Re: [Ace] [COSE] Gap in registration of application/cwt?

Jim Schaad <ietf@augustcellars.com> Tue, 11 August 2020 00:49 UTC

Return-Path: <ietf@augustcellars.com>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB1813A0E6B; Mon, 10 Aug 2020 17:49:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pjDb-nNbIqk4; Mon, 10 Aug 2020 17:49:22 -0700 (PDT)
Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A5623A0E6A; Mon, 10 Aug 2020 17:49:21 -0700 (PDT)
Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 10 Aug 2020 17:49:15 -0700
From: Jim Schaad <ietf@augustcellars.com>
To: 'Laurence Lundblade' <lgl@island-resort.com>, 'Ace Wg' <ace@ietf.org>, 'cose' <cose@ietf.org>
References: <D964158E-4895-4C75-A27F-0141D4EDCE5A@island-resort.com>
In-Reply-To: <D964158E-4895-4C75-A27F-0141D4EDCE5A@island-resort.com>
Date: Mon, 10 Aug 2020 17:49:13 -0700
Message-ID: <004201d66f79$3d95ed10$b8c1c730$@augustcellars.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0043_01D66F3E.9139D430"
X-Mailer: Microsoft Outlook 16.0
Content-Language: en-us
Thread-Index: AQEQxPObADvrQueaMVqePLeeIeR2QKq9Z/LQ
X-Originating-IP: [73.180.8.170]
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/gidwjN0e0LgKCF3QT5XMS3ootT4>
Subject: Re: [Ace] [COSE] Gap in registration of application/cwt?
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 11 Aug 2020 00:49:24 -0000

 

 

From: COSE <cose-bounces@ietf.org> On Behalf Of Laurence Lundblade
Sent: Monday, August 10, 2020 1:25 PM
To: Ace Wg <ace@ietf.org>; cose <cose@ietf.org>
Subject: [COSE] Gap in registration of application/cwt?

 

It doesn’t seem clear what the CBOR tagging requirements are when application/cwt is used to indicate a message is a CWT.

 

This is the text that I think it missing:

 

The CBOR CWT tag (61) must NOT be used. It is unnecessary because the media type already indicates it is a CWT.

 

The COSE type indicating tag MUST be present. It is necessary to determine whether what the COSE type is, whether it is COSE_Sign1, COSE_Mac0...

 

Another solution could be a MIME parameter added to the application/cwt indicating the COSE type.

 

[JLS] Yes that would have been an alternative that would work – However this option would require either that you use text content types for CoAP or you allocate N different integer content types one for each possible set of options that could be placed there.  The current solution is cleaner and smaller.

 

Step 3 in section 7.2 also seems wrong. It doesn’t make it an error for the COSE type tag to be absent when the CBOR CWT tag is present.

 

 

This is all based on my understanding that the surrounding protocol for must specify exactly when CBOR tags are to be used and when they are not to be used and that the surrounding protocol must not leave it as an optional implementation choice. In this case application/cwt is the supporting protocol.

 

[JLS] What is the text that says that this is true.  This would be a surprising statement for me.

 

Jim

 

 

LL