing key pairs. For example, consider a Privacy Pass deployment wherein Clients use cached tokens that are valid for one hour. Clients could pre-fetch these tokens each hour and the Issuer and Origin could rotate the verification key every hour to force expiration. Alternatively, Clients could pre-fetch tokens for the entire day all at once, including an expiration timestamp in each token to indicate the time window for which the token is valid. The ExtensionType (defined in ) of this extension is 0x01. The value of this extension is an ExpirationTimestamp, defined as follows. The ExpirationTimestamp fields are defined as follows:

• "timestamp_precision" is an 8-octet integer, in network byte order, representing the granularity of the timestamp, i.e., the target to which the timestamp is rounded for loss of precision.
• "timestamp" is an 8-octet integer, in network byte order, representing the expiration timestamp. The expiration timestamp is the UNIX time in seconds at which a token expires, expressed in the UTC/GMT timezone ().

As an example, an ExpirationTimestamp structure with the following value would be interpreted as an expiration timestamp of 1688583600, i.e., July 05, 2023 at 19:00:00 GMT+0000, which is the timestamp rounded to the nearest hour (timestamp_precision = 3600).

Privacy Considerations This extension intentionally adds more information to a token that might not otherwise be visibile to Attester, Issuer, or Origin. As such, how this information is chosen can have an impact on Origin-Client, Issuer-Client, Attester-Origin, or redemption context unlinkability as defined in . Mitigating risk of privacy violation requires that the extension be constructed in a way that does not induce anonymity set partitioning, as described in . The best way to achieve this in practice is for Clients to use the same limited sets of information in the extension. Consistency can be achieved in a variety of ways. For example, Client implementations might insist that all Clients use the same deterministic function for computing the expiration timestamp, e.g., some function F(current time). This function would round the current timestamp, resulting in a loss of precision but overall less unique value. One way to implement this function would by rounding the timestamp to the nearest hour, day, or week. Of course, this does not account for clock skew, which occurs with some non-negligible probability in practice . An alternative implementation strategy for consistency is to run some sort of consistency check to ensure that the Client uses a value that is consistent with other Clients. Several consistency mechanisms exist; see for more information. Such an explicit consistency check would depend less upon the Client's current clock and thus be more robust at the cost of additional work. Orthogonal to the mechanism used to ensure consistency, it is also important that Clients choose expiration timestamps that are shared by other Clients. Consider, for example, a scenario where two Clients consistently choose expiration timestamps per the recommendation above, but only one Client ever requests a token within a given expiration window. Despite the consistency check in place, the actual value of the timestamp is still unique to one of the Clients. The means by which implementations ensure that some minimum number of Clients share the same expiration timestamp is a deployment-specific challenge. For example, in the Split Origin, Attester, and Issuer deployments as described in , the Attester is positioned to ensure that Clients do not choose consistent yet unique values. General purpose approaches to ensure that some minimum number of Clients share the same expiration timestamp are outside the scope of this document; indeed, this problem is not unique to Privacy Pass and is common to other privacy-related protocols such as Oblivious HTTP .

Security Considerations Use of the expiration extension risks revealing additional information to parties that see the extension, including the Attester, Issuer, and Origin. discusses specific privacy implications for use of this extension that aim to mitigate exposure of information that can unintentionally partition the Client anonymity set and lead to Origin-Client, Issuer-Client, Attester-Origin, or redemption context unlinkability as defined in . General information regarding the use of extensions and their possible impact on Client privacy can be found in and .

IANA Considerations This document registers the following entry into the "Privacy Pass PrivateToken Extensions" registry.

• Expiration extension
  • Type: 0x0001
  • Name: Expiration
  • Value: ExpirationTimestamp value as defined in
  • Reference: This document
  • Notes: None

References Normative References Google This document specifies new parameters for the "PrivateToken" HTTP authentication scheme, called extensions. The purpose of these extensions is to negotiate and carry public metadata for Privacy Pass protocols. Apple Inc. Google LLC Cloudflare This document defines an HTTP authentication scheme for Privacy Pass, a privacy-preserving authentication mechanism used for authorization. The authentication scheme in this document can be used by clients to redeem Privacy Pass tokens with an origin. It can also be used by origins to challenge clients to present Privacy Pass tokens. Google This document specifies Privacy Pass issuance protocols that encode public information visible to the Client, Attester, Issuer, and Origin into each token. Brave Software Brave Software Google LLC Cloudflare This document specifies two variants of the two-message issuance protocol for Privacy Pass tokens: one that produces tokens that are privately verifiable using the issuance private key, and another that produces tokens that are publicly verifiable using the issuance public key. LIP Fastly Cloudflare This document specifies the Privacy Pass architecture and requirements for its constituent protocols used for authorization based on privacy-preserving authentication mechanisms. It describes the conceptual model of Privacy Pass and its protocols, its security and privacy goals, practical deployment models, and recommendations for each deployment model that helps ensure the desired security and privacy goals are fulfilled. Brave Software The Tor Project Mozilla Cloudflare This document describes the consistency requirements of protocols such as Privacy Pass, Oblivious DoH, and Oblivious HTTP for user privacy. It presents definitions for consistency and then surveys mechanisms for providing consistency in varying threat models. In concludes with discussion of open problems in this area. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document defines a date and time format for use in Internet protocols that is a profile of the ISO 8601 standard for representation of dates and times using the Gregorian calendar. Informative References Google Inc., Mountain View, CA, USA Google Inc., Mountain View, CA, USA Google Inc., Mountain View, CA, USA Leibniz University Hannover, Hannover, Germany Purdue University, West Lafayette, IN, USA International Institute of Information Technology, Hyderabad, Hyderabad, India Google Inc., Mountain View, CA, USA Google Inc., Mountain View, CA, USA Google Inc., Mountain View, CA, USA ACM This document describes Oblivious HTTP, a protocol for forwarding encrypted HTTP messages. Oblivious HTTP allows a client to make multiple requests to an origin server without that server being able to link those requests to the client or to identify the requests as having come from the same client, while placing only limited trust in the nodes used to forward the messages.

Acknowledgments This document received input and feedback from Jim Laskey.