[core] Update to external_aad in OSCORE

[Francesca Palombini <[e-mail]>]

Hi,

After receiving some review comments from Jim about Group OSCORE ( https://mailarchive.ietf.org/arch/msg/core/kx3ePNG3RbxtoFC9pZnYKggccew ), and following off-list discussion, we have a proposal to update the external_aad in OSCORE to add the ID Context.

More precisely, the external_aad would be modified from:

external_aad = bstr .cbor aad_array

aad_array = [
  oscore_version : uint,
  algorithms : [ alg_aead : int / tstr ],
  request_kid : bstr,
  request_piv : bstr,
  options : bstr,
]

to:


external_aad = bstr .cbor aad_array



aad_array = [

  oscore_version : uint,

  algorithms : [ alg_aead : int / tstr ],

  request_kid : bstr,

  request_piv : bstr,

  kid_context : bstr / nil,

  options : bstr,

]
where the kid_context is the ID Context (or nil if not present).

We have not identified any issues with ID Context not being part of the external_aad in OSCORE (unicast), as it is linked to the keying material via the security context key derivation. However, the same external_aad structure is used both in unicast and group settings, both for AEAD and for signing. As it could be helpful to have ID Context in the external_aad for the signature, we propose to do this change in unicast OSCORE to keep OSCORE and group OSCORE aligned.

This change means that the ID Context (which in Group OSCORE contains the group identifier) would be integrity protected (and signed in group OSCORE) in each message, rather than just part of the key derivation.

This change does not add any overhead to the message as external_aad is not sent, and is a very little modification implementation-wise. The biggest consequence would be draft-wise to re-create and update the test vectors in appendix C.

We have had discussions with some implementers, and they don’t see an issue with this change. If anybody sees a problem with it, please let us know.

Thanks,
Francesca