Subject: [core] relation between EDHOC and OSCOAP

From: peter van der Stok <[email-masked]>
Date: Thu, 03 Aug 2017 11:03:13 +0200

Hi all,

Possibly there has been already a discussion on the relation between the 
drafts
selander-ace-cose-edhce (EDHOC) and ietf-core-object-security (OSCOAP). 
In that case my apologies.

If I understand correctly, EDHOC together with OSCOAP provide security 
at the application layer, using COSE, the same way as DTLS and TLS do at 
the transport layer by creating a common secret and using that for the 
communication.
OSCOAP draft describes that an alternative to EDHOC can be provided by 
using the proposed oauth-authz protocol.
That alternative to EDHOC, in my understanding, motivates the separation 
of the two drafts: EDHOC and OSCOAP.

However, I assume that a browser that supports coaps by using OSCOAP 
instead of DTLS, will also use EDHOC.
For 6tisch the EALS protocol, described in selander-ace-eals, also uses 
both protocols EDHOC and OSCOAP.

In OSCOAP the importance of EDHOC to OSCOAP is described, but the EDHOC 
draft summarily refers to OSCOAP and then uses it for the 
implementation.

Unless my understanding is completely wrong, may I suggest that both 
drafts provide normative references to each other and explain this tight 
coupling. A logic consequence is then that both drafts form a package to 
be brought to RFC together.

Looking forward to being corrected,

Peter

-- 
Peter van der Stok