Re: [OAUTH-WG] OSCORE

Hannes Tschofenig <Hannes.Tschofenig@arm.com> Wed, 07 February 2018 15:47 UTC

Return-Path: <Hannes.Tschofenig@arm.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FCAB12D7F6; Wed, 7 Feb 2018 07:47:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.405
X-Spam-Level:
X-Spam-Status: No, score=-1.405 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, SUBJ_ALL_CAPS=1.506] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MzWnVbCm-cIN; Wed, 7 Feb 2018 07:47:51 -0800 (PST)
Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0069.outbound.protection.outlook.com [104.47.1.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1BEE6126E3A; Wed, 7 Feb 2018 07:47:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=kzHhZa6GzIDoPfLmmFNGQCp6tEhWDbK0Xsipoblbf/4=; b=Z/7LshQHrEu5BJdex331JzDksVYu0m/mqzd5xmkGnwXA1RiiCs0xJuVhWPM+6ba7gVdq7O5k/T/TcP2yg2Dgqdj0h+70y6G4HspChnTkxKWf5/JtsTnHrkao0mgtRfej2EbHLLUjtqjhcARlGpag+yNPsN8ss3jvgeYGl5S2BzY=
Received: from AM4PR0801MB2706.eurprd08.prod.outlook.com (10.167.90.148) by AM4PR0801MB1425.eurprd08.prod.outlook.com (10.168.5.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.464.11; Wed, 7 Feb 2018 15:47:47 +0000
Received: from AM4PR0801MB2706.eurprd08.prod.outlook.com ([fe80::b863:80d:692b:e64b]) by AM4PR0801MB2706.eurprd08.prod.outlook.com ([fe80::b863:80d:692b:e64b%14]) with mapi id 15.20.0485.009; Wed, 7 Feb 2018 15:47:47 +0000
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
To: =?utf-8?B?R8O2cmFuIFNlbGFuZGVy?= <goran.selander@ericsson.com>, "OAuth@ietf.org" <OAuth@ietf.org>
CC: "draft-ietf-core-object-security@ietf.org" <draft-ietf-core-object-security@ietf.org>
Thread-Topic: [OAUTH-WG] OSCORE
Thread-Index: AdOf+vC9Bo7oOstGSpuGdOgV/ndnFaOZAgKAo5ii+kA=
Date: Wed, 7 Feb 2018 15:47:47 +0000
Message-ID: <AM4PR0801MB2706EAF074A35A93ABC729BAFAFC0@AM4PR0801MB2706.eurprd08.prod.outlook.com>
References: <AM4PR0801MB2706E520121559D478FB6D99FAFC0@AM4PR0801MB2706.eurprd08.prod.outlook.com> <35cc46fe-3453-e458-af55-a6acb2905e44@ri.se> <D6A0C60E.9EC6E%goran.selander@ericsson.com>
In-Reply-To: <D6A0C60E.9EC6E%goran.selander@ericsson.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com;
x-originating-ip: [88.214.160.174]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; AM4PR0801MB1425; 6:11hSzXdGkqrPR5+9VsjAIqAoPq0/nJORxNseiT5ffyUgug/cnNqR3/ymTaLGINO3zvZF18dhE8WVZjxBnwVkHCFfyxsFsQwH7TUn49OqxdXxoSCkUqFuRFDMnDWcOyq7CY9ggzvp1ReYRyzVkq7RZcJ8Jbi51/TC2WARL8NYE/EWdXKZ9GwkMrzrklbAye8TxGdfFcvdAFj/1u6MmHLLgNfy0PSBKri6/YsSftM3ZFzp1W1M0sGFlQo2s+7REP/aqeBkN/v9zn7h2uk80Ty7igFMItTeStUBnuEhGKmF5kz/QJLbkshkSwm9BLXLHrjahhdAg7umAIHZxPdJ1EWQqXQFTF0u7Fpk7TDOWOw8SPMnFPhyaf73TbCIU4EBM1Tn; 5:9hvqVeld5yvGoiDFP8ev/U54+FZzXkhVyq1toFKlDPIXOlfjXbrYrQzyHQJwF4QCYH2GOk6BzpoRvi+ZfWRJAHPAUQHbULnk3AnI8/wQp0oImsBVj4IQewnmLhjl6xo8cX40QkTQtLaW5H2ptySXIRDZaqJYivBvYHnsWsX97KE=; 24:OGC91wgJPGoFdTwZuIiBQXzRWBodBuz6g2alo1M+CVxkE23kPwChy1RCxngkJ+j0ZUjYUaOq4ejSgThUS3LiqkWJIF9sexc7WZfvKLl6pxk=; 7:Q7PlNbARxjyFLlE3asf+dP8KfJix9jCO8dP92Az1THV4D2DfSsi6XAq4nsFbvf1wTxREf9i8nPDNPhT6fnAWyl4igrj3R7X923hA2XkbaqaxhhAL2YMxT9Gy4n+D6lUspkC+GK5/YBxQ8IlbniEruwrLPLVF/qWrIk44rP7a1C/gqxcqgGUV+ANgN98jNyVgNpk1/9fc0ZHXdVotyN+dPEJ4iwF+FfiA+i+AxB2KP/OnpmJvWC/x1xYwG2LT2ngv
x-ms-exchange-antispam-srfa-diagnostics: SSOS;
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 02d47a02-a42d-4314-f9d0-08d56e4222f0
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(5600026)(4604075)(3008032)(2017052603307)(7153060)(7193020); SRVR:AM4PR0801MB1425;
x-ms-traffictypediagnostic: AM4PR0801MB1425:
x-microsoft-antispam-prvs: <AM4PR0801MB1425E11350670561284DE79DFAFC0@AM4PR0801MB1425.eurprd08.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(37575265505322)(278428928389397)(192374486261705);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040501)(2401047)(5005006)(8121501046)(3002001)(10201501046)(3231101)(2400082)(944501161)(93006095)(93001095)(6055026)(6041288)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123562045)(20161123558120)(6072148)(201708071742011); SRVR:AM4PR0801MB1425; BCL:0; PCL:0; RULEID:; SRVR:AM4PR0801MB1425;
x-forefront-prvs: 0576145E86
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(39860400002)(396003)(366004)(39380400002)(376002)(13464003)(199004)(377424004)(40434004)(189003)(51914003)(3280700002)(81166006)(81156014)(229853002)(68736007)(8676002)(2501003)(5890100001)(9686003)(99286004)(55016002)(8936002)(2900100001)(186003)(97736004)(6436002)(6306002)(2950100002)(74316002)(305945005)(7736002)(106356001)(33656002)(110136005)(5250100002)(5660300001)(25786009)(66066001)(316002)(59450400001)(102836004)(966005)(86362001)(53546011)(6506007)(6116002)(72206003)(3846002)(26005)(76176011)(4326008)(478600001)(105586002)(2906002)(6246003)(53936002)(14454004)(7696005)(3660700001); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR0801MB1425; H:AM4PR0801MB2706.eurprd08.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: 8ytFDlqA+kpMeI9qbT5y2D0YOu8zS0bwpycT//uwbMiqp9jHCq1Q6Uj9Y/Mei7/ZXJxPtq3UadOiam3KXgRIcA==
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 02d47a02-a42d-4314-f9d0-08d56e4222f0
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Feb 2018 15:47:47.4658 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0801MB1425
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/VA8y_VZm6-y0wFjvtiDVo02PFlE>
Subject: Re: [OAUTH-WG] OSCORE
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Feb 2018 15:47:54 -0000

