WG Review: CBOR Object Signing and Encryption (cose)

[The IESG <[e-mail]>]

A new IETF working group has been proposed in the Security Area. The IESG
has not made any determination yet. The following draft charter was
submitted, and is provided for informational purposes only. Please send
your comments to the IESG mailing list (iesg at ietf.org) by 2015-05-25.

CBOR Object Signing and Encryption (cose)
------------------------------------------------
Current Status: Proposed WG

Assigned Area Director:
  Kathleen Moriarty <[e-mail]>

Mailing list
  Address: [e-mail]
  To Subscribe: https://www.ietf.org/mailman/listinfo/cose
  Archive: http://www.ietf.org/mail-archive/web/cose/

Charter:

Concise Binary Object Representation (CBOR, RFC 7049) is a concise binary
format for the serialization of data structured to an extended version of
the JSON data model. COSE seeks to create CBOR-based object signing and
encryption formats. One motivation for COSE was to reuse functionality
from the JOSE working group using the CBOR data representation as it is
more amenable to constrained nodes and constrained node networks (RFC
7228).

The JOSE working group recently completed producing representations for
cryptographic keys, message authentication (MACs), encryption, and
digital signatures, using JSON representation. 

The resulting formats will not be cryptographically convertible from or
to JOSE formats. This lack of a need for bit-for-bit compatibility will
enable some simplification in the adaptation process.

Criteria that should be considered in the decision making process,
changing from JSON to CBOR encoding include:
    o Maintain the current JOSE paradigms and formatting where feasible.
    o Minimize message size, code size, and computational complexity to
suit constrained environments, where this is expected to  be used.
    o Improve security
    o Provide new functionality for additional use cases that were not
required for JOSE. 

Key management and binding of keys to identities are out of scope for the
working group.  The COSE WG will not innovate in terms of cryptography. 
The specification of algorithms in COSE is limited to those in RFCs or
active IETF WG documents.

The working group will coordinate its progress with the ACE, DICE and
CORE working groups to ensure that we are fulfilling the needs of these
constituencies to the extent relevant to their work. Other groups may be
added to this list as the set of use cases is expanded.

The WG will have two deliverables:

1. A standards-track specification covering the same cryptographic
formats from JOSE, with optimizations for constrained device processing,
expressed in CBOR;
2. Registration for algorithms (such as AES-CCM-8) that are appropriate
for constrained environments.
The Working Group will use a wiki to track desired use cases for its
work, but does not intend to publish this as an RFC.

Milestones:
  Jun 2015 - Submit COSE specification as a WG item
  Jun 2015 - Submit COSE constrained-appropriate algorithms as a WG item
  Jan 2016 - Submit COSE specification to the IESG, for publication as a
Proposed Standard
  Jan 2016 - Submit COSE constrained-appropriate algorithms to the IESG,
for publication as a Proposed Standard