[core] Missing must in the Group OSCORE document

[Jim Schaad <[e-mail]>]

Christian,

 I have been thinking about the problem case of having a duplicate IV reuse
in the case where I suggested that we use separate IV spaces for the group
and pairwise keying materials.  I agree that this is a problem, however the
problem is greater than what you outlined.  This is going to be a situation
that will arise anytime that the request comes in under one security context
and the response goes out under a different security context.  In this
situation you will always have the problem that a reflected IV value from
context 1 will lead to a potential IV reuse in context 2.

Missing requirement in the document:

A server MUST use a PIV value from it's own sender context when ever it
would normally use a reflected IV, but the security context for the request
and response are not the same.

Jim