Hi Göran,

Maybe you can then answer the question whether this is useful / applicable to a HTTP. Asked differently, under what conditions does the OSCORE not work for HTTP. This would help the folks in the group, including me, to determine whether this actually something we should be looking into at all. Note that typical applications that use OAuth do not use CoAP -- only HTTP.

In OAuth we had for several years tried to get HTTP message protection working and we have, unfortunately, failed to find a suitable solution.

Ciao
Hannes


-----Original Message-----
From: Göran Selander [mailto:goran.selander@ericsson.com]
Sent: 07 February 2018 15:37
To: Hannes Tschofenig; OAuth@ietf.org
Cc: draft-ietf-core-object-security@ietf.org
Subject: [OAUTH-WG] OSCORE


Hi Hannes, and all

Thanks for the announcement.

To be a little bit more precise, the statement is that a CoAP-mappable HTTP message can be mapped to CoAP (using RFC 8075), protected with OSCORE (as specified in the referenced draft) and transported with HTTP (as exemplified in the referenced draft). The main use case is in conjunction with an HTTP-CoAP translational proxy (RFC 8075), and the mapping would with this construction result in a CoAP-mappable HTTP request being protected by an HTTP client and verified by a CoAP server.

This functionality was proposed by OCF for their end-to-end REST use cases. Happy to hear any comments on the construction as described in the draft.


Note that Hannes referenced the wrong version of the draft, here is the
latest:

https://tools.ietf.org/html/draft-ietf-core-object-security-08


Göran


On 2018-02-07 11:06, Hannes Tschofenig wrote:
> Hi guys,
>
> You may be interested to hear that a group of people working on
> Internet of Things security believe they have found a solution to deal
> with the challenges we had in protecting HTTP requests/responses.
>
> Here is the draft:
> https://tools.ietf.org/html/draft-ietf-core-object-security-07
>
> (The draft is mostly focused on CoAP but it is supposed to be
> applicable also to HTTP.)
>
> Ciao
> Hannes
>
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose
> the contents to any other person, use it for any purpose, or store or
> copy the information in any medium. Thank you.
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>




IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.