[secdir] [new-work] WG Review: CBOR Object Signing and Encryption (cose)
The IESG <iesg@ietf.org> Mon, 15 October 2018 16:36 UTC
Return-Path: <new-work-bounces@ietf.org>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F3EA130F00; Mon, 15 Oct 2018 09:36:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1539621364; bh=COMdzL7HJrbY0hAzOY2iGUd5CptPQmOlzBzcW83OXM8=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=webfxGqfvhQO+7JaMYUBb2BNGGIA+bSzLhLsZGRvTHAnZk3IkdQ8nw24wWnAip8kI KsxC8mPixKrCZvuvq+xWWFQjmLg5K64jHv/FhVPzhhbh/yYY3zckofUUIkmd8OuKj/ v3PXueLOEVFQPhH8cRu2/08BPYB8B9ELgb4y1fdw=
X-Mailbox-Line: From new-work-bounces@ietf.org Mon Oct 15 09:35:58 2018
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 12BFD130EFB; Mon, 15 Oct 2018 09:35:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1539621355; bh=COMdzL7HJrbY0hAzOY2iGUd5CptPQmOlzBzcW83OXM8=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=Srg1vnkYZdjGRinf6oxr64895mcO9hXSUiHDaAoj93aZ5tJGuvt5QqTwPs89MgTk1 O3DqG7E7vPLyPBXsrJhStdqwSx9dzvBHXy32ppZmw4b7PMlTR5joyvbBrAeATSK5SS /LFe1BhJsTCVQi6THDGnL+cY0STqV2g7W9eHAHE4=
X-Original-To: new-work@ietf.org
Delivered-To: new-work@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DAC8130EC6 for <new-work@ietf.org>; Mon, 15 Oct 2018 09:35:45 -0700 (PDT)
MIME-Version: 1.0
From: The IESG <iesg@ietf.org>
To: new-work@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 6.87.0
Auto-Submitted: auto-generated
Precedence: bulk
MIME-Version: 1.0
Reply_to: <iesg@ietf.org>
Message-ID: <153962134557.18806.14542405894668818591.idtracker@ietfa.amsl.com>
Date: Mon, 15 Oct 2018 09:35:45 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/new-work/MKjHj0Ddz_Ud0J1etSu5NPc52UQ>
X-BeenThere: new-work@ietf.org
X-Mailman-Version: 2.1.29
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: new-work-bounces@ietf.org
Sender: new-work <new-work-bounces@ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/cwbpLzLkV7E5fe3r1U5eFSk0ags>
X-Mailman-Approved-At: Mon, 15 Oct 2018 09:45:07 -0700
Subject: [secdir] [new-work] WG Review: CBOR Object Signing and Encryption (cose)
X-BeenThere: secdir@ietf.org
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Oct 2018 16:36:11 -0000
A new IETF WG has been proposed in the Security Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2018-10-25. CBOR Object Signing and Encryption (cose) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: Justin Richer <jricher@mit.edu> Kepeng Li <kepeng.lkp@alibaba-inc.com> Assigned Area Director: Eric Rescorla <ekr@rtfm.com> Security Area Directors: Eric Rescorla <ekr@rtfm.com> Benjamin Kaduk <kaduk@mit.edu> Mailing list: Address: cose@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/cose Archive: https://mailarchive.ietf.org/arch/browse/cose/ Group page: https://datatracker.ietf.org/group/cose/ Charter: https://datatracker.ietf.org/doc/charter-ietf-cose/ CBOR Object Signing and Encryption (COSE, RFC 8152) describes how to create and process signatures, message authentication codes, and encryption using Concise Binary Object Representation (CBOR, RFC 7049) for serialization. COSE additionally describes a representation for cryptographic keys. COSE has been picked up and is being used both by a number of groups within the IETF (i.e. ACE, CORE, ANAMA, 6TiSCH and SUIT) as well as outside of the IETF (i.e. W3C and FIDO). There are a number of implementations, both open source and private, now in existence. The specification is now sufficiently mature that it makes sense to try and advance it to STD status. The standards progression work will focus on: 1. Should the document be split in two? One document for the structures and one document for the algorithm definitions. 2. What areas in the document need clarification before the document can be progressed? 3. What implementations exist and do they cover all of the major sections of the document? There are a small number of COSE related documents that will also be addressed by the working group dealing with additional attributes and algorithms that need to be reviewed and published. The first set of three are listed in the deliverables. A re-charter will be required to expand this list. The SUIT working group has identified a need for the use of hash-based signatures in the form of Leighton-Micali Signatures (LMS) (draft-mcgrew-hash-sigs). This signature form is resistant to quantum computing and is low-cost for validation. The SUIT working group additionally has identified a need for registering hash functions for indirect packaging. The W3C Web Authentication working group has identified a need for the ability to use algorithms which are currently part of TPMs which are widely deployed. At the time COSE was developed, there was a sense that X.509 certificates was not a feature that needed to be transferred from the JOSE key document (RFC 7517). Since that time a better sense of how certificates would be used both in the IoT sphere and with COSE outside of the IoT sphere has been developed. The need to be able to identify X.509 certificates is now a feature that needs to be provided. This will additionally require definition of a small number of hash functions for compact references to certificates. Key management and binding of keys to identities are out of scope for the working group. The COSE WG will not innovate in terms of cryptography. The specification of algorithms in COSE is limited to those in RFCs or active IETF WG documents. The working group will coordinate its progress with the ACE, SUIT and CORE working groups to ensure that we are fulfilling the needs of these constituencies to the extent relevant to their work. Other groups may be added to this list as the set of use cases is expanded, in consultation with the responsible Area Director. The WG will have five deliverables: 1. Republishing a version of RFC 8152 suitable for advancement to full standard. 2. Use of Hash-based Signature algorithms in COSE using draft-housley-suit-cose-hash-sig as a starting point. 3. Placement of X.509 certificates in COSE messages and keys using draft-schaad-cose-x509 as a starting point. 4. Define the algorithms needed for W3C Web Authentication for COSE using draft-jones-webauthn-cose-algorithms and draft-jones-webauthn-secp256k1 as a starting point. 5. Define a small set of hash functions. Milestones: TBD _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work