]> Google

scott@shendrickson.com

Cloudflare, Inc.

caw@heapingbits.net

Security Privacy Pass token extensions This document describes an extension for Privacy Pass that allows tokens to encode geolocation hints. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the Privacy Pass Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction Some Privacy Pass token types support binding additional information to the tokens, often referred to as public metadata. describes an extension parameter to the basic PrivateToken HTTP authentication scheme for supplying this metadata alongside a token. describes variants of the basic Privacy Pass issuance protocols that support issuing tokens with public metadata. However, there are no existing extensions defined to make use of these protocol extensions. This document describes an extension for Privacy Pass that allows tokens to encode geolocation hints. These hints can be used by origins that redeem tokens to influence its behavior in various ways, such as determining the content of HTTP responses.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Geolocation Hint Extension The geolocation hint extension is an extension used to convey rough geolocation hints to origins that do not already have accurate or authoritative mappings for the IP addresses of clients. This can be particularly useful for cases where IP geolocation mappings have changed recently, or a client is using a VPN or proxy that may not be commonly recognized by servers. The value of this extension is an GeoHintTimestamp, defined as follows. ; } GeoHint; ]]> The GeoHintTimestamp fields are defined as follows:

• "geo_hint" is a string formatted as defined in . It contains a comma-separated list of Alpha2code, Region, and City. The value SHOULD NOT contain a Postal Code.

As an example, a GeoHint structure corresponding to the "192.0.2.5,US,US-AL,Alabaster" entry would be: ; // "US,US-AL,Alabaster" } GeoHint; ]]>

Security Considerations Geolocation information can contribute to a client's fingerprint. Exposing precise geolocation information can therefore lead to anonymity set partitioning, as described in . More general information regarding the use of extensions and their possible impact on client privacy can be found in . Servers MUST NOT use IP Geolocation Client Hints for making security or access-control decisions, as the value can be spoofed by a client. The hint is intended only for use in optimizing behavior.

IANA Considerations This document registers the following entry into the "Privacy Pass PrivateToken Extensions" registry.

• Expiration extension
  • Type: 0x0002
  • Name: Geolocation hint
  • Value: GeoHint value as defined in
  • Reference: This document
  • Notes: None

Normative References Google Cloudflare, Inc. This document specifies a new parameter for the "PrivateToken" HTTP authentication scheme. This purpose of this parameter is to carry extensions for Privacy Pass protocols that support public metadata. Apple Inc. Google LLC Cloudflare This document defines an HTTP authentication scheme that can be used by clients to redeem Privacy Pass tokens with an origin. It can also be used by origins to challenge clients to present an acceptable Privacy Pass token. Brave Software Brave Software Google LLC Cloudflare This document specifies two variants of the two-message issuance protocol for Privacy Pass tokens: one that produces tokens that are privately verifiable using the issuance private key, and another that produces tokens that are publicly verifiable using the issuance public key. LIP Fastly Cloudflare This document specifies the Privacy Pass architecture and requirements for its constituent protocols used for constructing privacy-preserving authentication mechanisms. It provides recommendations on how the architecture should be deployed to ensure the privacy of clients and the security of all participating entities. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document records a format whereby a network operator can publish a mapping of IP address prefixes to simplified geolocation information, colloquially termed a "geolocation feed". Interested parties can poll and parse these feeds to update or merge with other geolocation data sources and procedures. This format intentionally only allows specifying coarse-level location. Some technical organizations operating networks that move from one conference location to the next have already experimentally published small geolocation feeds. This document describes a currently deployed format. At least one consumer (Google) has incorporated these feeds into a geolocation data pipeline, and a significant number of ISPs are using it to inform them where their prefixes should be geolocated.

Acknowledgments This document received input and feedback from Jim Laskey.