Subject: [Secdispatch] Request for discussion of Concise IDs in Prague

From: Carsten Bormann <[email-masked]>
Date: Sun, 17 Mar 2019 20:52:36 +0100

With the completion of CWT (RFC 8392) and CWT proof of possession
(draft-ietf-ace-cwt-proof-of-possession, submitted to IESG), we now
have a way to use COSE for authenticated assertions where previously
only RFC 5280/RFC5755 ("X.509") certificates were really applicable.
The latter are sometimes quite clumsy to use in constrained
environments, even with tricks such as
draft-raza-ace-cbor-certificates.

There has been interest in a profile specification that details how to
use CWT for these kinds of signed claims; a work in progress is
available as draft-birkholz-core-coid.  No IETF working group is
currently chartered to work on such a profile, and no single working
group jumps to mind as the obvious candidate.

A side discussion and meeting(*) was held a while ago to determine a
good solution; this side meeting came up with ACE and CORE as two
leading candidates: ACE because it already did CWT (which, however,
already was a bit of an odd addition to its charter), and CORE,
because it is interested in having such a profile available and has
the requirements (but is not itself a security area WG).

The side meeting also recommended to ask secdispatch to dispatch this
document.  Because a family tragedy kept one of the main authors away
from this, this did not happen right away; however, I would like to
make this request now, hopefully in time for a discussion in Prague.

Grüße, Carsten

(*) In some order, I believe the participants of the discussion were:
Benjamin Kaduk <[email-masked]>,
Carsten Bormann <[email-masked]>,
Henk Birkholz <[email-masked]>,
Ivaylo Petrov <[email-masked]>,
Jim Schaad <[email-masked]>,
Matthew Miller <[email-masked]>,
Richard Barnes <[email-masked]>,
Roman Danyliw <[email-masked]>,

---

From: Michael Richardson <[email-masked]>
Date: Sun, 17 Mar 2019 16:41:44 -0400

> the requirements (but is not itself a security area WG).

I had asked why not CBOR WG, and it might be useful to share your answer.

    > make this request now, hopefully in time for a discussion in Prague.

+1

I am also aware of a few other groups that would be interested in
ConciseIDs, but I don't speak for them, so I've asked them to speak up
themselves.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Carsten Bormann <[email-masked]>
Date: Sun, 17 Mar 2019 21:49:21 +0100

> I had asked why not CBOR WG, and it might be useful to share your answer.

The CBOR WG is really more concerned with the integrity of the CBOR standard itself and with the CDDL notation for structural interoperability (“syntax”).  Concise IDs are an application of CWTs and COSE, which are in turn an application of CBOR.  Concise IDs are much closer to the applications that the CoRE WG is looking at, than to features and functions of CBOR (or CDDL).

In the end, of course, the parties interested will come to whatever WG that runs the process; I would just imagine that with CoRE (and possibly ACE) quite a few of the interested parties would already be there, and the WG as a whole will be more in a position to provide its collected expertise in this area.

Grüße, Carsten