[dtn] BPSec contexts and blocks

[Brian Sipos <[e-mail]>]

Ed,
One thing which has come up in drafting the COSE security context is the notion of a Context ID and security block(s) in which the context can be present. Right now, the registry in Section 11.2 of BPSec [1] does not assign a Context ID to any particular security block(s) and there is no text which requires a Context ID to be present in only one type of security block.
In my initial go at defining the use of COSE in BPSec, I naively assumed that a Context ID would be limited to a single block type so allocated two Context IDs for COSE [2]. But in fact there is no distinction between these two contexts because the Result ID actually defines which operation is present (signature, MAC, or encrypt).

Is it reasonable to define only a single "COSE Context ID" and allow it to be used in either an Integrity or a Confidentiality Block?

Since neither BPSec [1] nor the Security Context Template [3] seem to mention this, can either be updated to to require a security context to explain which types of security block it is expected to be present (or not present) in?
Section 2.5.3 of [3] hints at this but uses the language "a security block" rather than distinguishing between different security block types. I expect that most contexts will only be defined for integrity or confidentiality but not both.

[1] https://datatracker.ietf.org/doc/html/draft-ietf-dtn-bpsec-22
[2] https://datatracker.ietf.org/doc/html/draft-bsipos-dtn-bpsec-cose-01#section-7.1
[3] https://datatracker.ietf.org/doc/html/draft-birrane-dtn-scot-00