Re: [core] FW: Review draft-tiloca-core-oscore-discovery-04

[Marco Tiloca <[e-mail]>]

Hi Jim,

Thanks a lot for your review, also addressed in the latest submitted -05.

https://tools.ietf.org/html/draft-tiloca-core-oscore-discovery-05

Please, see some replies inline.

Best,
/Marco

On 2019-11-20 08:03, Jim Schaad wrote:
> Need to go here as well.
>
> -----Original Message-----
> From: Jim Schaad <[e-mail]> 
> Sent: Wednesday, November 20, 2019 3:03 PM
> To: '[e-mail]'
> <[e-mail]>
> Subject: Review draft-tiloca-core-oscore-discovery-04
>
> * Should this document be re-written to only use CoRAL-reef?

==>MT
As a first step, we have added an appendix with CoRAL versions of the
(re-)registration and lookup examples.
<==

>
> * Introduction - You have the statement that generally one application group
> uses one OSCORE group.  I don't know that I agree with this statement.  It
> depends to a large extent of how you define an application group.  For
> example, if you are looking at both administration and usage as being in the
> same App group then this is not a true statement.

==>MT
We have relaxed this assumption. Now an application group may use
multiple security groups.
<==

> * Section 2 - If you want ACE-KEY-GROUPCOMM-OSCORE to be an information
> reference, then the definition for 'name' needs to be changed.

==>MT
We have made ace-key-groupcomm-oscore an informative reference.

When introducing the attribute 'sec-gp', now we say: "'sec-gp',
specifying the name of the OSCORE group of interest, as a stable and
invariant identifier, such as the group name used in
[I-D.ietf-ace-key-groupcomm-oscore]".
<==

>
> * Section 2 - Just replace and use the correct terms for countersignature
> algorithm info and countersignature key info structures.

==>MT
Trying to also keep short names for the attributes, we have:

- renamed 'cs_crv' to 'cs_alg_crv';
- renamed 'cs_kty' to 'cs_key_kty';
- added 'cs_key_crv';
- update all examples accordingly.
<==

>
> * Section 3 - For 'app-gp' - the MAY is confusing to me.  Better to say MUST
> occur once for each application group and MUST contain only a single
> application group.  

==>MT
Done.
<==

>
> * Section 5 - I don't care if you specify the same application group
> multiple times.   I don't want to have to figure out how to check this one
> thing and error.  Plus the end result will always be the same anyway

==>MT
We have removed the last sentence "A same application group MUST NOT be
specified multiple times".
<==

>
> * Section 5.1 - I think the anchor in the response is supposed to be absent.

==>MT
See reply from Christian at:

https://mailarchive.ietf.org/arch/msg/core/bUlyq1zHYk5-YWV7RgTkdUkQ21k
<==

>
> * Section 6 - It looks like you are registering [2001:db8:4::4] twice - that
> looks like it will mess things up.
>
> * Section 6 - I am not sure why you are registering the app-grp on the
> individual device rather than on the group itself.  That means that If I go
> in reverse, from the app group to the address of the app group, then I get
> the individual endpoints rather than the group multicast address.  This
> might be done for somebody who wants to get the messages in the group and
> would be permitted to do so.

==>MT
Covering both comments, we have replaced 'app-gp' with a separate
attribute 'in-app-gp' reflecting a node's membership rather than the
group itself:

1) in the two registrations from the CT to the RD, right below the
paragraph "Consecutively, the CT registers ... ".

2) in the response from the RD to the joining nodes, right below the
paragraph "The device with IP address [2001:db8:4::x] can consequently
learn the groups to which it belongs".

The actual double registration is still there, so it's now an open point
about whether removing the registration of application-group members
altogether from the example, or collapse the two registrations into one,
with multiple instances of 'in-app-gp'.
<==

>
>
>
>
>
>
> _______________________________________________
> core mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/core

-- 
Marco Tiloca
Ph.D., Senior Researcher

RISE Research Institutes of Sweden
Division ICT
Isafjordsgatan 22 / Kistagången 16
SE-164 40 Kista (Sweden)

Phone: [phone]
https://www.ri.se