Subject: Re: [dtn] Interoperability context and/or COSE

From: Mehmet Adalier <[email-masked]>
Date: Tue, 28 Jul 2020 15:44:00 -0700

Regarding the questions posed below:

Yes, I believe that the BPsec interoperability security context should be useable in environments beyond interoperability-testing. I am not sure what ‘production grade’ entails, but I will be more than happy to contribute to this effort.

Regarding “Should the COSE security context replace the BPSec-interop document?” 

I have extensively reviewed the COSE RFC. While this is a well written RFC, I am not convinced that the overhead introduced provides a tangible security benefit. While it attempts to standardize, its complexity increases the amount of processing code and the attack surface. My vote will be no, it should not replace the BPsec interop document.

mehmet

From: dtn <[email-masked]> on behalf of Rick Taylor <[email-masked]>
Date: Monday, July 27, 2020 at 6:09 AM
To: "[email-masked]" <[email-masked]>
Subject: [dtn] Interoperability context and/or COSE

Hi All,

At IETF-108 a question was raised as whether the existing BPSec interoperability security context should be useable in environments beyond interoperability-testing.

A second question was raised: whether the COSE security context would actually make a good replacement for the BPSec interoperability security context draft.

The chairs are interested in discovering WG consensus on the following topics:

Should BPsec-interop be updated to be ‘production grade’?
Should the COSE security context be adopted as a WG document?
Should the COSE security context replace the BPSec-interop document?

Cheers,

Rick & Marc

_______________________________________________ dtn mailing list [email-masked] https://www.ietf.org/mailman/listinfo/dtn

---

From: "Birrane, Edward J." <[email-masked]>
Date: Wed, 29 Jul 2020 00:59:15 +0000

I agree that the COSE security context is useful and well written.

But I also agree with Mehmet; if we need to produce a “default” security context it should be made as simple as possible. To that end, I think a new version of the interop security contexts, re-imagined to be default operational security contexts that can also be used for interoperability is the way to go.

-Ed

Edward J. Birrane, III, Ph.D.
Embedded Applications Group Supervisor
Principal Staff, Space Exploration Sector
Johns Hopkins Applied Physics Laboratory
(W) 443-778-7423<tel:(443)%20778-7423> / (F) 443-228-3839<tel:(443)%20228-3839>

From: dtn <[email-masked]> On Behalf Of Mehmet Adalier
Sent: Tuesday, July 28, 2020 6:44 PM
To: Rick Taylor <[email-masked]>; [email-masked]
Subject: [EXT] Re: [dtn] Interoperability context and/or COSE

APL external email warning: Verify sender [email-masked]<mailto:[email-masked]> before clicking links or attachments

mehmet

From: dtn <[email-masked]<mailto:[email-masked]>> on behalf of Rick Taylor <[email-masked]<mailto:[email-masked]>>
Date: Monday, July 27, 2020 at 6:09 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [dtn] Interoperability context and/or COSE

Hi All,

  1.  Should BPsec-interop be updated to be ‘production grade’?
  2.  Should the COSE security context be adopted as a WG document?
  3.  Should the COSE security context replace the BPSec-interop document?

Cheers,

Rick & Marc
_______________________________________________ dtn mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/dtn