Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve token capacity comparison to cookies #273

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Improve token capacity comparison to cookies #273

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6b24a14
Improve token capacity comparison to cookies
aykutbulut Aug 15, 2023
3d5bc3b
Update background section
aykutbulut Aug 31, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 6 additions & 10 deletions spec.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,16 +142,12 @@ Private State Tokens API performs cross site anonymous authentication without
using linkable state carrying cookies [[RFC6265]]. Cookies do provide cross
site authentication, however, they fail to provide anonymity.

Cookies store large amounts of information. [[RFC6265]] requires at least 4096
bytes per cookie and 50 cookies per domain. This means an origin has
50 x 4096 x 2^8 unique identifiers at its disposal. When backed with back end
databases, a server can store arbitrary data for that many unique
users/sessions.

Compared to a cookie, the amount of data stored in a Private State Token is very
limited. A token stores a value from a set of six values (think of a value of
an enum type of six possible values). Hence a token stores data between 2 and 3
bits (4 < 6 < 8). This is very small compared to 4096 bytes a cookie can store.
[[RFC6265]] requires at least 4096 bytes per cookie and 50 cookies per
domain. Compared to this capacity at an origin's disposal, the amount of data
stored in a Private State Token by an issuer is very limited. A token stores a
value from a set of six values (think of a value of an enum type of six
possible values). Hence, a token's storage capacity is between 2 and 3 bits (4
< 6 < 8). This is very small compared to an origin's cookie storage capacity.

Moreover, Private State Tokens API use cryptographic protocols that prevents
origins from tracking which tokens they issue to which user. When presented with
Expand Down