Re: [core] Orie Steele's Yes on draft-ietf-core-oscore-edhoc-10: (with COMMENT)

[Marco Tiloca <[e-mail]>]

Hello Orie,

Thanks a lot for your review! Please find in line below our detailed 
replies to your comments.

A Github PR where we have addressed your comments is available at [PR].

Unless any concern is raised, we plan to soon merge this PR (and the 
other ones related to other received reviews), and to submit the result 
as version -11 of the document.

Thanks,
/Marco

[PR] https://github.com/core-wg/oscore-edhoc/pull/21

On 2024-03-28 23:23, Orie Steele via Datatracker wrote:
> Orie Steele has entered the following ballot position for
> draft-ietf-core-oscore-edhoc-10: Yes
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer tohttps://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fabout%2Fgroups%2Fiesg%2Fstatements%2Fhandling-ballot-positions%2F&data=05%7C02%7Cmarco.tiloca%40ri.se%7C10367c31927c464a927d08dc4f75b351%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C638472614143510142%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=nuwinJScrt98c69FurBPHKWDE1aDrxyHTNnHhG4ZLlc%3D&reserved=0  
> for more information about how to handle DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://eur05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-core-oscore-edhoc%2F&data=05%7C02%7Cmarco.tiloca%40ri.se%7C10367c31927c464a927d08dc4f75b351%7C5a9809cf0bcb413a838a09ecc40cc9e8%7C0%7C0%7C638472614143521127%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=38mva%2F4zPyhvdaZTqDRnhyRSRNvPinaRxYop3tsIquc%3D&reserved=0
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Thanks to Shuping Peng for the ART-ART review.
> Thanks to Carsten Bormann for the shepherd writeup.
>
> In Section 2
>
> """
> The Content-Format of the request can be set to application/cid-edhoc+cbor-seq.
> """

==>MT

This is the "Overview" section, and its text is intended to recap the 
key concepts of EDHOC, without additions to or deviations from the 
formulation of 
https://datatracker.ietf.org/doc/html/rfc9528#appendix-A.2 , which says:

 > An EDHOC message has media type "application/edhoc+cbor-seq", whereas 
an EDHOC message prepended by a connection identifier has media type 
"application/cid-edhoc+cbor-seq"; see Section 10.9.

That is, it is a fact that the EDHOC message mentioned in the quoted 
text **has** the Content-Format application/cid-edhoc+cbor-seq. What the 
message sender may or may not do is specifically including the CoAP 
Option "Content-Format" that specifies the corresponding Content-Format 
identifier.

That said, this is a good opportunity to rephrase the sixth, seventh, 
and eight paragraphs to be consistent with the formulation in 
https://datatracker.ietf.org/doc/html/rfc9528#appendix-A.2 . With that 
in mind, we have made the following changes:

OLD (sixth paragraph):
 > The Content-Format of the request can be set to 
application/cid-edhoc+cbor-seq.

NEW (sixth paragraph):
 > The request has Content-Format application/cid-edhoc+cbor-seq.

OLD (seventh paragraph):
 > The Content-Format of the response can be set to 
application/edhoc+cbor-seq.

NEW (seventh paragraph):
 > The response has Content-Format application/edhoc+cbor-seq.

OLD (eighth paragraph):
 > The Content-Format of the request can be set to 
application/cid-edhoc+cbor-seq.

NEW (eighth paragraph):
 > The request has Content-Format application/cid-edhoc+cbor-seq.

<==

> SHOULD ? or MUST ?.. same question for the use of "can" in the following
> sections.
>
> In Section 3.2.1
>
> """
> The application/cid-edhoc+cbor-seq media type does not apply to this message,
> whose media type is unnamed. """
>
> I think this is intending to say "application/cid-edhoc+cbor-seq" SHOULD NOT be
> used for this message... but this could be clearer if a media type was named.
>

==>MT

We believe that the text is correct as-is, so we have made no changes.

In fact, the following statement would not be correct:

 > The application/cid-edhoc+cbor-seq media type SHOULD NOT be used for 
this message, whose media type is unnamed.

First, it is a fact that the combined EDHOC + OSCORE request has exactly 
the media type that it has, which is unnamed and not really needed to be 
registered by name or other identifier.

Second, under no circumstances has the payload of that request the 
representation format that the media type application/cid-edhoc+cbor-seq 
indicates. In particular, the payload as a whole is not an EDHOC 
message, and especially not an EDHOC message prepended by an EDHOC 
connection identifier as the media type application/cid-edhoc+cbor-seq 
would indicate.

<==

>

-- 
Marco Tiloca
Ph.D., Senior Researcher

Phone: [phone]

RISE Research Institutes of Sweden AB
Box 1263
164 29 Kista (Sweden)

Division: Digital Systems
Department: Computer Science
Unit: Cybersecurity

https://www.ri.se