Re: [COSE] Proposed charter update

[Göran Selander <[e-mail]>]

Hi Jim,

Thanks for commenting. 

On the term "native CBOR certificate" in draft-mattsson-cose-cbor-cert-compress.

We are not specially attached to this term. Happy to replace it with some other adjective or just use "CBOR certificate type 1",  "CBOR certificate type 2", if that is less confusing. 

We did not intend to define "native CBOR" (like in 1. below), the intended parenthesis is like this: native (CBOR certificate). Not like this: (native CBOR) certificate.

The rationale (perhaps twisted, but anyway) is like this: Assume there is a device which speaks CBOR (i.e. "is native in CBOR"), then it should be able to parse and verify a "native" CBOR certificate without knowing of other encodings.

We are not targeting an X.509 certificate replacement as in 2. below. The only difference between the compressed X.509 format and the native format is in what is being signed. In the former the signature is on the uncompressed ASN.1/DER encoding, in the latter the signature is on the CBOR encoding, like in 3. below.

Hope that helps.

Göran

On 2020-09-25, 19:02, "COSE on behalf of Jim Schaad" <[e-mail] on behalf of [e-mail]> wrote:

    I just made a relatively fast read through on the compressed certificate draft.  If we are looking to do "native CBOR" certificates then I think that we need to be very explicit what it is meant by "native CBOR".  When I hear that term I end up with a number of different things that this could end up being:

    1.  A CBOR Encoding for ASN.1.
    2.  A CBOR Encoding for an X.509 certificate replacement.  (CWT?)
    3.  What is being proposed in the document which amounts to CBOR Compressed X.509 certificate signed in the CBOR format.

    It might be that coining a new term for this might be best because I definitely got a surprise on the definition.

    Jim


    -----Original Message-----
    From: COSE <[e-mail]> On Behalf Of Göran Selander
    Sent: Friday, September 25, 2020 6:31 AM
    To: [e-mail]
    Subject: [COSE] Proposed charter update

    Hi,

    We got an action last meeting to propose new text for the charter. Please find a proposal below.

    OLD is the charter *after* incorporating the changes proposed by John (as discussed in the meeting):
    https://mailarchive.ietf.org/arch/msg/cose/bUSlA5k5k855lVEq6ZnP1KPO0Cg/

    NEW is the proposal. The first and last paragraph of OLD are unchanged, and the middle paragraph is replaced with two new ones.


    OLD
    ---
    A CBOR encoding of the compressed certificate profile defined in RFC 7925. It is expected that the compression works with a large subset of RFC 7925 and takes into consideration any updates in draft-ietf-uta-tls13-iot-profile-00. The compression may also include other important IoT certificate profiles like IEEE 802.1AR.

    It should be noted that this is not a new certificate architecture, rather it is a method of compressing current X.509 certificates that meet a specific profile into a smaller format. The compression algorithm is loss-less so they can be expanded and normal X.509 certificate processing used.

    This work will be based on draft-mattsson-cose-cbor-cert-compress. The working group will collaborate and coordinate with other IETF WGs such as TLS, UTA, LAKE to understand and validate the requirements and solution.
    ---

    NEW
    ---
    A CBOR encoding of the compressed certificate profile defined in RFC 7925. It is expected that the compression works with a large subset of RFC 7925 and takes into consideration any updates in draft-ietf-uta-tls13-iot-profile-00. The compression may also include other important IoT certificate profiles like IEEE 802.1AR.

    The main objective is to define a method of compressing current X.509 certificates that meet a specific profile into a smaller format. This compression algorithm is loss-less so they can be expanded and normal X.509 certificate processing used.

    Another objective is to explore the possibility to parse and verify the compressed X.509 encoding directly on the target device. This removes the need for compression, decompression, and DER parsing, with associated overhead and code, which is relevant for embedded implementations.

    This work will be based on draft-mattsson-cose-cbor-cert-compress. The working group will collaborate and coordinate with other IETF WGs such as TLS, UTA, LAKE to understand and validate the requirements and solution.
    ---

    Göran



    On 2020-09-23, 18:35, "COSE on behalf of John Mattsson" <[e-mail] on behalf of john.mattsson=[e-mail]> wrote:

         Three suggestion regarding certificate compression in the charter.

        OLD
        "A CBOR encoding of the compressed certificate profile defined in RFC 7925."

        NEW
        "A CBOR encoding of the compressed certificate profile defined in RFC 7925. It is expected that the compression works with a large subset of RFC 7925 and takes into consideration any updates in draft-ietf-uta-tls13-iot-profile-00. The compression may also include other important IoT certificate profiles like IEEE 802.11AR."


        OLD:
        "This work will be based on draft-mattsson-cose-cbor-cert-compress and draft-raza-ace-cbor-certificates. It is expected these documents are to be combined into a single document."

        NEW
        "This work will be based on draft-mattsson-cose-cbor-cert-compress"


        ADD
        "The working group will collaborate and coordinate with other IETF WGs such as TLS, UTA, LAKE to understand and validate the
        requirements and solution."

        _______________________________________________
        COSE mailing list
        [e-mail]
        https://www.ietf.org/mailman/listinfo/cose

    _______________________________________________
    COSE mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/cose

    _______________________________________________
    COSE mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/cose