Overall pictures of Identity provider mix up attack patterns and trade offs between costs and effect скачать в хорошем качестве

Overall pictures of Identity provider mix up attack patterns and trade offs between costs and effect

Presented by Yoshiyuki Tabata at the OAuth Security Workshop 2021 This March, FAPI 1.0 Part 1 and Part 2 became OpenID final specifications. To comply with them, there are many active movements globally. As the same as other OAuth-related specifications, several Security Considerations are described in these specifications, "Identity provider mix-up attack" is one of them. Although this attack is a very complex attack, there are few descriptions and no figures, so it is difficult for implementers to grasp the overall picture of the attack. Of course, there are several mitigations described, these take a little high cost so there may be a case that is a little hard to apply to the real system. In this presentation, to grasp the overall picture of "Identity provider mix-up attack", we list and figure several patterns and conditions of this attack. And also we list mitigations and describe which mitigation can be effective for which conditions and how much. By doing this, implementers can decide how much they should spend efforts to deal with this attack and which mitigation they should apply.