Subject: [Ace] Object Security Work in ACE

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 15 Jan 2016 15:57:38 +0100

Hi all,

during the ACE WG meetings we had various talks about object security
and as we are moving our work along in the group it would be good to
make some plans about it.

We need your feedback regarding two issues:

1) Do you believe that object security standardization work (using COSE)
should be done in this working group? If it shouldn't be done in this
group which other group do you have in mind?

Object security in this context refers to ways to protect messages
conveyed over CoAP and to also include various CoAP header fields in the
protection.

2) What use cases are you interested in?

3) In various meetings Goeran presented OSCOAP, see
https://tools.ietf.org/html/draft-selander-ace-object-security-03

We are not entirely sure about the role of
https://tools.ietf.org/html/draft-bergmann-ace-dcaf-cose-00
which was presented at the last IETF meeting. Here are the slides
presented by Carsten:
https://www.ietf.org/proceedings/94/slides/slides-94-ace-4.pdf

The last slide contains about the difference between OSCOAP and
draft-bergmann-ace-dcaf-cose-00.

Have people reviewed the documents? What functionality offered by these
specifications do you like/dislike? Is functionality missing?

Ciao
Hannes & Kepeng

---

From: Olaf Bergmann <[email-masked]>
Date: Fri, 15 Jan 2016 16:52:56 +0100

> https://tools.ietf.org/html/draft-bergmann-ace-dcaf-cose-00

Who is "We"?

Grüße
Olaf

---

From: Göran Selander <[email-masked]>
Date: Fri, 15 Jan 2016 16:02:31 +0000

Hi Hannes,

>conveyed over CoAP and to also include various CoAP header fields in the

This work have different parts which may belong in different WGs.

1. One part is on expanding on the motivation. A short background is
provided in

https://tools.ietf.org/html/draft-selander-ace-object-security-03#section-2

People has shown interest in making this into a more formal analysis. One
draft is planned to be submitted to the CORE WG in time for next F2F
meeting.

2. Another part is to expand on how the CoAP headers and options should be
handled, which is currently in

https://tools.ietf.org/html/draft-selander-ace-object-security-03#section-6

This is also planned to be included in the previously mentioned draft to
CORE.

3. A third part is how to wrap CoAP headers, option and payload into a
COSE object, and how to carry that COSE object in CoAP. This is the
remainder of draft-selander-ace-object-security-03, and there may be other
proposals as well. I think this work belongs to CORE.

4. A fourth part is how to indicate in the OAuth flow that object security
is going to be used as communication security protocol between Client and
Resource Server. This is described in draft-seitz-ace-oauth-auth which of
course belongs to ACE.

5. A fifth part is how to establish the security context to use for object
security as in 5. This is addressing one of the review comments of
draft-seitz-ace-oauth-authz. A draft is planned for the next F2F meeting.
I think this belongs in the ACE WG.

Did I forget something?

Göran

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 15 Jan 2016 17:16:50 +0100

Hi Olaf,

>> https://tools.ietf.org/html/draft-bergmann-ace-dcaf-cose-00
We refers to the chairs.

Similarly to the CWT discussion we are not even sure which group the
work should go. I do, however, believe there are a number of
participants who thought that object level security is something to work
on.

Ciao
Hannes

> 
> Grüße
> Olaf
> 
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 15 Jan 2016 17:20:38 +0100

Thanks for the quick response, Goeran.

It might be worthwhile to split the draft (as outlined below) and to
submit the pieces to the relevant working groups (and most pieces seem
to go to the CORE working group).

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 15 Jan 2016 17:21:22 +0100

Asking you back: What do you see the role of your document in context of
OSCON?

Ciao
Hannes

---

From: Olaf Bergmann <[email-masked]>
Date: Mon, 18 Jan 2016 14:19:42 +0100

>>> https://tools.ietf.org/html/draft-bergmann-ace-dcaf-cose-00

Since there are a several open issues that have been raised in the
reviews and also the COSE specification has evolved, I will need to
update that document. It also contains some text on application level
security of CoAP messages which I could split out and contribute to a
more general document if need be (see below).

> participants who thought that object level security is something to work

It definitely is. IMO, the question how to secure CoAP messages on the
application level is something that belongs to CORE (in cooperation with
COSE, obviously) whereas its use in the context of authorization is
something that should be done in ACE.

Grüße
Olaf

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 18 Jan 2016 15:54:11 +0100

Hi Olaf,

thanks for the response. The response from you and from Goeran make it
more clear that this work mostly belongs to the CORE working group
(which Kepeng and I previously didn't realize).

We encourage both of you to update the drafts and to submit them to the
CORE working group so that the CORE WG chairs can ask the group for
their feedback.

Ciao
Hannes