Re: [COSE] Carrying certificate chains in COSE signed messages

From: COSE <cose-bounces@ietf.org<mailto:cose-bounces@ietf.org>> on behalf of Jim Schaad <ietf@augustcellars.com<mailto:ietf@augustcellars.com>>
Date: Friday 4 November 2016 at 19:48
To: "'Lundblade, Laurence'" <llundbla@qti.qualcomm.com<mailto:llundbla@qti.qualcomm.com>>
Cc: 'Samuel Erdtman' <samuel@erdtman.se<mailto:samuel@erdtman.se>>, "cose@ietf.org<mailto:cose@ietf.org>" <cose@ietf.org<mailto:cose@ietf.org>>
Subject: Re: [COSE] Carrying certificate chains in COSE signed messages

During the development of the COSE document, the creation of attributes to carry X.509 items was discussed.  Given the set of use cases that we had on our radar at the time it was decided that we did not need this at the time.  These were all cases where we were looking at constrained devices where the addition of the certificate to many messages was going to be a problem.  In this environment, if you were using X.509 then you would pre-distribute the certificates rather than carrying them in a message.

If we can identify a number of cases where we would be using X.509 certificates then I would be willing to create a document which would define the fields and how to use them.  It would appear that we might have one case, do people know of more?

This work could be very useful.

One use case is IoT device bootstrapping/on-boarding in a network using vendor issued public key certificates installed during manufacturing and used during deployment to authenticate certificate enrolment of operational certificates. There is recent work using IEEE 802.1AR which is based on X.509, but maybe other formats are more relevant.

In any case, defining certificate enrolment using COSE would make much more sense for constrained devices compared to the proposal to use CMS. The enrolment protocol can be authenticated using transport layer security or application layer security.

I don’t think we have a strong case for doing a new certificate format at this time, however if people think there is enough of a need then the next step would be for them to organize a BOF to see if they can attract enough attention.

Without excluding this case, it would be good to examine the feasibility of using the existing candidates in constrained devices before going forward with that.

Göran

Jim

From: Samuel Erdtman [mailto:samuel@erdtman.se]
Sent: Friday, November 04, 2016 10:49 AM
To: Derek Atkins <derek@ihtfp.com<mailto:derek@ihtfp.com>>
Cc: Lundblade, Laurence <llundbla@qti.qualcomm.com<mailto:llundbla@qti.qualcomm.com>>; Jim Schaad <ietf@augustcellars.com<mailto:ietf@augustcellars.com>>; cose@ietf.org<mailto:cose@ietf.org>
Subject: Re: [COSE] Carrying certificate chains in COSE signed messages

It might absolutely feel strange to have certificate chains in COSE since that would become the larger part of the message.
However I think Laurence has a point in the fact that It is more convenient to use CBOR then ASN1 even if you formally have the bandwidth and capacity to process ASN1.

Then there is the connection to existing trust infrastructure many organizations have well functioning PKIs setups and wants to use them.
Are you saying that we should only use COSE when building completely new systems with no interaction with existing infrastructure?
I think it would be good for adoption if we could support this use-case.
I could also imagine CAs adopting new certificate formats based on CBOR and COSE in the future and if that happens a transition would be much easier if they had the option to start using COSE today.
If this is a big no-no I guess JOSE would be the option.

//Samuel

On Fri, Nov 4, 2016 at 5:36 PM, Derek Atkins <derek@ihtfp.com<mailto:derek@ihtfp.com>> wrote:
Hi,

"Lundblade, Laurence" <llundbla@qti.qualcomm.com<mailto:llundbla@qti.qualcomm.com>> writes:

> 1) A CBOR/COSE implementation is much cleaner and nicer than a
> ASN.1/CMS implementation. It is less work to implement, easier to
> maintain, test and so on.

Yes...  This is part of my point.

>      Also it’s not just about the data size.
> Would guess that the code size difference between implementations of
> CBOR/COSE and ASN.1/CMS is larger than a cert.  Also you can add the
> X.509 cert to the protocol messages outside the constrained
> environment.

Sure, it's not just about data size, it's also about code size.  But if
you're using COSE then presumably size matters.

> Personally, I was hoping CBOR/COSE would replace ASN.1/CMS in the very
> long term. :-)

Why wait?

> 2) Same question as before. If not cert chains, then what?  Pretty
> sure the 3-party trust introduction with a well-known root cert is a
> fundamental model that COSE should support.

There is nothing wrong with cert chains per-se, but I would argue X.509
is the wrong solution for COSE.

> LL

-derek

>
>
> On Nov 4, 2016, at 7:23 AM, Derek Atkins <derek@ihtfp.com<mailto:derek@ihtfp.com>> wrote:
>
>> If your environment is so constrained that you want to use COSE, why
>> would you decide on X.509 as your certificate format??  Your cert chain
>> would likely be larger than your data payload!!
>>
>> -derek
>>
>> "Lundblade, Laurence" <llundbla@qti.qualcomm.com<mailto:llundbla@qti.qualcomm.com>> writes:
>>
>>> Yes, have a use case where I *think* I need to carry cert chains with
>>> a signed message.  I want to sign something in one place and I want
>>> someone far away to be able to verify it based on a trusted a root
>>> key.  Compatibility with extant and various cert management SW and
>>> services is also desirable.
>>>
>>> If not cert chains, then what?
>>>
>>> LL
>>>
>>>
>>> ________________________________________
>>> From: Jim Schaad <ietf@augustcellars.com<mailto:ietf@augustcellars.com>>
>>> Sent: Thursday, November 3, 2016 1:15 PM
>>> To: Lundblade, Laurence; cose@ietf.org<mailto:cose@ietf.org>
>>> Subject: RE: [COSE] Carrying certificate chains in COSE signed messages
>>>
>>> Do you have a use case where you are planning to use COSE and need to carry
>>> cert chains or is this just speculative?
>>>
>>> Jim
>>>
>>>
>>>> -----Original Message-----
>>>> From: COSE [mailto:cose-bounces@ietf.org<mailto:cose-bounces@ietf.org>] On Behalf Of Lundblade, Laurence
>>>> Sent: Thursday, November 03, 2016 12:40 PM
>>>> To: cose@ietf.org<mailto:cose@ietf.org>
>>>> Subject: [COSE] Carrying certificate chains in COSE signed messages
>>>>
>>>> For many use cases it is a requirement that a signed message carry leaf
>>> and
>>>> intermediate (X.509) certs that would be used to verify against a trusted
>>> root.
>>>>
>>>> It seems like the way to do this is with a COSE_Key, but there aren't any
>>>> examples or details.  Is this right?
>>>>
>>>> Thx
>>>>
>>>> LL
>>>>
--
       Derek Atkins                 617-623-3745<tel:617-623-3745>
       derek@ihtfp.com<mailto:derek@ihtfp.com>             www.ihtfp.com<http://www.ihtfp.com>
       Computer and Internet Security Consultant

_______________________________________________
COSE mailing list
COSE@ietf.org<mailto:COSE@ietf.org>
https://www.ietf.org/mailman/listinfo/cose