Re: [Ace] [COSE] Gap in registration of application/cwt?

Laurence Lundblade <lgl@island-resort.com> Sat, 15 August 2020 17:58 UTC

Return-Path: <lgl@island-resort.com>
X-Original-To: ace@ietfa.amsl.com
Delivered-To: ace@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F5AD3A089D for <ace@ietfa.amsl.com>; Sat, 15 Aug 2020 10:58:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.894
X-Spam-Level:
X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FwK6zBPZ-fa6 for <ace@ietfa.amsl.com>; Sat, 15 Aug 2020 10:58:25 -0700 (PDT)
Received: from p3plsmtpa06-05.prod.phx3.secureserver.net (p3plsmtpa06-05.prod.phx3.secureserver.net [173.201.192.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 728443A08A3 for <ace@ietf.org>; Sat, 15 Aug 2020 10:58:25 -0700 (PDT)
Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id 70RkkF98s5Zij70RkkXsxV; Sat, 15 Aug 2020 10:58:24 -0700
X-CMAE-Analysis: v=2.3 cv=XP9OtjpE c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=VrHXGImtAAAA:8 a=K6EGIJCdAAAA:8 a=48vgC7mUAAAA:8 a=bFzclpeIq9MwBgp7VhUA:9 a=8I6_VEMliVAvdM0K:21 a=48s_paRzSZvxVOPN:21 a=QEXdDO2ut3YA:10 a=eypa8oWK2F2CkhvW-8UA:9 a=X3EDfnADaIYM8snQ:21 a=N1mhsGAlisfas1Wx:21 a=LB8P8dvH4siyT6m8:21 a=_W_S_7VecoQA:10 a=rjybpTLx1R2UrS7S5igv:22 a=L6pVIi0Kn1GYQfi8-iRI:22 a=w1C3t2QeGrPiZgrLijVG:22
X-SECURESERVER-ACCT: lgl@island-resort.com
From: Laurence Lundblade <lgl@island-resort.com>
Message-Id: <39135152-A5D8-48AB-B882-B29DCE5E3811@island-resort.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_C2B0FD4B-89A1-446B-9435-8F88B4DBFA6D"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Date: Sat, 15 Aug 2020 10:58:23 -0700
In-Reply-To: <00af01d6728b$27579480$7606bd80$@augustcellars.com>
Cc: cose <cose@ietf.org>, Ace Wg <ace@ietf.org>
To: Jim Schaad <ietf@augustcellars.com>
References: <D964158E-4895-4C75-A27F-0141D4EDCE5A@island-resort.com> <004201d66f79$3d95ed10$b8c1c730$@augustcellars.com> <D2ADF917-F69E-40E4-AA03-DFF6DB8BB9B3@island-resort.com> <66829A45-EDC1-4317-AA0A-FD335B6CF820@island-resort.com> <00af01d6728b$27579480$7606bd80$@augustcellars.com>
X-Mailer: Apple Mail (2.3445.104.11)
X-CMAE-Envelope: MS4wfGxnkWHM0/BE/KxSnQg95LVNYBQvUmtTbHAgCNZvaAf4MtSLk+5SpkrhWAahs47BKs8xeWBbq3e7P58f62bPbu6rW6nknh4j5s0pL784XEOKPqVexQqz JvX26buXs4x+2WMp9QbJMYqi3VYFFshgSUExOy71r6INHMJbzA0FBaXHfXAEdWnDWXNA5jnId0Y7fN5nue2trIyUZMhPLLedeB/LVKaYMd2QTyIMNg9L7oOk
Archived-At: <https://mailarchive.ietf.org/arch/msg/ace/oDc839d9fG15mgW-PJCIpkhOLgo>
Subject: Re: [Ace] [COSE] Gap in registration of application/cwt?
X-BeenThere: ace@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" <ace.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ace>, <mailto:ace-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ace/>
List-Post: <mailto:ace@ietf.org>
List-Help: <mailto:ace-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ace>, <mailto:ace-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 15 Aug 2020 17:58:27 -0000


> On Aug 14, 2020, at 3:35 PM, Jim Schaad <ietf@augustcellars.com> wrote:
> 
>  
>  
> From: Laurence Lundblade <lgl@island-resort.com <mailto:lgl@island-resort.com>> 
> Sent: Friday, August 14, 2020 1:59 PM
> To: Jim Schaad <ietf@augustcellars.com <mailto:ietf@augustcellars.com>>
> Cc: Ace Wg <ace@ietf.org <mailto:ace@ietf.org>>; cose <cose@ietf.org <mailto:cose@ietf.org>>
> Subject: Re: [COSE] Gap in registration of application/cwt?
>  
> Here’s a series of scenarios that I think are legal CWT. These are allowed by RFC 8392, right?
>  
> 1) Explicitly tagged, no external type info needed
> - Has CWT tag
> - Has COSE type tag
> [JLS] Yes
>  
> 2) CWT identification by label, COSE type tagged
> - The CWT is a CBOR data item with a label. The definition of the label says the contents of the label are always CWT
> - No CWT tag necessary as it is implied by the label
> - Has a COSE type tag
> [JLS] Yes, the label could be internal to the CBOR object or external such as an media-type

I was being very specific with the term label, meaning a label/key identifying an item in a CBOR map.

>  
> 3) CWT and COSE by label
> - The CWT is an item with a label. The definition of the label says the contents of the label are always CWT and of a specific COSE type
> - No tags necessary
> [JLS] Yes that would be fine
>  
> 4) Application/CWT identifies content as CWT, tagging for COSE type
> - No CWT tag
> - Has a COSE tag
> [JLS] This is the same as 2?  I don’t think that it would be restricted to just that media type.

