Subject: [COSE] Martin Duke's No Objection on draft-ietf-cose-rfc8152bis-algs-09: (with COMMENT)

From: Martin Duke via Datatracker <[email-masked]>
Date: Tue, 09 Jun 2020 22:22:50 -0700

Martin Duke has entered the following ballot position for
draft-ietf-cose-rfc8152bis-algs-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cose-rfc8152bis-algs/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

As everyone else has pointed out, the header needs to be fixed to indicate this
is Informational, not Standards Track.

Section 1.
s/messages transport/message transport
s/of the Javascript/of Javascript

Sec 1.3
In the definitions of “AE” and “AEAD”, I don’t understand the functional
difference between authentication of “plaintext contents” (AE) and
authentication of “non-encrypted data” (AEAD). AFAICT AE isn’t actually used in
the document, so it might be easiest to simply delete it.

Sec 1.5. Replace the URL with a reference.

I actually read this whole document but got pretty lost by the end, not being
an expert in this area.

---

From: Jim Schaad <[email-masked]>
Date: Mon, 15 Jun 2020 10:31:14 -0700

-----Original Message-----
From: Martin Duke via Datatracker <[email-masked]> 
Sent: Tuesday, June 9, 2020 10:23 PM
To: The IESG <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; Matthew Miller <[email-masked]>; [email-masked]
Subject: Martin Duke's No Objection on draft-ietf-cose-rfc8152bis-algs-09: (with COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

As everyone else has pointed out, the header needs to be fixed to indicate this is Informational, not Standards Track.

Section 1.
[JLS] Done.

Sec 1.3
In the definitions of “AE” and “AEAD”, I don’t understand the functional difference between authentication of “plaintext contents” (AE) and authentication of “non-encrypted data” (AEAD). AFAICT AE isn’t actually used in the document, so it might be easiest to simply delete it.
[JLS]  I have updated the text to read as follows, does that make it clearer?

Authenticated Encryption (AE) <xref target="RFC5116"/> algorithms are encryption algorithms that provide an authentication check of the contents algorithm with the encryption service.  An example of an AE algorithm used in COSE is AES Key Wrap <xref target="RFC3394"/>.  These algorithms are used for key encryption algorithms, but AEAD algorithms would be preferred.

Authenticated Encryption with Associated Data (AEAD) <xref target="RFC5116"/> algorithms provide the same authentication service of the content as AE algorithms do.   They also allow for associated data to be included in the authentication service, but which is not part of the encrypted body.    An example of an AEAD algorithm used in COSE is AES-GCM <xref target="RFC5116"/>.    These algorithms are used for content encryption and can be used for key encryption as well.

[JLS] Fixed.

I actually read this whole document but got pretty lost by the end, not being an expert in this area.

---

From: Martin Duke <[email-masked]>
Date: Mon, 15 Jun 2020 10:47:51 -0700

s/contents algorithm/contents, I think, but otherwise LGTM.

this is non-blocking, but I don't see a reason to include the AE definition
in this document at all, but I"m happy to consider these issues addressed.

On Mon, Jun 15, 2020 at 10:31 AM Jim Schaad <[email-masked]> wrote:

> Cc: [email-masked]; [email-masked];
> [email-masked]; Matthew Miller <[email-masked]>;
> [email-masked]
> As everyone else has pointed out, the header needs to be fixed to indicate
> this is Informational, not Standards Track.
>
> Section 1.
> authentication of “non-encrypted data” (AEAD). AFAICT AE isn’t actually
> used in the document, so it might be easiest to simply delete it.
> Authenticated Encryption (AE) <xref target="RFC5116"/> algorithms are
> encryption algorithms that provide an authentication check of the contents
> algorithm with the encryption service.  An example of an AE algorithm used
> in COSE is AES Key Wrap <xref target="RFC3394"/>.  These algorithms are
> used for key encryption algorithms, but AEAD algorithms would be preferred.
>
> Authenticated Encryption with Associated Data (AEAD) <xref
> target="RFC5116"/> algorithms provide the same authentication service of
> the content as AE algorithms do.   They also allow for associated data to
> be included in the authentication service, but which is not part of the
> encrypted body.    An example of an AEAD algorithm used in COSE is AES-GCM
> <xref target="RFC5116"/>.    These algorithms are used for content
> encryption and can be used for key encryption as well.
>
>

---

From: Jim Schaad <[email-masked]>
Date: Thu, 18 Jun 2020 11:14:10 -0700

From: Martin Duke <[email-masked]> 
Sent: Monday, June 15, 2020 10:48 AM
To: Jim Schaad <[email-masked]>
Cc: The IESG <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Matthew Miller <[email-masked]>
Subject: Re: Martin Duke's No Objection on draft-ietf-cose-rfc8152bis-algs-09: (with COMMENT)

this is non-blocking, but I don't see a reason to include the AE definition in this document at all, but I"m happy to consider these issues addressed.

[JLS] Fixed

On Mon, Jun 15, 2020 at 10:31 AM Jim Schaad <[email-masked] <mailto:[email-masked]> > wrote:

-----Original Message-----
From: Martin Duke via Datatracker <[email-masked] <mailto:[email-masked]> > 
Sent: Tuesday, June 9, 2020 10:23 PM
To: The IESG <[email-masked] <mailto:[email-masked]> >
Cc: [email-masked] <mailto:[email-masked]> ; [email-masked] <mailto:[email-masked]> ; [email-masked] <mailto:[email-masked]> ; Matthew Miller <[email-masked] <mailto:[email-masked]> >; [email-masked] <mailto:[email-masked]> 
Subject: Martin Duke's No Objection on draft-ietf-cose-rfc8152bis-algs-09: (with COMMENT)

Section 1.

Sec 1.3