Re: [Teep] Comment on JSON support in TEEP OTrPv2 draft

[Dave Thaler <[e-mail]>]

Personally, I like what OTrPv1 did which was to just reference JWS/JWE and specify the payload that gets signed/encrypted.
So you could specify the payload in CDDL but just reference the JOSE & COSE RFCs for how to wrap them.
So you use CDDL to express JSON when wrapping in JOSE, and use CDDL to express CBOR when wrapping in COSE.

Maybe I'm missing some technical issue, but that's my short answer anyway.

Dave

From: Hannes Tschofenig <[e-mail]>
Sent: Tuesday, July 23, 2019 5:41 PM
To: Dave Thaler <[e-mail]>
Cc: [e-mail]
Subject: RE: Comment on JSON support in TEEP OTrPv2 draft

Thanks, Dave. I will look at the ways to best encode bstr.

The biggest problem I had was with referencing CDDL items that refer to the JOSE counterparts to this structure:

   Msg_AuthEnc_Wrapper = [ * (COSE_Mac_Tagged /
                              COSE_Sign_Tagged /
                              COSE_Mac0_Tagged /
                              COSE_Sign1_Tagged)]

Do you have an idea on how to solve that problem? I am not entirely sure there is even a CDDL description of JOSE.

Ciao
Hannes

From: Dave Thaler <[e-mail]<mailto:[e-mail]>>
Sent: Dienstag, 23. Juli 2019 17:30
To: Hannes Tschofenig <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: Comment on JSON support in TEEP OTrPv2 draft

The OTrPv2 draft says it supports JSON and CBOR (which is great to see),
although in the meeting you correctly noted the JSON support isn't completely
specified.  The CDDL RFC (RFC 8610) does apply to JSON, as Appendix A explains,
as long as you only use the specific subset of CDDL specified there.

The current OTrPv2 draft does not, however, currently stick to that subset of CDDL.
For example, it uses "bstr" which Appendix A explains is not in that subset.
I think OTrPv2 can still be mapped to JSON, as long as you explain how
to map such types in the OTrPv2 JSON format.   (I am assuming we do NOT need
the ability for an intermediary to translate between CBOR and JSON, in which case
you'd need more than what I'm suggesting here.)


RFC 7493 was pointed out in the INTAREA WG, which species "a restricted profile of JSON
designed to maximize interoperability and increase confidence that
software can process it successfully with predictable results".  That is, it specifies
a profile of JSON, sort of like how RFC 8610 specifies a profile of CDDL.  Section 4 of
RFC 7493 in particular gives recommendations for how to map specific data types,
including binary data.

So I would suggest that the OTrPv2 doc talk about how to encode "bstr" (and any other
CDDL types missing from the profile in RFC 8610 Appendix A) into types within the CDDL
JSON profile, and reference relevant sections of RFC 7493, at least informatively if not normatively,
for how/why.   E.g., RFC 7493 section 4.4 can be used as the rule to encode bstr into
a string.

Dave
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.