Re: [Anima] constrained voucher examples updated --- voucher looks wrong

<ietf@augustcellars.com> Fri, 14 June 2019 18:35 UTC

From: ietf@augustcellars.com
To: 'Michael Richardson' <mcr+ietf@sandelman.ca>, 'Thomas Werner' <thomas-werner@siemens.com>, 'consultancy' <consultancy@vanderstok.org>, anima@ietf.org
References: <28559.1558924665@localhost>
In-Reply-To: <28559.1558924665@localhost>
Date: Fri, 14 Jun 2019 11:35:04 -0700
Message-ID: <007101d522df$e41217a0$ac3646e0$@augustcellars.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Language: en-us
Thread-Index: AQI6C3zosouMnyM+R/zZmAatMjR9kqXRqA9g
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima/43e9jow3syiFbHPPt85twhYzfbk>
Subject: Re: [Anima] constrained voucher examples updated --- voucher looks wrong
Precedence: list

So for kicks I did a quick run through the CMS side of things

Looking at the example in A.3.1 - there does not appear to be any content in
the message.  It has a content type of 'data', but the content itself is
detached.    Is this intended?

Jim


-----Original Message-----
From: Michael Richardson <mcr+ietf@sandelman.ca> 
Sent: Sunday, May 26, 2019 7:38 PM
To: Thomas Werner <thomas-werner@siemens.com>; consultancy
<consultancy@vanderstok.org>; anima@ietf.org
Cc: Jim Schaad <ietf@augustcellars.com>
Subject: constrained voucher examples updated --- voucher looks wrong


I have updated the appendix to draft-ietf-anima-constrained-voucher, which
contains the COSE signed CBOR vouchers.  I have included base64 of the
binary, as well as CBOR diagnostic format.
Please see:
 
https://github.com/anima-wg/constrained-voucher/blob/master/constrained-vouc
her.txt#L2218

I am including the private (EC) keys in PKCS1 form ("BEGIN EC PRIVATE KEY"),
perhaps I should use PKCS8/RFC5208 format ("BEGIN PRIVATE KEY") instead?

Thomas, and Jim, would you take a crack at validating the voucher-request
and parboiled (Registrar signed) voucher requests from these files?  The raw
binary files are at:
  https://github.com/anima-wg/constrained-voucher/tree/master/examples
along with the public keys.   It's just COSE signatures.

In doing this, I've discovered a bug in my code, and I believe it needs to
be fixed.  Specifically, it appears at line:
 
https://github.com/anima-wg/constrained-voucher/blob/master/constrained-vouc
her.txt#L2478

You'll notice:

   "00-D0-E5-F2-00-02", 11: "rIe_64PzENXdd32FApWcMQ", 12: "MII
   B5TCCAWugAwIBAgIBATAKBggqhkjOPQQDAjBzMRIwEAYKCZImiZPyLGQBGRY

that is, I've pinned the *base64* encoding of the registrar's DER encoded
certificate, rather than the DER encoding itself.  This is clearly wrong,
but I do it consistently and tolerantly so I don't notice.  I will be fixing
this.  However, the signature on the resulting object should be correct,
even if the contents are semantically wrong.

--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works  -=
IPv6 IoT consulting =-

[Anima] constrained voucher examples updated --- … Michael Richardson
Re: [Anima] constrained voucher examples updated … ietf
Re: [Anima] constrained voucher examples updated … ietf