Re: [Lake] [core] 🔔 Working Group Last Call (WGLC) of draft-ietf-core-oscore-edhoc-06

[Christian Amsüss <[e-mail]>]

On Thu, Mar 09, 2023 at 10:40:32AM +0000, John Mattsson wrote:
> A reason why you sometimes want to decouple authentication from key
> derivation and continuing the security protocol is that authentication
> might take a long time (request to some database, popup for the human
> user to click OK/Deny, etc). The EDHOC specification should be clear
> on what is allowed and not. If always waiting for authentication is
> preferred from an implementation perspective then maybe EDHOC should
> mandate that. The important part is that everybody agrees on what is
> possible and not.

Good points; it might easily be practical for the responder to derive
the keys once message 3 is received, rather than wait for all
confirmations to arrive.

> > Then maybe "[on error], OSCORE key material MUST NOT be derived from the EDHOC exchange, let alone
> > be used to protect the respone"?

Then, "MUST NOT be used" is probably the better wording.

BR
c

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom