Subject: Re: [Ace] New Version Notification - draft-ietf-ace-cwt-proof-of-possession-07.txt

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 24 Sep 2019 16:33:18 -0700

Hi all,

Thanks for the updates; they look good!

Before I kick off the IETF LC, I just have two things I wanted to
double-check (we may not need a new rev before the LC):

(1) In Section 3.2 (Representation of an Asymmetric Proof-of-Possession
Key), the last paragraph is a somewhat different from the main content, in
that it mentions using "COSE_Key" for an encrypted symmetric key, analogous
to the last paragraph of Section 3.2 of RFC 7800.  I had wanted to see some
additional discussion, but we agreed that this was analogous to RFC 7800
and we did not need to go "out of parity" with it on this point.  So we
should be able to go ahead without new text here, but did we want to
explicitly refer back to that portion of RFC 7800 to make the connection
clear?

(2) In https://github.com/cwt-cnf/i-d/pull/27/files we removed a large
chunk of text since it contained several things that are inaccurate.  The
only things that were removed that I wanted to check if we should think
about keeping was the note that the same key might be referred to by
different key IDs in messages directed to different recipients.  What do
people think about that?

Thanks,

Ben

On Wed, Sep 18, 2019 at 07:59:18PM -0700, [email-masked] wrote:
> 
> A new version (-07) has been submitted for draft-ietf-ace-cwt-proof-of-possession:
> https://www.ietf.org/internet-drafts/draft-ietf-ace-cwt-proof-of-possession-07.txt
> 
> Sub state has been changed to AD Followup from Revised ID Needed
> 
> 
> The IETF datatracker page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-ace-cwt-proof-of-possession/
> 
> Diff from previous version:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-cwt-proof-of-possession-07
> 
> Please note that it may take a couple of minutes from the time of submission
> until the diff is available at tools.ietf.org.
> 
> IETF Secretariat.
>

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 24 Sep 2019 16:35:10 -0700

> different key IDs in messages directed to different recipients.  What do

Oops, and my notes were unfortunately misalgined to the terminal window
size:

(3) I think we were going to change the [JWT] reference to [CWT], in
Section 4:

   Applications utilizing proof of possession SHOULD also utilize
   audience restriction, as described in Section 4.1.3 of [JWT], as it
   provides additional protections.  Audience restriction can be used by
   recipients to reject messages intended for different recipients.

That way we won't get asked to make [JWT] a normative reference.

-Ben

---

From: Mike Jones <[email-masked]>
Date: Wed, 25 Sep 2019 00:23:36 +0000

I'm fine with us making both of the proposed changes.

				Thanks,
				-- Mike

-----Original Message-----
From: Benjamin Kaduk <[email-masked]> 
Sent: Tuesday, September 24, 2019 4:35 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: New Version Notification - draft-ietf-ace-cwt-proof-of-possession-07.txt

On Tue, Sep 24, 2019 at 04:33:18PM -0700, Benjamin Kaduk wrote:
> (1) In Section 3.2 (Representation of an Asymmetric 
> Proof-of-Possession Key), the last paragraph is a somewhat different 
> from the main content, in that it mentions using "COSE_Key" for an 
> encrypted symmetric key, analogous to the last paragraph of Section 
> 3.2 of RFC 7800.  I had wanted to see some additional discussion, but 
> we agreed that this was analogous to RFC 7800 and we did not need to 
> go "out of parity" with it on this point.  So we should be able to go 
> ahead without new text here, but did we want to explicitly refer back 
> to that portion of RFC 7800 to make the connection clear?
> 
> (2) In 
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith
> ub.com%2Fcwt-cnf%2Fi-d%2Fpull%2F27%2Ffiles&amp;data=02%7C01%7CMichael.
> Jones%40microsoft.com%7C3db4c9b38e6a4b2a13e408d74147db9e%7C72f988bf86f
> 141af91ab2d7cd011db47%7C1%7C1%7C637049649201375862&amp;sdata=vAL0NqVzv
> sqDAt5JYv0HdtUomFc5ldKJQtla3dtL%2BuM%3D&amp;reserved=0 we removed a large chunk of text since it contained several things that are inaccurate.  The only things that were removed that I wanted to check if we should think about keeping was the note that the same key might be referred to by different key IDs in messages directed to different recipients.  What do people think about that?

