[Rats] comments on draft-birkholz-rats-uccs

[Jessica Fitzgerald-McKay <[e-mail]>]

Hi, UCCS authors,

Mike Jenkins and I reviewed the UCCS draft. Our comments are below. Happy
to talk through any of them with the group.

Thanks,
Jess

The intent of this draft is similar to the key concept of EST - use the
authentication of the secure session connection. Most schemes build on this
concept leave a lot of banana peels laying around, some of which we
describe here. In general, this does not seem appropriate to the scope of
RATS. We feel that COSE might be a more appropriate work group to think
these issues through.

- If you're using a static symmetric key for authentication (as one might
with highly-constrained devices), you can only authenticate a net, not an
entity. The receiver cannot differentiate between authenticating the sender
and authenticating itself.

- The authentication happens at the secure channel termination, not in the
channel-contents-using application. It's important how the termination
process vouches the authentication to the application. (In EST, this
question is how the EST server vouches the requestor's identity to the CA
server.)

- A TEE only helps if the TEE application can punch through the REE and set
up the secure channel completely on its own. If the TEE relies on the REE
to set up the secure channel, you might as well just operate in the REE.

- There is a comment at the end of the introduction (!) about transitioning
back and forth between self-protected and channel-protected CWT, "in a
well-defined scope". Define the security characteristics of that scope or
get rid of the comment. You're handing someone an awful lot of rope there.

- The claims set should be treated as ephemeral by the recipient. It
shouldn't be stored, and can't be forwarded except as data originated by
the recipient. As soon as it emerges from the secure channel, it's no more
valid or meaningful than any other piece of unprotected data in the
application environment.