Subject: [COSE] Magnus Westerlund's Discuss on draft-ietf-cose-x509-07: (with DISCUSS)

From: Magnus Westerlund via Datatracker <[email-masked]>
Date: Thu, 22 Oct 2020 05:18:11 -0700

Magnus Westerlund has entered the following ballot position for
draft-ietf-cose-x509-07: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cose-x509/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I think the topic should be fairly easily to resolve one way or another.
However, even after having read the reply to Marin's comment I don't think this
document is published with the right status.

- The document defines new CBOR attributes, that is standard track work as it
comes out as consensus document from a IETF WG. - It does not define or
document crypto algorithm just refer to existing ones. - The charter item might
have been reasonable as informational if existing attributes could have been
used. With the choice to define new attributes I think this has entered
standards track. - The status of the document I think will also affect the
value that IANA might assign to these COSE Header Parameters.

If there are additional considerations I am happy to learn about them.

Else, I would propose a change of status to proposed standard and redo the IETF
last call.

---

From: Laurence Lundblade <[email-masked]>
Date: Thu, 22 Oct 2020 11:17:20 -0700

I would like to see it as standards track.

I would like EAT / RATS to make normative reference to it. Some forms of Attestation use Endorsements to convey a signature verification key to the Verifier and some Endorsements are in the form of an X.509 certificate.

I will present some of this at the RATS virtual interim tomorrow <https://datatracker.ietf.org/doc/agenda-interim-2020-rats-06-rats-01/>. Slides are here <https://datatracker.ietf.org/doc/slides-interim-2020-rats-06-sessa-eat-verification-id-and-other-updates/>. This is why I’ve been so interested in this lately.

Also, it seems pretty important for COSE to be usable with the all the X.509 infrastructure out there.

LL

> On Oct 22, 2020, at 5:18 AM, Magnus Westerlund via Datatracker <[email-masked]> wrote:
> 
> ...
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose
>

---

From: Laurence Lundblade <[email-masked]>
Date: Fri, 23 Oct 2020 12:11:04 -0700

We had a good discussion on key / cert identification for EAT / RATS at our virtual interim meeting today. There seems to be consensus support for use of cose-x509.

LL

> On Oct 22, 2020, at 11:17 AM, Laurence Lundblade <[email-masked]> wrote:
> 
>> On Oct 22, 2020, at 5:18 AM, Magnus Westerlund via Datatracker <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> ...
>> [email-masked] <mailto:[email-masked]>
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/cose <https://www.ietf.org/mailman/listinfo/cose>