Re: [core] Tossing around URIs to use outside an application

[Michael Richardson <[e-mail]>]

Christian Amsüss <[e-mail]> wrote:
    > A thing that came up in last week's interim is the usability of URIs
    > that you are just "tossed", with respect to secure usage.

Yes, I agree that this is an issue.
I've been thinking about it all day yesterday.
(Since I was awake at 4am for RIPE82, and I passed out on the couch in the
mid-afternoon, I have to repoprt that I actually kinda dreamt about this.
This is a kinda of "day-mare" that I just don't recommend.)

    > (And apologies for the long mail; if I had the clarity of the problem
    > I'd like to have it would be shorter).

I always thought that Mark Twain first said this, but apparently he might
have been quoting, and it might have been Voltaire who first said this.
I've omitted your UI thoughts, because I think that they are mostly spot-on,
but may be distracting.

    > For reference, a question was whether EDHOC-authenticated CoAP would
    > use its own "coape" scheme, or if not how a user of "coaps" would know
    > whether it's DTLS or EDHOC+OSCORE secured, or (given coaps implies
    > DTLS) how a coap user would know whether to use plain CoAP or try
    > EDHOC, and if so at which authentication endpoint with which
    > credentials.

I think that we should just focus the discussion here.
I think we probably need a coape:// scheme, but coap->coape upgrade should be common.

EDHOC is unlike DTLS (or HTTPS before it), because doing EDHOC requires
transactions at the CoAP layer to resources other than the intended target
resource.
Given that we do all of this because we think that we might be proxying
through other transports (TCP X HTTP X BTLE) I think that any kind of DNS or
discovery ahead of time may be a irrelevant.
I think that the discovery/dynlink process should create a channel
towards the target.  The channel might include clues, like those returned by DANE.
But, I think that we must always be prepared to accept 4.01
(or maybe another new code) says to authenticate.  We might get this code
even though we already think we have an EDHOC session up, because maybe we
used the wrong credential.

    >   As it finds a DANE record with a public key along with the name it
    > resolves, it initiates EDHOC expecting that public key; for itself it
    > sets a key-by-value as it has no key it expects to be usable for that
    > server.

I can accept this as a hint process.

    > What I'm leaning towards taking from this is that we should be able to
    > support tossable URIs, but what they would look like in practice in a
    > CoREnvironment may need looking into.

    > Do you think that would work?

If we want to avoid disclosing the URL that we using and then get the 4.01,
then we should doing an opportunistic EDHOC to get privacy.  How (and if)
that is authenticated is something we should discuss.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide