Subject: Re: [COSE] draft-ietf-cose-x509-08 status

From: Michael Richardson <[email-masked]>
Date: Wed, 03 Feb 2021 12:21:50 -0500

Carsten Bormann <[email-masked]> wrote:
    > On 31. Jan 2021, at 23:54, Blumenthal, Uri - 0553 - MITLL
    > <[email-masked]> wrote:
    >>
    >> I do not get the “re-certify the certificate” part.

    > In the Web PKI, the assumption is that every participant knows all root
    > certificates and updates that set eagerly.  In the IoT world, that
    > doesn’t work.

    > So people are looking at alternative ways of validating a certificate.
    > If there is a big brother/little brother relationship, the little

The RFC8366 voucher does exactly this.
(And you can use it entirely outside of BRSKI, as SZTP does)

It can be serialized as COSE signed CBOR.
Let's not try to mix things up here, or re-invent things.

So I am opposed to cose-x509 doing anything other than doing anything other
than conveying certificates.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Henk Birkholz <[email-masked]>
Date: Fri, 5 Feb 2021 14:04:45 +0100

Hi Michael,

if I get that correctly, your proposal is to send YANG modeled JSON that 
includes b64url encoded CMS, wrapped in a CBOR byte string signed via COSE?

Viele Grüße,

Henk

On 03.02.21 18:21, Michael Richardson wrote:
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose
>

---

From: Michael Richardson <[email-masked]>
Date: Sat, 06 Feb 2021 17:09:39 -0500

Henk Birkholz <[email-masked]> wrote:
    > if I get that correctly, your proposal is to send YANG modeled JSON
    > that includes b64url encoded CMS, wrapped in a CBOR byte string signed
    > via COSE?

No.

draft-ietf-anima-constrained-voucher maps the YANG model to CBOR signed by COSE.
It does this with draft-ietf-core-sid and draft-ietf-core-yang-cbor.
No JSON or CMS would be involved.
That format is only *one* possible serialization of the YANG in RFC8366.

    >> Carsten Bormann <[email-masked]> wrote: > On 31. Jan 2021, at 23:54,
    >> Blumenthal, Uri - 0553 - MITLL > <[email-masked]> wrote:
    >> >>
    >> > In the Web PKI, the assumption is that every participant knows all
    >> root > certificates and updates that set eagerly.  In the IoT world,
    >> that > doesn’t work.
    >>
    >> > So people are looking at alternative ways of validating a
    >> certificate.  > If there is a big brother/little brother relationship,
    >> the little
    >>
    >> The RFC8366 voucher does exactly this.  (And you can use it entirely
    >> outside of BRSKI, as SZTP does)
    >>
    >> It can be serialized as COSE signed CBOR.  Let's not try to mix things
    >> up here, or re-invent things.
    >>
    >> So I am opposed to cose-x509 doing anything other than doing anything
    >> other than conveying certificates.
    >>
    >> --
    >> Michael Richardson <[email-masked]> . o O ( IPv6 IøT consulting
    >> ) Sandelman Software Works Inc, Ottawa and Worldwide
    >>
    >>
    >>
    >>
    >>
    >> _______________________________________________ COSE mailing list
    >> [email-masked] https://www.ietf.org/mailman/listinfo/cose
    >>