Subject: [Ace] I-D Action: draft-bormann-core-ace-aif-08.txt

From: [email-masked]
Date: Mon, 22 Jun 2020 15:12:27 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF.

        Title           : An Authorization Information Format (AIF) for ACE
        Author          : Carsten Bormann
	Filename        : draft-bormann-core-ace-aif-08.txt
	Pages           : 9
	Date            : 2020-06-22

Abstract:
   Constrained Devices as they are used in the "Internet of Things" need
   security.  One important element of this security is that devices in
   the Internet of Things need to be able to decide which operations
   requested of them should be considered authorized, need to ascertain
   that the authorization to request the operation does apply to the
   actual requester, and need to ascertain that other devices they place
   requests on are the ones they intended.

   To transfer detailed authorization information from an authorization
   manager (such as an ACE-OAuth Authorization Server) to a device, a
   representation format is needed.  This document provides a suggestion
   for such a format, the Authorization Information Format (AIF).  AIF
   is defined both as a general structure that can be used for many
   different applications and as a specific refinement that describes
   REST resources and the permissions on them.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-bormann-core-ace-aif/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-bormann-core-ace-aif-08
https://datatracker.ietf.org/doc/html/draft-bormann-core-ace-aif-08

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-bormann-core-ace-aif-08

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 23 Jun 2020 00:16:54 +0200

I went ahead and quickly implemented what we had discussed today.

https://www.ietf.org/id/draft-bormann-core-ace-aif-08.html

Lots more editing to do, but the gist of what I was trying to say should be there.
Comments welcome!

Grüße, Carsten

> On 2020-06-23, at 00:12, [email-masked] wrote:
> 
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Francesca Palombini <[email-masked]>
Date: Tue, 23 Jun 2020 13:44:54 +0000

Hi Carsten,

Thanks for this quick update! Just some short high level comments, to make sure we can use this for ace-key-groupcomm-oscore.

In ace-key-groupcomm-oscore, we would say that Toid is the identifier of the OSCORE group, so the OSCORE "group name", which is encoded as a bstr. For Tperm, it's a bit further away from what the aif document specifies (which is why I want to check with you), but we would go for array of tstr, since we can't really encode the permission to be a "monitor" node (for example) by indicating a REST method. This is a bit stretched from the document right now, but it should work.

We would have to register a media type (and content format) for this, so what would this be? You use aif+cbor for the default, so maybe something like "aif-ace-group+cbor". For section 5.3, we would have to register Toid and Tperm with something like:

Toid registry:
* name: gname
* description: group name of the OSCORE group as specified in ace-key-groupcomm-oscore

Tperm registry:
* name: roles
* description: role of the group member as specified in ace-key-groupcomm-oscore

I think we are missing some form of "encoding" column in the registries above. In that case it would be "bstr" for Toid gname and "CBOR array of tstr" for Tperm role. It would also be "tstr" for local-part Toid and "int" for Tperm REST-method-set. (also, minor, but you sometimes use "local-part" and sometimes "local-uri", see section 4). Even better, the description or the encoding in the registry could point to "path" and "permissions" cddl, for the default values in the aif doc.

Using "array of tstr" for roles allows us to express what we need for "set of roles". I don't see this being in contrast with the aif document right now.

So all in all, I think this can work for ace-key-groupcomm-oscore. Please let me know if you see anything that bothers you in my summary.

