Re: [COSE] Updated drafts

[Francesca Palombini <[e-mail]>]

Hi Jim,

Thank you for this update. I have a couple of questions about the IANA registries in the algorithms draft.

* Why did you set the "Capabilities" of COSE Key Types registry to "kty, x "? In particular, I do not see why having "kty" in this column would be helpful at all. The kty value for each line in the "Capabilities" column should be the same as the value in the "Name" column, i.e. "1, crv" for Key Type 1, "2, crv" for Key Type 2, "3" for Key Type 3 etc. I suspect you did add it to match the "Parameters" column of section 9.2 of OSCORE groupcomm, but if that's the case, having only the second element of the current column would be enough. We could then define in OSCORE groupcomm the format as "kty (taken from "Name"), X taken from Capabilities for that kty".

* I would expect this document to define exactly how the fields in Capabilities are formatted, and what values they take. It is enough to have a sentence saying "crv is defined in section TBD, and can take the following values: TBD from this registry: TBD". Also, the reference column of this registry should be updated to also point to this document.

* I have a hard time understanding the update to COSE Algorithms registry. You have added a column called "Capabilities", and populated every raw for all the algorithms with the string "kty"? How does that help? Maybe you wanted to point to the COSE Key Type to use with that algorithm? That would mean adding a "Key Type" column (rather than a "Capabilities"), populated with the value from the "Name" or "Value" column of COSE Key Types registry, for each algorithm. Then we would extract the capabilities for that algorithm by looking at the Capabilities for the right key type. Another option would be to duplicate the information from "COSE Key Types" Capabilities into the Capabilities column of COSE Algorithm that you define, but I don't like duplicating things. If we cannot assume that "Capabilities" are the same for the algorithm and for the key type, I would add the "Capablities" column in the COSE Algorithm as well. Even then, I do think a "Key Type" column with the "Name" or "Value" from COSE Key Types would be useful. That is the way to link: "You use this type of key with this algorithm".

Example of what I think this should look like:

COSE Key Types registry:

Name | Value | Capabilities | Ref
         1 |   OKP |  crv | This doc
         2 |   EC2  |  crv | This doc

Crv field for Value OKP takes the values from Table 22 of RFC8152 for Key Type OKP
Crv field for Value EC2 takes the values from Table 22 of RFC8152 for Key Type EC2
etc

COSE Algorithms registry:

Add a "Key Type" parameter, that takes for value for example:

Name  | ... | Key Type
EdDSA | ... | OKP (or 1)
etc

Hope this makes sense,
Francesca

On 11/11/2019, 23:53, "COSE on behalf of Jim Schaad" <[e-mail] on behalf of [e-mail]> wrote:

    I have finally gotten to the point of sending this message.
    
    I updated three drafts before the submission deadline
    
    *  The X.509 and hash algorithm drafts were updated to address WGLC comments
    *  The Algorithms draft was updated with an attempt to get a more
    generalized version of what was needed by the group communication algorithm
    details.
    
    I need to get feedback on the new capabilities defintions to see if I have
    missed anything significant and to see if this will substitute for what was
    desired by the group communication authors.
    
    Jim
    
    
    _______________________________________________
    COSE mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/cose