[lamps] Re: [core] Re: Re: EST /.well-known/est registry

Esko Dijk <esko.dijk@iotconsultancy.nl> Thu, 16 July 2026 07:19 UTC

Return-Path: <esko.dijk@iotconsultancy.nl>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id D13F8117A552E; Thu, 16 Jul 2026 00:19:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1784186396; bh=1Z2XiqcbZDpmqLYGpQ1+9PGCERG/Xs0mTxXXZfQ9dl4=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=AoLa9nZiyd99ssNAPgggfpzl0/7YfNYUVNC4c7c/LRiYRwloFZEg+XVdSxqcE3eKe +67Byb1okS3PfBhJ1DHkeTBqt3ua1j52ZN6Q1IwCOCLjw7mynzEwaaF4GW8qhhUK0R RtK0of+Dx6x/XUPaWypPEojBqIf2U5QrMxdk5k4k=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=iotconsultancy.nl
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id amRNO6FDqQ0f; Thu, 16 Jul 2026 00:19:55 -0700 (PDT)
Received: from dane.soverin.net (dane.soverin.net [185.233.34.47]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C35CC117A5526; Thu, 16 Jul 2026 00:19:55 -0700 (PDT)
Received: from smtp.soverin.net (unknown [10.10.4.99]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by dane.soverin.net (Postfix) with ESMTPS id 4h14Dh0431z1Hlv; Thu, 16 Jul 2026 07:19:48 +0000 (UTC)
Received: from smtp.soverin.net (smtp.soverin.net [10.10.4.99]) by soverin.net (Postfix) with ESMTPSA id 4h14Dg40gfz1g; Thu, 16 Jul 2026 07:19:47 +0000 (UTC)
Authentication-Results: smtp.soverin.net; dkim=pass (2048-bit key; unprotected) header.d=iotconsultancy.nl header.i=@iotconsultancy.nl header.a=rsa-sha256 header.s=soverin1 header.b=e5GSscoQ; dkim-atps=neutral
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iotconsultancy.nl; s=soverin1; t=1784186387; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=2uRemD365q7oYtPJ2zSWGWGbdDCLVWOZMfks5rOARp8=; b=e5GSscoQl/BdIJzs4Kc5gHt+kNuCyFc+ekEKoG5hnrsZPcyDGi6Qzi+jT1NqNf741SboS7 QgYXi5M1BKC5nv2J6H7Bit3TF1aTV8bdhEg23aXv9CGMOrUM1HDhbjgGhRt/DVNrtd4nKt 2K8BL9oFuw066IFWP9xIdx0M61dmFJs7Sk1S659jew1P9/cujjSJ3/M9GNrCDW5R/MxYp1 nYSDrzou2y4Nm/fAGyxqv4znSkcVgVwfklqkCs4LnBu4h5xtV5mt9dtrOHl2UEoTdTML68 P+xF7fUPD1N2RJiAp8OrCmfUmUGYvxoot0hx7R/Y1PY47wv1YYtGOvHK3Awypg==
X-CM-Envelope: MS4xfJMX8VISz85zPxX2SLtmg6178OeOWGHBruTstDqTFy/1MHY0hQ4egfGsFIkbRhwmV1eahWwRAdX0vTJExu81e2GLM3LizF9RUKkySyO+T4f42l9O0fG5 PKR19tI6pq0S99wcyuiqQJTSa0Dola0Ivp3548FKTF+H3Pr8siTf7xLBAqVXuv5sRvtGrk35gKS53hDNMHHEXgBNtmo0TGAh6o8U+PcEyEwRUjdMBJyg1H3C VVz53+IP7EaJ3E9T/fiH+Qx0LA9rNpADIOjLsirRPNc4ThPEF918IagIkoi3WKEELcADOlJBAxn1nNyaz7vguEETN3j6c/ZG9+fjXH+03Q858nfpk1UF4sJX leJdiBKmnwOGVC2UYhP/380eUVK/Gm02/3uISYrlxnSaqzsD7P0yjdGqiKTZy9cgsL4Tqg5cuUH02IhvwkyzKGvResjLJg==
X-Soverin-Id: 019f69cb-ba38-7094-87d1-cca177ae119b
Content-Type: multipart/alternative; boundary="------------mD0oVedYuUmsZJjn3OJzsAG6"
Message-ID: <9f2e8c33-0621-40c6-984b-6a15758920d1@iotconsultancy.nl>
Date: Thu, 16 Jul 2026 09:19:46 +0200
MIME-Version: 1.0
To: "Brockhaus, Hendrik" <hendrik.brockhaus=40siemens.com@dmarc.ietf.org>, Michael Richardson <mcr+ietf@sandelman.ca>
References: <15098.1783962252@obiwan.sandelman.ca> <870A3B63-2253-4695-9A51-A7EC6796BC91@vigilsec.com> <168979.1784050486@dyas> <PAXPR10MB4898485B7672C754037D8F1CFEF82@PAXPR10MB4898.EURPRD10.PROD.OUTLOOK.COM> <305759.1784124938@dyas> <PAXPR10MB4898AA503521E2E47CF1B11BFEC72@PAXPR10MB4898.EURPRD10.PROD.OUTLOOK.COM>
Content-Language: en-US
From: Esko Dijk <esko.dijk@iotconsultancy.nl>
Organization: IoTconsultancy.nl
In-Reply-To: <PAXPR10MB4898AA503521E2E47CF1B11BFEC72@PAXPR10MB4898.EURPRD10.PROD.OUTLOOK.COM>
X-Spampanel-Class: ham
Message-ID-Hash: 2JDSZSEMMGAXLDRCKOOFUFMUSUIPCC5E
X-Message-ID-Hash: 2JDSZSEMMGAXLDRCKOOFUFMUSUIPCC5E
X-MailFrom: esko.dijk@iotconsultancy.nl
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Russ Housley <housley@vigilsec.com>, "lamps@ietf.org" <lamps@ietf.org>, "core@ietf.org" <core@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [core] Re: Re: EST /.well-known/est registry
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/64ZHj8EFLyww_0otCUQwfHZbORM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

