Subject: [Ace] Clarifications on the pub-sub keying draft

From: Jim Schaad <[email-masked]>
Date: Wed, 20 Nov 2019 08:10:21 +0800

For those people who were on Jabber yesterday during the meeting, I made a
characterization of Francesca's Pub-Sub draft which was wrong, and she did
not tell me I was an idiot like she should have.

When you are doing encrypted pub-sub there are three problems that need to
be addressed:

1.  Get permissions to talk to the pub-sub server itself.  This is currently
covered by the MQTT draft and the two ACE profiles currently in last call.
In some cases this can also be a NOP.

2.  Get the group encryption keys from the Group KDC:  This is a completely
independent operation from that in step 1.  This is the first halve of the
pub-sub draft.  On jabber I was getting this mixed up with problem 1 and I
should have known better.

3.  How to encrypt the content:  This is the second halve of the pub-sub
draft.

As noted above, problem 1 is completely separate from problems 2 and 3.   It
is for this reason that I do not believe that any part of the pub-sub draft
needs to be included in the MQTT draft.  There might be a forward reference
from MQTT to this draft for content encryption processing but that should be
all that is needed.

Jim