[Lake] COSE headers as EDHOC extension point

[Christian Amsüss <[e-mail]>]

Hi Lake group,

as issue [1] seems to have slipped through the GitHub summary, here
explicitly:

What is the expected behavior of recipients of an ID_CRED_x when there
is an unexpected additional item (tangentially related: an none at all)
is presented in the ID_CRED_x map?

AIU, EDHOC is not explicit, and there are two possible answers:

1. All elements must be understood, or processing fails.

  That makes everything very easy (except extending).

2. As long as anything is understood that suffices for the recipient to
   find a unique suitable CRED_x, additional entries are fair game.

   Then I'd extend GREASE to those points.

   There is one complication that is that the values can be arbitrarily
   complex, all EDHOC implementations need to implement skipping over
   CBOR items. That's not hugely complex, but a naive implementation
   ("just use a CBOR library", when that library was previously only
   used to decode concrete small items) can easily blow up. It does help
   that EDHOC always uses the core deterministic encoding requirements,
   so skipping over arbitrarily large (ha: who can buffer that) CBOR can
   happen with bounded (2 words) space.

3. It is complicated.

   Then we can't GREASE in general, and may easily fall into 1.


I hope it's 2, but I don't know how to find out (or, if it is really
unspecified, worse: I have no idea of the WG's opinion so that we can make
a statement in any document).

BR
Christian

[1]: https://github.com/lake-wg/grease/issues/1

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom