Subject: Re: [COSE] Agenda for interim on 17.02.2021

From: Göran Selander <[email-masked]>
Date: Tue, 16 Feb 2021 06:50:31 +0000

Hi,

I second John's proposal to have the interim meeting. These are topics of recent mail threads ([1], [2]) and although these are not sharply defined issues, the meeting may if not solve at least help us come to a sharper formulation of the issues. 

I can prepare a slide on the second point.

Göran

[1] https://mailarchive.ietf.org/arch/msg/cose/RaeiOMvtAVuP710uHuYCLU3AU_4/
[2] https://mailarchive.ietf.org/arch/browse/cose/?index=RaeiOMvtAVuP710uHuYCLU3AU_4

On 2021-02-11, 08:42, "COSE on behalf of John Mattsson" <[email-masked] on behalf of john.mattsson=[email-masked]> wrote:

    Hi,

    I would like the WG to discuss and hopefully agree on:

    * X509. Trust relations, protection, and formats. This is relevant for the EDHOC and the CBOR certificate work as well.
    * IANA registrations policies, in particular co-factor ECC, as brought up by Wei25519.

    I think these are the two most urgent things to discuss. I am however not the driver for any of these.

    Cheers,
    John

    From: Ivaylo Petrov <[email-masked]>
    Date: Wednesday, 10 February 2021 at 23:30
    To: cose <[email-masked]>
    Cc: Cose Chairs Wg <[email-masked]>
    Subject: Agenda for interim on 17.02.2021

    Dear all,

    Our next interim is scheduled for 17.02.2021 from 16:00 UTC. The chairs would like to know what topics the WG would like to discuss during the interim. If there is nothing to discuss at that time, we could cancel the interim as the IETF 110 meeting will be less than a month later.

    - Matthew and Ivaylo

    COSE WG Chairs

---

From: John Mattsson <[email-masked]>
Date: Tue, 16 Feb 2021 12:36:17 +0000

Below are my short summary of what I think needs discussion regarding [1]

X.509 discussion topics
--------------------------

Major discussion points:

1. Many people have expressed that they don't understand the trust assumptions mentioned for x5u. Is x5u meant to distribute trust anchors in some way? 

2. It was suggested that parts of the end-entity certificate need to be integrity protected. This would make the current specification of x5bag and x5chain insecure.
  - Putting everything in protected would be problematic for Michael's use case with middleboxes removing intermediary certs.
  - Putting the cert in external_aad like EDHOC would change the COSE processing...

Less major discussion points:

- Protection requirements for x5u use of HTTP CoAP.
- Not allowing OSCORE, Mandating PKCS7.

If time allow, we can continue with how we would like things to work for CBOR encoded X.509 certificates. There we have more flexibility.

John

-----Original Message-----
From: Göran Selander <goran.selander=[email-masked]>
Date: Tuesday, 16 February 2021 at 07:50
To: John Mattsson <[email-masked]>, Ivaylo Petrov <[email-masked]>, cose <[email-masked]>
Cc: Cose Chairs Wg <[email-masked]>
Subject: Re: [COSE] Agenda for interim on 17.02.2021

Hi,

Göran

    Hi,

    Cheers,
    John

    Dear all,

    - Matthew and Ivaylo

    COSE WG Chairs

---

From: Ivaylo Petrov <[email-masked]>
Date: Wed, 17 Feb 2021 15:24:36 +0100

Hello,

Sorry for the late confirmation. As John pointed out, it appears that it
makes sense to have the meeting in order to try to resolve the issues with
the x509 draft. See you all in about 1h30. Apart from the chairs slides
which we have prepared, any slides with explanations of the issues would
be appreciated.

Ivaylo

On Tue, Feb 16, 2021 at 1:36 PM John Mattsson <[email-masked]>
wrote:

> 1. Many people have expressed that they don't understand the trust
> assumptions mentioned for x5u. Is x5u meant to distribute trust anchors in
> some way?
>
> 2. It was suggested that parts of the end-entity certificate need to be
> integrity protected. This would make the current specification of x5bag and
> x5chain insecure.
>   - Putting everything in protected would be problematic for Michael's use
> case with middleboxes removing intermediary certs.
> If time allow, we can continue with how we would like things to work for
> CBOR encoded X.509 certificates. There we have more flexibility.
>
> John
>
> I second John's proposal to have the interim meeting. These are topics of
> recent mail threads ([1], [2]) and although these are not sharply defined
> issues, the meeting may if not solve at least help us come to a sharper
> formulation of the issues.
>
> [1]
> https://mailarchive.ietf.org/arch/msg/cose/RaeiOMvtAVuP710uHuYCLU3AU_4/
> [2]
> https://mailarchive.ietf.org/arch/browse/cose/?index=RaeiOMvtAVuP710uHuYCLU3AU_4
>
>
>
>
> On 2021-02-11, 08:42, "COSE on behalf of John Mattsson" <
> [email-masked] on behalf of john.mattsson=
> [email-masked]> wrote:
>
>     Hi,
>
>     * X509. Trust relations, protection, and formats. This is relevant for
> the EDHOC and the CBOR certificate work as well.
>     Our next interim is scheduled for 17.02.2021 from 16:00 UTC. The
> chairs would like to know what topics the WG would like to discuss during
> the interim. If there is nothing to discuss at that time, we could cancel
> the interim as the IETF 110 meeting will be less than a month later.
>
>
>
>     - Matthew and Ivaylo
>
>     COSE WG Chairs
>
>
>

---

From: John Mattsson <[email-masked]>
Date: Wed, 17 Feb 2021 14:32:42 +0000

I can make some quick and ugly slides on X.509 if you want…

From: Ivaylo Petrov <[email-masked]>
Date: Wednesday, 17 February 2021 at 15:25
To: John Mattsson <[email-masked]>
Cc: Göran Selander <goran.selander=[email-masked]>, cose <[email-masked]>, Cose Chairs Wg <[email-masked]>
Subject: Re: [COSE] Agenda for interim on 17.02.2021

Hello,

Sorry for the late confirmation. As John pointed out, it appears that it makes sense to have the meeting in order to try to resolve the issues with the x509 draft. See you all in about 1h30. Apart from the chairs slides which we have prepared, any slides with explanations of the issues would be appreciated.

Ivaylo

On Tue, Feb 16, 2021 at 1:36 PM John Mattsson <[email-masked]<mailto:[email-masked]>> wrote:
Below are my short summary of what I think needs discussion regarding [1]

X.509 discussion topics

Major discussion points:

John

-----Original Message-----
From: Göran Selander <goran.selander=[email-masked]<mailto:[email-masked]>>
Date: Tuesday, 16 February 2021 at 07:50
To: John Mattsson <[email-masked]<mailto:[email-masked]>>, Ivaylo Petrov <[email-masked]<mailto:[email-masked]>>, cose <[email-masked]<mailto:[email-masked]>>
Cc: Cose Chairs Wg <[email-masked]<mailto:[email-masked]>>
Subject: Re: [COSE] Agenda for interim on 17.02.2021

Hi,

Göran

On 2021-02-11, 08:42, "COSE on behalf of John Mattsson" <[email-masked]<mailto:[email-masked]> on behalf of john.mattsson=[email-masked]<mailto:[email-masked]>> wrote:

    Hi,

    Cheers,
    John

    From: Ivaylo Petrov <[email-masked]<mailto:[email-masked]>>
    Date: Wednesday, 10 February 2021 at 23:30
    To: cose <[email-masked]<mailto:[email-masked]>>
    Cc: Cose Chairs Wg <[email-masked]<mailto:[email-masked]>>
    Subject: Agenda for interim on 17.02.2021

    Dear all,

    - Matthew and Ivaylo

    COSE WG Chairs

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 17 Feb 2021 16:04:33 +0100

> - Protection requirements for x5u use of HTTP CoAP.

Much of the confusion here is coming from the interaction of (1) having to validate the chain (authorizations) of the retrieved certificate with (2) having to validate the chain of the certificate that is protecting the communication channel used for retrieving the certificate.

I believe this is a mire.

Grüße, Carsten