Re: [core] I-D Action: draft-ietf-core-object-security-13.txt

[Göran Selander <[e-mail]>]

Dear all,

We have submitted a new version of OSCORE. One of the review comments from
IESG was to provide more details of the security properties to simplify
the review. The basic content for this was already in version -12, but in
the process of completing this exercise, we went back to the assumptions
made on the protection of the CoAP options and made some reassessments as
is described below. This work involved the authors, some old and new
implementors. Meanwhile we also received further reviews which were
integrated in this version.

The following changes were made to the options:

* Observe is now additionally Inner, which enables the endpoints to verify
each others intent and simplifies the processing at the cost of making
some of the proxy processing out of scope. This resulted in a change of
Observe processing and we then took the opportunity to split out
option-specific processing which simplified the specification.

* No-Response is now essentially Inner, i.e. protected end-to-end,
resulting from a review from Jim Schaad. The processing is rewritten
accordingly.

* Uri-Host/Port processing is clarified in a separate subsection.

A corresponding change of the analysis of unprotected header fields was
made in appendix D.

We also did the following updates:

* HTTP processing updated based on comments from Martin Thomson.

* CoAP-to-CoAP Forwarding Proxy description is expanded.

* ID Context added to the security context. The message format already
contained the COSE header parameter 'kid context', and this is now
dedicated for transporting the ID Context. Such a parameter was already in
use by Group OSCORE and 6tisch Minimal Security and they can now apply
this in a common way.

* Updated deployment examples and test vectors (appendices B and C)

* Updated references


Best regards,
Göran



On 2018-06-27, 15:16, "core on behalf of [e-mail]"
<[e-mail] on behalf of [e-mail]> wrote:

>
>A New Internet-Draft is available from the on-line Internet-Drafts
>directories.
>This draft is a work item of the Constrained RESTful Environments WG of
>the IETF.
>
>        Title           : Object Security for Constrained RESTful
>Environments (OSCORE)
>        Authors         : Göran Selander
>                          John Mattsson
>                          Francesca Palombini
>                          Ludwig Seitz
>	Filename        : draft-ietf-core-object-security-13.txt
>	Pages           : 78
>	Date            : 2018-06-27
>
>Abstract:
>   This document defines Object Security for Constrained RESTful
>   Environments (OSCORE), a method for application-layer protection of
>   the Constrained Application Protocol (CoAP), using CBOR Object
>   Signing and Encryption (COSE).  OSCORE provides end-to-end protection
>   between endpoints communicating using CoAP or CoAP-mappable HTTP.
>   OSCORE is designed for constrained nodes and networks supporting a
>   range of proxy operations, including translation between different
>   transport protocols.
>
>
>The IETF datatracker status page for this draft is:
>https://datatracker.ietf.org/doc/draft-ietf-core-object-security/
>
>There are also htmlized versions available at:
>https://tools.ietf.org/html/draft-ietf-core-object-security-13
>https://datatracker.ietf.org/doc/html/draft-ietf-core-object-security-13
>
>A diff from the previous version is available at:
>https://www.ietf.org/rfcdiff?url2=draft-ietf-core-object-security-13
>
>
>Please note that it may take a couple of minutes from the time of
>submission
>until the htmlized version and diff are available at tools.ietf.org.
>
>Internet-Drafts are also available by anonymous FTP at:
>ftp://ftp.ietf.org/internet-drafts/
>
>_______________________________________________
>core mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/core