[Lake] EDHOC negotiation and errors

["Sipos, Brian J." <[e-mail]>]

Hello,

I've been a long-time user of COSE and more recently have been investigating
the use of EDHOC as a means of key agreement over long- and variable-delay
links. It seems to be quite a good fit to cover the same capabilities of
IPsec IKE and DTLS handshake in a transport-agnostic way. One part that
seems to be missing is a standard way for EDHOC endpoints to negotiate
credential contents.

 

My use case would be optimized if there was a way for an endpoint to include
in the ID_CRED_x an "x5t" parameter by default for terseness with known
peers but be able to have the peer signal back an "unknown credential
referenced" error so that the ID_CRED_x could instead be sent with an entire
"x5chain" which would then be cached on the peer. The distinction here is
"unknown credential referenced" meaning the peer doesn't have the credential
versus "invalid credential type" meaning the peer can't handle the given
type (KID vs. x5t vs. x5u, etc.). The reason for this kind of negotiation is
that the x5t ID would be significantly smaller than the full x5chain.

 

I don't see any earlier mailing list discussion on this topic and there's no
private use or experimental range reserved for the error code registry, so I
don't see any way of communicating these types of negotiation in an
interoperable way. Obviously a follow-on document could make these kinds of
error code allocations with accompanying logic, but this seems like a
'typical' use case for EDHOC on an open network.

Any thoughts?

 

Brian S.