Chiming in:

indeed the key idea proposed is to have each registry entry on one line, 
including both a regular path segment and a short path segment 
equivalent. I like that. This emphasizes better that the functionality 
is equivalent across EST/EST-coaps. And it forces applicants to think 
about a EST-coaps equivalent. See Table 1 in 
draft-ietf-anima-constrained-voucher for an example of this side-by-side 
listing. Absence of a short equivalent would indicate EST-coaps doesn't 
support the resource at all.  And also, long/short names may be identical.

The thing that Michael seemed to be wrestling with is how to tie this to 
the even-shorter-path (numeric) registrations made in 
draft-ietf-core-uri-path-abbrev. Note that this already has numbers 
defined for some EST CoAP well-known paths.  On the one hand we don't 
want to repeat those numbers in the new IANA registry (since already 
registered in the other registry from draft-ietf-core-uri-path-abbrev). 
On the other hand, it's handy for users of this to have all the required 
info in one table.

I would still advice to keep these things separate, to avoid complexity.

Finally, Michael I think suggested that this draft, or this new IANA 
registry, could somehow mention the (mandatory?) support for 
draft-ietf-core-uri-path-abbrev at the EST-coaps server side. But I 
think that would  need an "RFC9148 bis" or as Hendrik said an "RFC7030 
bis" could also do this.  For example, 
draft-ietf-anima-constrained-voucher does require URI-path-abbrev 
support for cBRSKI, but this does not cover 'all EST-coaps servers' in 
general.

Esko


On 7/16/26 07:48, Brockhaus, Hendrik wrote:
> Michael
>
> Thank you for your quick review and pointing at RFC 8295 for further path segments to be added.
> However, I'm not sure if I fully understand your suggestions. I'm not a CORE expert either.
> My goal is simply to include in this new register only the path segments as defined in other RFCs. If any extension to the path segment registration, e.g., based on draft-ietf-core-uri-path-abbrev, is needed, I vote for doing so in a rfc7030bis.
> The three-column layout of the table is based on existing examples likehttps://www.iana.org/assignments/brski-parameters/brski-parameters.xhtml#brski-well-known-uris  andhttps://www.iana.org/assignments/cmp/cmp.xhtml#cmp-well-known-uri. Are you referring to the layout described in draft-ietf-anima-constrained-voucher? If this is an accepted way of adding HTTP and CoAP path segments in one table, I am fine with it.
>
> Hendrik
>
>> -----Ursprüngliche Nachricht-----
>> Von: Michael Richardson<mcr+ietf@sandelman.ca>
>> Gesendet: Mittwoch, 15. Juli 2026 16:16
>> An: Brockhaus, Hendrik (FT RPD CST SEA-DE)
>> <hendrik.brockhaus@siemens.com>;core@ietf.org
>> Cc: Russ Housley<housley@vigilsec.com>;lamps@ietf.org
>> Betreff: Re: AW: [lamps] Re: EST /.well-known/est registry
>>
>>
>> Brockhaus, Hendrik<hendrik.brockhaus@siemens.com> wrote:
>>      > I prepared a PR for attestation-freshness,
>>      >https://github.com/lamps-wg/lamps-attestation-freshness/pull/38.  You
>>      > can use the text if your draft is faster
>>
>> Fantastic!
>> I've made two suggestions in your PR.
>>
>> 1. Make it five columns wide, and put the 7030/9148 entries on a single line.
>>
>> 2. Mark the draft-ietf-core-uri-path-abbrev for the short names.
>>     As this document creates getnonce/nonce verb, it ought to allocate a
>>     number for that too.
>>
>> My suggestion probably creates a non-DRY quandry.
>> Repeating the uri-path-abbrev allocations in this table is definitely NOT DRY.
>> (DRY == Don't Repeat Yourself. A software engineering term)
>>
>> The 3rd-normal-form/DRY is that one should take the CoAP short name and then
>> go visit the Uri-Path-Abbrev registry to find out the number.
>>
>> I don't love that method as it obscures which ones have allocations, and
>> which do not, and people reading this are not SQL engines that always
>> remember to do the right JOINs.
>> So I prefer not to do that, but now we are complicating the IANA Considerations.
>> The Uri-Path-Abbrev registry is currently set to IETF Review, which is
>> stronger than the Specification Required that this EST Registry demands.
>>
>> RFC9148 (like 7030) provided NO way to extend the set, and this registry
>> helps 9148 too, and Specification Required is fine for 9148 use too.
>>
>> But, this does mean that an external entity (some other SDO) could add to the
>> ESG registry, but would not be allowed to allocate a Uri-Path-Abbrev.
>> I'm not sure if this is a problem.
>>
>> Another situation might be that someone (with an RFC), would like to create a
>> new 7030 resource, but instead of doing a 9148 short-name, just do the
>> Uri-Path-Abbrev.   I think that's fine, just make the 9148 name the same as
>> the 7030.
>>
>> --
>> Michael Richardson<mcr+IETF@sandelman.ca>, Sandelman Software Works
>>   -= IPv6 IoT consulting =-                      *I*LIKE*TRAINS*
>>
>>
> _______________________________________________
> core mailing list --core@ietf.org
> To unsubscribe send an email tocore-leave@ietf.org
-- 
*IoTconsultancy.nl* | Email/Teams: esko.dijk@iotconsultancy.nl | +31 6 
2385 8339