(3) I think we were going to change the [JWT] reference to [CWT], in Section 4:

-Ben

---

From: Ludwig Seitz <[email-masked]>
Date: Wed, 25 Sep 2019 08:31:03 +0200

> I'm fine with us making both of the proposed changes.

+1

-- 
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

---

From: Samuel Erdtman <[email-masked]>
Date: Wed, 25 Sep 2019 09:17:58 +0200

+1

---

From: Mike Jones <[email-masked]>
Date: Wed, 25 Sep 2019 08:13:34 +0000

Does one of you have the time to create a PR today making the two changes?  I’ll then be able to review it and publish sometime in the next 24 hours.  Or if not, I’ll plan to do it myself while flying back from Korea to the US tomorrow.

                                                       Thanks all,
                                                       -- Mike

From: Samuel Erdtman <[email-masked]>
Sent: Wednesday, September 25, 2019 12:18 AM
To: Ludwig Seitz <[email-masked]>
Cc: Mike Jones <[email-masked]>; Benjamin Kaduk <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: New Version Notification - draft-ietf-ace-cwt-proof-of-possession-07.txt

+1

On Wed, Sep 25, 2019 at 8:31 AM Ludwig Seitz <[email-masked]<mailto:[email-masked]>> wrote:

+1

--
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

---

From: Ludwig Seitz <[email-masked]>
Date: Wed, 25 Sep 2019 11:34:08 +0200

On 25/09/2019 10:13, Mike Jones wrote:
> Does one of you have the time to create a PR today making the two 
> changes?  I’ll then be able to review it and publish sometime in the 
> next 24 hours.  Or if not, I’ll plan to do it myself while flying back 
> from Korea to the US tomorrow.
> 
>                                                         Thanks all,
> 
>                                                         -- Mike
> 
> *From:* Samuel Erdtman <[email-masked]>
> *Sent:* Wednesday, September 25, 2019 12:18 AM
> *To:* Ludwig Seitz <[email-masked]>
> *Cc:* Mike Jones <[email-masked]>; Benjamin Kaduk 
> <[email-masked]>; [email-masked]; 
> [email-masked]
> *Subject:* Re: New Version Notification - 
> draft-ietf-ace-cwt-proof-of-possession-07.txt
> 
> +1
> 

I'm in the process of doing the PR, but I noticed that I can only 
address Ben's (1) and (3).

For (2) Ben was asking for our opinion.

I think we could take the note about different key IDs referring to the 
same key and reintroduce it in the text as it is a useful reminder.

(I mean that chunk:
" Note that the value of a Key ID is not always the same for different 
parties. When sending a COSE encrypted message with a shared key,
the Key ID may be different on both sides of the conversation,
with the appropriate one being included in the message based on the 
recipient of the message.")

/Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

---

From: Mike Jones <[email-masked]>
Date: Thu, 26 Sep 2019 00:47:46 +0000

On Ben's (2): "The only things that were removed that I wanted to check if we should think about keeping was the note that the same key might be referred to by different key IDs in messages directed to different recipients.  What do people think about that?"  I'm fine restoring that text.

Could you also do that, Ludwig?

				Thanks all,
				-- Mike

-----Original Message-----
From: Ludwig Seitz <[email-masked]> 
Sent: Wednesday, September 25, 2019 2:34 AM
To: Mike Jones <[email-masked]>; Samuel Erdtman <[email-masked]>
Cc: Benjamin Kaduk <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: New Version Notification - draft-ietf-ace-cwt-proof-of-possession-07.txt

(I mean that chunk:

/Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51