You mean there could be other media types that also identify the content as CWT?

>  
> 5) Application/CWT identifies content as CWT
> - Has CWT tag even though it is redundant 
> - Has a COSE tag
> [JLS] Yes

Additionally, one might interpret CBORbis 4.2.2 to say the the CWT tag should not be present.

>  
> 6) Application/CWT; cose-type=COSE_Sign1 (or Mac0 or …)
> - No tags are used
> - Identification is completely by the MIME type header
> - (I understand that the cose-type MIME parameter is not defined, but it could be. 8392 doesn’t forbid it)
> [JLS] Yes you could do that, and as I stated in a previous mail this is not a good idea for the CoAP world.
>  
> 7) A protocol like FIDO identifies a protocol element that is an attention type the type of which is CWT with COSE_Sign1
> - No tags are used
> [JLS] yes
>  
> 8) A protocol like FIDO identifies a protocol element that is an attention type the type of which is CWT; the COSE type is determined by tag
> - No CWT tag
> - Has a COSE tag
> [JLS] yes
>  
> The one thing you can’t do is have a CWT tag without a COSE type tag. 8392 section 6 forbids this.
>  
> [JLS] There however is a set of nested cases that you might need to look at.  That is 6.CWT ( COSE_Encrypt_Tagged ( COSE_Sign ))  You would also need to think about the requirements for nested COSE layers.

All but the most outer COSE type are always identified by a tag, per 7.1 step 5 and 7.2 step 6, right?

LL


>  
> Jim
>  
>  
> LL
>  
>  
>  
>  
> 
> 
>> On Aug 11, 2020, at 12:20 PM, Laurence Lundblade <lgl@island-resort.com <mailto:lgl@island-resort.com>> wrote:
>>  
>>  
>> 
>> 
>>> On Aug 10, 2020, at 5:49 PM, Jim Schaad <ietf@augustcellars.com <mailto:ietf@augustcellars.com>> wrote:
>>>  
>>> This is all based on my understanding that the surrounding protocol for must specify exactly when CBOR tags are to be used and when they are not to be used and that the surrounding protocol must not leave it as an optional implementation choice. In this case application/cwt is the supporting protocol.
>>>  
>>> [JLS] What is the text that says that this is true.  This would be a surprising statement for me.
>> 
>>  
>> Here’s three things that lead me to this.
>>  
>>> CBORbis
>>> The sentence of the first paragraph in 4.2.2 <https://tools.ietf.org/html/draft-ietf-cbor-7049bis-14#section-4.2.2> very clearly states this, though this is only for deterministic encoding.
>>>  
>>> Typical CDDL
>>> Most CDDL that describes tagged data describes it only as tagged or untagged, not as optionally tagged.  COSE is one example of this. 
>>>  
>>> Email threads
>>> This thread <https://mailarchive.ietf.org/arch/browse/cbor/?gbt=1&index=Hz7VjeBab9DxPas9E5_KfOmZwN0> and this thread <https://mailarchive.ietf.org/arch/browse/cbor/?gbt=1&index=y1EZ-IylFpJ3_MndQGADSbKhx0s>.
>>>  
>>> I summarized this behavior in this email <https://mailarchive.ietf.org/arch/msg/cbor/Hz7VjeBab9DxPas9E5_KfOmZwN0/> and no where in the rest of the thread was it indicated differently.
>>>  
>> So, it is not a hard requirement because 4.2.2 is only for deterministic encoding, but seems like a “should" in spirit. It is the preferred way to design a CBOR protocol.
>>  
>> However you slice it, I think it is up to the surrounding protocol to say whether a tag is always required, never required or optionally required. If the protocol doesn’t say, then it defaults to optionally required.
>>  
>> Defaulting or explicitly allowing optional tagging means the receiver has to allow for all the tagging scenarios and makes possible the error case where the surrounding protocol says the data is of one type and the tag conflicts with it. (e.g. an application/cwt that contains a tagged CoSWID).
>>  
>> I don’t think optional tagging is of any advantage in a protocol design. It doesn’t enable anything.
>>  
>> It has some disadvantage because it introduces error conditions and potential confusion.
>>  
>> I think there are several scenarios with section 6 and application/cwt that could be more clear.
>>  
>>> Can you use tag 61 or not? I think the current answer is that in application/cwt, tag 61 is optional.
>>>  
>>> How do you know what the COSE type is? It is somewhat obvious that COSE tags will work, but there is no requirement to use them. A MIME parameter or other is entirely allowed here.
>>>  
>>> Section 6 does say that determination that something is a CWT is application dependent, but doesn’t say that the COSE type is also application dependent. Section 7 does address this.
>>  
>> Said another way, my fully general CWT decoder that is called by some application needs an input parameter to indicate the COSE type because there is no requirement in 8392 that a CWT indicate which COSE type is in use. Sometimes the caller will be able to provide the COSE type and sometimes they won’t. Sometimes there will be an error of conflicting COSE type and sometimes the error will be that the COSE type can’t be determined.
>>  
>> I think it would have been cleanest if CWT always indicated the COSE type be used and the tagging optionality didn’t span two protocol layers, but that would be an incompatible change.  Maybe a recommendation that CWT’s SHOULD always indicate their COSE type?
>>  
>> LL
> 
>  
> _______________________________________________
> Ace mailing list
> Ace@ietf.org <mailto:Ace@ietf.org>
> https://www.ietf.org/mailman/listinfo/ace <https://www.ietf.org/mailman/listinfo/ace>