Subject: [COSE] Spencer Dawkins' No Objection on charter-ietf-cose-01-00: (with COMMENT)

From: Spencer Dawkins <[email-masked]>
Date: Tue, 09 Oct 2018 19:58:01 -0700

Spencer Dawkins has entered the following ballot position for
charter-ietf-cose-01-00: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-cose/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I think this is one of the recharters that is appropriate for external review
before approval. Thanks for that.

I see "resistant to quantum computing" a lot these days, but is this actually
"resistant to attacks based on quantum-computing capabilities", or something
like that? I mean, quantum computers do have other uses, I hope :-)

This text

"At the time COSE was developed, there was a sense that X.509
certificates was not a feature that needed to be transferred from the
JOSE key document (RFC 7517).  Since that time a better sense of how
certificates would be used both in the IoT sphere and with COSE
outside of the IoT sphere has been developed.  The need to be able to
identify X.509 certificates is now a feature that needs to be
provided.  This will additionally require definition of a small number
of hash functions for compact references to certificates."

alternates between "X.509 certificates" (twice) and "certificates" with no
adjective (twice). If there's no difference intended, it may be useful to be
consistent.

---

From: Jim Schaad <[email-masked]>
Date: Tue, 9 Oct 2018 20:27:28 -0700

> -----Original Message-----
> From: COSE <[email-masked]> On Behalf Of Spencer Dawkins
> Sent: Tuesday, October 9, 2018 7:58 PM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; [email-masked]
> Subject: [COSE] Spencer Dawkins' No Objection on charter-ietf-cose-01-00:
> (with COMMENT)
> 
email
> addresses included in the To and CC lines. (Feel free to cut this
introductory
> paragraph, however.)

Yes it is "resistant to attacks..."

Well - the big use of quantum computers that I have seen mostly boil down to
- how do we solve this problem which are hard and therefore could be used
for cryptography, but yes there are other thing like traveling salesmen that
are supposed to be solvable.

> 
> This text
> 
> "At the time COSE was developed, there was a sense that X.509 certificates
was
> not a feature that needed to be transferred from the JOSE key document
(RFC
> 7517).  Since that time a better sense of how certificates would be used
both in
> the IoT sphere and with COSE outside of the IoT sphere has been developed.
> The need to be able to identify X.509 certificates is now a feature that
needs to
> be provided.  This will additionally require definition of a small number
of hash
> functions for compact references to certificates."
> 

The text should probably use X.509 certificates consistently.  There are
other certificate formats and I have already been approached by somebody who
wants to do a COSE certificate of some type (definitely not in scope of the
current charter).

Jim

> 
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose