[core] oscore-groupcomm: Thoughts on the role of the Group Manager

[Robert Quattlebaum <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello everyone,

I was reviewing draft-ietf-core-oscore-groupcomm-02 and had some
comments, specifically to the role of the group manager.

First off, overall the direction looks fantastic.

Second, appendix D.1 outlines a process for an endpoint becoming a
member of the group. In this process, the endpoint itself petitions
the Group Manager to be made a part of the group. This seems obtuse to
me: Presumably, an authenticated administrative interaction was
required to configure that endpoint to know to request to join that
group. Wouldn't it make sense to also configure the rest of the
required data to participate in the group in the same administrative
action?

It also seems at odds with the third responsibility of a Group Manager
outlined in section 6: "Driving the join process to add new endpoints
as group members". In Appendix D.1, it is the endpoint initiating the
join, not the Group Manager.

Specifically, what I'm proposing is that endpoints don't ask the Group
Manager to join a group: instead, the administrator indicates to the
Group Manager that a specific endpoint should be added to the group,
and at that point the group manager goes ahead and configures the
newly added endpoint accordingly. Strictly speaking, I don't even
think an endpoint even needs to know who the Group Manager is.

The Group Manager already needs the capability to configure endpoints
to reconfigure and eject devices from the group. Eliminating the
(apparent) requirement for an endpoint to be able to ask to join a
group makes implementations more simple without sacrificing any
functionality. It would also simplify the required security
interactions. It also allows for the Group Manager to be an offline
device that only appears during administrative actions.

Thoughts?

- -\- RQ
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEyqyznYdlVWku4iGibiytsfqnyUQFAls2lSIACgkQbiytsfqn
yUQx7Af+J2l7KgFGXaJvnCFYE1mYzQ3ralzsAeFOa5V57CWwX4qPg1oVnwXFrQ2q
PFEUB09ovAHHEhI0AmHHSt6tJWwJ8LxGs9vkdwdy/5O4nDGml8ix/gksEzKb66MA
q1ilk5qns491vCCfpkCzqcNqaE2wT8n/gnF1a5G1lmeARpOkKHhwOzQ+mKObl0ux
akCOMdtZcEjVw+npFqWEMxmmtJIcl0JQIXoIxuPO1eSClaxR6KnP19oHrhrhJHuq
W61XyucLWEzwD/mQx3LaeI5UGRdoFOFEVjhQd22AeQYWNaUbygQ8ozz+I6vpkplo
l/1LbPhyYMDzEQ0FOgx7Kau3O3Su6A==
=kvhP
-----END PGP SIGNATURE-----