Subject: Re: [Teep] JSON/JOSE vs. CBOR/COSE

From: Brendan Moran <[email-masked]>
Date: Mon, 24 Feb 2020 11:35:53 +0000

I also support using only one encoding, and I second keeping the TCB as small as possible, so I support using CBOR/COSE as the only encoding. In particular, if TEEP is going to keep a dependency on SUIT, this means that using JSON/JOSE for TEEP requires supporting both JSON/JOSE and CBOR/COSE, since SUIT already has a single encoding: CBOR/COSE. As such, using JSON/JSOE for TEEP dramatically increases the TCB from a single parser & cryptographic wrapper to two of each.

Personally, I don’t find CBOR/COSE significantly harder to debug than JSON. I find JSON unreadable unless it’s been formatted. I find CBOR unreadable unless it’s been decoded into diagnostic notation. I don’t find a substantial difference in overhead between these two.

Best Regards,
Brendan
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Michael Richardson <[email-masked]>
Date: Mon, 24 Feb 2020 12:07:10 -0500

Brendan Moran <[email-masked]> wrote:
    > I also support using only one encoding, and I second keeping the TCB as
    > small as possible, so I support using CBOR/COSE as the only
    > encoding. In particular, if TEEP is going to keep a dependency on SUIT,
    > this means that using JSON/JOSE for TEEP requires supporting both
    > JSON/JOSE and CBOR/COSE, since SUIT already has a single encoding:
    > CBOR/COSE. As such, using JSON/JSOE for TEEP dramatically increases the
    > TCB from a single parser & cryptographic wrapper to two of each.

This is true from a generality of specification point of view, but are there any
ways to use TEEP without SUIT?  (I think so, but I could be wrong, as my
TEEP-fu is weak)   It could be that those uses could specify JSON/JOSE, while
all SUIT/TEEP uses could specify CBOR/COSE.

Having said this, I'm already in favour of CBOR/COSE only, I just want to
make sure that we are clear about the possibilities.  A client implementation
could support one or the other, but not both.

    > Personally, I don’t find CBOR/COSE significantly harder to debug than
    > JSON. I find JSON unreadable unless it’s been formatted. I find CBOR
    > unreadable unless it’s been decoded into diagnostic notation. I don’t
    > find a substantial difference in overhead between these two.

+1

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-