Thanks,
Francesca 

On 23/06/2020, 00:17, "Ace on behalf of Carsten Bormann" <[email-masked] on behalf of [email-masked]> wrote:

    Grüße, Carsten

    _______________________________________________
    Ace mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/ace

---

From: Jim Schaad <[email-masked]>
Date: Tue, 23 Jun 2020 08:46:53 -0700

> -----Original Message-----
> From: Ace <[email-masked]> On Behalf Of Francesca Palombini
> Sent: Tuesday, June 23, 2020 6:45 AM
> To: Carsten Bormann <[email-masked]>; Ace Wg <[email-masked]>
> Cc: Marco Tiloca <[email-masked]>
> Subject: Re: [Ace] AIF as discussed today (Re: I-D Action: draft-bormann-core-
> ace-aif-08.txt)
> 
> Hi Carsten,
> 
> Thanks for this quick update! Just some short high level comments, to make
> sure we can use this for ace-key-groupcomm-oscore.
> 
> In ace-key-groupcomm-oscore, we would say that Toid is the identifier of the
> OSCORE group, so the OSCORE "group name", which is encoded as a bstr. For
> Tperm, it's a bit further away from what the aif document specifies (which is
> why I want to check with you), but we would go for array of tstr, since we can't
> really encode the permission to be a "monitor" node (for example) by
> indicating a REST method. This is a bit stretched from the document right now,
> but it should work.
> 
> We would have to register a media type (and content format) for this, so what
> would this be? You use aif+cbor for the default, so maybe something like "aif-
> ace-group+cbor". For section 5.3, we would have to register Toid and Tperm
> with something like:
> 
> Toid registry:
> * name: gname
> I think we are missing some form of "encoding" column in the registries above.
> In that case it would be "bstr" for Toid gname and "CBOR array of tstr" for
> Tperm role. It would also be "tstr" for local-part Toid and "int" for Tperm REST-
> method-set. (also, minor, but you sometimes use "local-part" and sometimes
> "local-uri", see section 4). Even better, the description or the encoding in the
> registry could point to "path" and "permissions" cddl, for the default values in
> the aif doc.
> 
> Using "array of tstr" for roles allows us to express what we need for "set of
> roles". I don't see this being in contrast with the aif document right now.

This follows what I would expect, for MQTT I would see

AIF-MQTT = AIF_Generic<filter, permissions>
filter = tstr
permissions = [ +permission ]
permission = "publish" / "subscribe"

For the group comm draft, I think that

AIF-GROUP-COM = AIF_Generic<path, permisions>
path = tstr  ; group name
permissions = uint . bits methods
methods = &(
    requester = 1,
   responder = 2,
   monitor = 3,
   verifier = 4
)

This does require a registry if we ever expect this to grow.
 
> So all in all, I think this can work for ace-key-groupcomm-oscore. Please let me
> know if you see anything that bothers you in my summary.
> 
> Thanks,
> Francesca
> 
> On 23/06/2020, 00:17, "Ace on behalf of Carsten Bormann" <ace-
> [email-masked] on behalf of [email-masked]> wrote:
>

---

From: Cigdem Sengul <[email-masked]>
Date: Tue, 23 Jun 2020 21:27:19 +0100

This looks what I expected from the MQTT point of view. Thanks, Jim.
I will look into adding the change to the profile document now.
Kind regards,
--Cigdem

On Tue, Jun 23, 2020 at 4:48 PM Jim Schaad <[email-masked]> wrote:

> > * description: role of the group member as specified in
> ace-key-groupcomm-
> > oscore
> >
> >     Lots more editing to do, but the gist of what I was trying to say
> should be
> > there.
> >     Comments welcome!
> >
> >     Grüße, Carsten
> >
> >
> >     > This draft is a work item of the Authentication and Authorization
> for
> > Constrained Environments WG of the IETF.
> >     >

---

From: Marco Tiloca <[email-masked]>
Date: Tue, 23 Jun 2020 22:41:58 +0200

Hi,

I think AIF-GROUP-COM as defined below works well for
ace-key-groupcomm-oscore.

It sounds safe to also have a register for the role integer values.

