Re: [dtn] Interoperability context and/or COSE

Regarding the questions posed below:

Yes, I believe that the BPsec interoperability security context should be useable in environments beyond interoperability-testing. I am not sure what ‘production grade’ entails, but I will be more than happy to contribute to this effort.

Regarding “Should the COSE security context replace the BPSec-interop document?” 

I have extensively reviewed the COSE RFC. While this is a well written RFC, I am not convinced that the overhead introduced provides a tangible security benefit. While it attempts to standardize, its complexity increases the amount of processing code and the attack surface. My vote will be no, it should not replace the BPsec interop document.

mehmet

From: dtn <dtn-bounces@ietf.org> on behalf of Rick Taylor <rick@tropicalstormsoftware.com>
Date: Monday, July 27, 2020 at 6:09 AM
To: "dtn@ietf.org" <dtn@ietf.org>
Subject: [dtn] Interoperability context and/or COSE

Hi All,

At IETF-108 a question was raised as whether the existing BPSec interoperability security context should be useable in environments beyond interoperability-testing.

A second question was raised: whether the COSE security context would actually make a good replacement for the BPSec interoperability security context draft.

The chairs are interested in discovering WG consensus on the following topics:

Should BPsec-interop be updated to be ‘production grade’?
Should the COSE security context be adopted as a WG document?
Should the COSE security context replace the BPSec-interop document?

Cheers,

Rick & Marc

_______________________________________________ dtn mailing list dtn@ietf.org https://www.ietf.org/mailman/listinfo/dtn 