Re: [COSE] WG Action: Rechartered CBOR Object Signing and Encryption (cose)

[Jim Schaad <[e-mail]>]

YEAAAAAH

And many thanks to EKR.

Jim


> -----Original Message-----
> From: COSE <[e-mail]> On Behalf Of The IESG
> Sent: Thursday, January 3, 2019 3:19 PM
> To: IETF-Announce <[e-mail]>
> Cc: [e-mail]; The IESG <[e-mail]>; [e-mail]
> Subject: [COSE] WG Action: Rechartered CBOR Object Signing and Encryption
> (cose)
> 
> The CBOR Object Signing and Encryption (cose) WG in the Security Area of
the
> IETF has been rechartered. For additional information, please contact the
Area
> Directors or the WG Chairs.
> 
> CBOR Object Signing and Encryption (cose)
> -----------------------------------------------------------------------
> Current status: Proposed WG
> 
> Chairs:
>   Matthew Miller <[e-mail]>
>   Ivaylo Petrov <[e-mail]>
> 
> Assigned Area Director:
>   Eric Rescorla <[e-mail]>
> 
> Security Area Directors:
>   Eric Rescorla <[e-mail]>
>   Benjamin Kaduk <[e-mail]>
> 
> Mailing list:
>   Address: [e-mail]
>   To subscribe: https://www.ietf.org/mailman/listinfo/cose
>   Archive: https://mailarchive.ietf.org/arch/browse/cose/
> 
> Group page: https://datatracker.ietf.org/group/cose/
> 
> Charter: https://datatracker.ietf.org/doc/charter-ietf-cose/
> 
> CBOR Object Signing and Encryption (COSE, RFC 8152) describes how to
create
> and process signatures, message authentication codes, and encryption using
> Concise Binary Object Representation (CBOR, RFC 7049) for serialization.
> COSE additionally describes a representation for cryptographic keys.
> 
> COSE has been picked up and is being used both by a number of groups
within
> the IETF (i.e. ACE, CORE, ANIMA, 6TiSCH and SUIT) as well as outside of
the
> IETF (i.e. W3C and FIDO).  There are a number of implementations, both
open
> source and private, now in existence.  The specification is now
sufficiently
> mature that it makes sense to try and advance it to STD status.
> 
> The standards progression work will focus on:
> 1. Should the document be split in two?  The first document would
>    contain the definitions of the structures and rules for processing
>    them.  The second document would contain the set of original
>    algorithms that were defined.
> 2. What areas in the document need clarification before the document
>    can be progressed?
> 3. What implementations exist and do they cover all of the major
>    sections of the document?
> 4. Resolution of any Errata or ambiguities in the document
> 
> There are a small number of COSE related documents that will also be
> addressed by the working group dealing with additional attributes and
> algorithms that need to be reviewed and published.  The first set are
listed
> below in the deliverables.  A re-charter will be required to expand this
list.
> 
> The SUIT working group has identified a need for the use of hash-based
> signatures in the form of Leighton-Micali Signatures (LMS) (draft-mcgrew-
> hash-sigs).  This signature form is resistant to quantum computer attacks
and is
> low-cost for validation.  The SUIT working group additionally has
identified a
> need for registering hash functions for indirect packaging.
> 
> The W3C Web Authentication working group has identified a need for the
> ability to use algorithms which are currently part of TPMs which are
widely
> deployed.
> 
> At the time COSE was developed, there was a sense that X.509 certificates
> were not a feature that needed to be transferred from the JOSE key
document
> (RFC 7517).  Since that time a better sense of how
> X.509 certificates would be used both in the IoT sphere and with COSE
outside
> of the IoT sphere has been developed.  The ability to identify or carry
X.509
> certificates now needs to be provided.  This will require the definition
of a
> small number of hash functions for compact references to X.509
certificates.
> 
> Key management and binding of keys to identities are out of scope for the
> working group.  The COSE WG will not innovate in terms of cryptography.
The
> specification of algorithms in COSE is limited to those in RFCs, active
CFRG or
> IETF WG documents, or algorithms which have been positively reviewed by
the
> CFRG.
> 
> The working group will coordinate its progress with the ACE, SUIT and CORE
> working groups to ensure that we are fulfilling the needs of these
> constituencies to the extent relevant to their work.  Other groups may be
added
> to this list as the set of use cases is expanded, in consultation with the
> responsible Area Director.
> 
> The WG will have five deliverables:
> 
> 1. Republishing a version of RFC 8152 suitable for advancement to Internet
>    Standard.
> 2. Use of Hash-based Signature algorithms in COSE using
>    draft-housley-suit-cose-hash-sig as a starting point (Informational).
> 3. Placement of X.509 certificates in COSE messages and keys using
>    draft-schaad-cose-x509 as a starting point (Informational).
> 4. Define the algorithms needed for W3C Web Authentication for COSE using
>    draft-jones-webauthn-cose-algorithms and draft-jones-webauthn-secp256k1
>    as a starting point (Informational).
> 5. Define a small number of hash functions for X.509 certificate
thumbprints
>    and for indirect signing (for SUIT) (Informational).
> 
> 
> _______________________________________________
> COSE mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/cose