Re: [core] John Scudder's Discuss on draft-ietf-core-oscore-edhoc-10: (with DISCUSS)

[Marco Tiloca <[e-mail]>]

Hello John,

Thanks a lot for your review! Please find in line below our detailed 
replies to your comments.

A Github PR where we have addressed your comments is available at [PR].

Unless any concern is raised, we plan to soon merge this PR (and the 
other ones related to other received reviews), and to submit the result 
as version -11 of the document.

Thanks,
/Marco

[PR] https://github.com/core-wg/oscore-edhoc/pull/25

On 2024-04-03 18:29, John Scudder wrote:
> [You don't often get email [e-mail]. Learn why this is important athttps://aka.ms/LearnAboutSenderIdentification  ]
>
>> On Apr 3, 2024, at 11:45 AM, Carsten Bormann<[e-mail]>  wrote:
> ...
>> We could make this a bit more standing out as in RFC 8881:
>>
>>    Hence, all assignments to the registry are made on a Standards Action
>>    basis per Section 4.6 of [63], with Expert Review required.
>>
>> ([63] is an obfuscated reference to RFC 8126, where the section referenced of course actually should be 4.9).  We could then add that RFC 7120 applies.
> That sounds good to me. I might word it as “with Expert Review required in addition” but polish as you see best.
>
> Given that IANA has also indicated to me in a side channel that the policy name as written already works for them, I’ve moved to COMMENT in any case, but I think it’ll be helpful for innocent bystanders at least, to improve the text in the spec as you suggest.

==>MT

We have made the following updates in Sections 8.3 and 8.4.


OLD (Section 8.3):
 > IANA is requested to create a new "EDHOC Authentication Credential 
Types" registry within the "Ephemeral Diffie-Hellman Over COSE (EDHOC)" 
registry group defined in [I-D.ietf-lake-edhoc].
 >
 > The registry uses the "Expert Review" registration procedure 
[RFC8126]. Expert Review guidelines are provided in Section 8.4.
 >
 > The columns of this registry are:

NEW (Section 8.3):
 > IANA is requested to create a new "EDHOC Authentication Credential 
Types" registry within the "Ephemeral Diffie-Hellman Over COSE (EDHOC)" 
registry group defined in [I-D.ietf-lake-edhoc].
 >
 > As registration policy, the registry uses either "Standards Action 
with Expert Review", or "Specification Required" per Section 4.6 of 
[RFC8126]. Expert Review guidelines are provided in Section 8.4.
 >
 > All assignments according to "Standards Action with Expert Review" 
are made on a "Standards Action" basis per Section 4.9 of [RFC8126], 
with Expert Review additionally required per Section 4.5 of [RFC8126]. 
The procedure for early IANA allocation of Standards Track code points 
defined in [RFC7120] also applies. When such a procedure is used, review 
and approval by the designated expert are also required, in order for 
the WG chairs to determine that the conditions for early allocation are 
met (see step 2 in Section 3.1 of [RFC7120]).
 >
 > The columns of this registry are:


OLD (Section 8.4)
 > The IANA registry established in this document is defined as "Expert 
Review".

NEW (Section 8.4)
 > The IANA registry established in this document is defined as 
"Standards Action with Expert Review" or "Specification Required", 
depending on the range of values for which an assignment is requested.

<==

>
> Hopefully, we’ll be able to do a less ad-hoc fix in 8216bis/7120bis.
>
> Thanks,
>
> —John

-- 
Marco Tiloca
Ph.D., Senior Researcher

Phone: [phone]

RISE Research Institutes of Sweden AB
Box 1263
164 29 Kista (Sweden)

Division: Digital Systems
Department: Computer Science
Unit: Cybersecurity

https://www.ri.se