Thanks,
/Marco

On 2020-06-23 22:27, Cigdem Sengul wrote:
> On Tue, Jun 23, 2020 at 4:48 PM Jim Schaad <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>
>
>     > From: Ace <[email-masked] <mailto:[email-masked]>>
>     On Behalf Of Francesca Palombini
>     > To: Carsten Bormann <[email-masked] <mailto:[email-masked]>>; Ace Wg
>     <[email-masked] <mailto:[email-masked]>>
>     > Cc: Marco Tiloca <[email-masked] <mailto:[email-masked]>>
>     > * description: group name of the OSCORE group as specified in
>     ace-key-
>     > groupcomm-oscore
>     >
>     > Tperm registry:
>     > * name: roles
>     > [email-masked] <mailto:[email-masked]> on behalf of
>     [email-masked] <mailto:[email-masked]>> wrote:
>     >
>     >     Lots more editing to do, but the gist of what I was trying
>     to say should be
>     > there.
>     >     Comments welcome!
>     >
>     >     Grüße, Carsten
>     >
>     >
>     >     > On 2020-06-23, at 00:12, [email-masked]
>     <mailto:[email-masked]> wrote:
>     >     >
>     >     >
>     >     > A New Internet-Draft is available from the on-line
>     Internet-Drafts
>     > directories.
>     >     > This draft is a work item of the Authentication and
>     Authorization for
>     >     >
>     >     >        Title           : An Authorization Information
>     Format (AIF) for ACE
>     >     >        Author          : Carsten Bormann
>     >     >         Filename        : draft-bormann-core-ace-aif-08.txt
>     >     >         Pages           : 9
>     >     >         Date            : 2020-06-22
>     >     >
>     >     > Abstract:
>     >     >   Constrained Devices as they are used in the "Internet of
>     Things" need
>     >     >   security.  One important element of this security is
>     that devices in
>     >     >   the Internet of Things need to be able to decide which
>     operations
>     >     >   requested of them should be considered authorized, need
>     to ascertain
>     >     >   that the authorization to request the operation does
>     apply to the
>     >     >   actual requester, and need to ascertain that other
>     devices they place
>     >     >   requests on are the ones they intended.
>     >     >
>     >     >   To transfer detailed authorization information from an
>     authorization
>     >     >   manager (such as an ACE-OAuth Authorization Server) to a
>     device, a
>     >     >   representation format is needed.  This document provides
>     a suggestion
>     >     >   for such a format, the Authorization Information Format
>     (AIF).  AIF
>     >     >   is defined both as a general structure that can be used
>     for many
>     >     >   different applications and as a specific refinement that
>     describes
>     >     >   REST resources and the permissions on them.
>     >     >
>     >     >
>     >     > The IETF datatracker status page for this draft is:
>     >     > https://datatracker.ietf.org/doc/draft-bormann-core-ace-aif/
>     >     >
>     >     > There are also htmlized versions available at:
>     >     > https://tools.ietf.org/html/draft-bormann-core-ace-aif-08
>     >     >
>     >     >
>     >     > A diff from the previous version is available at:
>     >     >
>     >     >
>     >     >
>     >     > Please note that it may take a couple of minutes from the
>     time of
>     > submission
>     >     > until the htmlized version and diff are available at
>     tools.ietf.org <http://tools.ietf.org>.
>     >     >
>     >     > Internet-Drafts are also available by anonymous FTP at:
>     >     > ftp://ftp.ietf.org/internet-drafts/
>     >     >
>     >     >
>     >     > _______________________________________________
>     >     > I-D-Announce mailing list
>     >     > [email-masked] <mailto:[email-masked]>
>     >     > https://www.ietf.org/mailman/listinfo/i-d-announce
>     >     > Internet-Draft directories: http://www.ietf.org/shadow.html
>     >     > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>     >
>     >     [email-masked] <mailto:[email-masked]>
>     > [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>

-- 
Marco Tiloca
Ph.D., Senior Researcher

RISE Research Institutes of Sweden
Division ICT
Isafjordsgatan 22 / Kistagången 16
SE-164 40 Kista (Sweden)

Phone: +46 (0)70 60 46 501
https://www.ri.se

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 27 Jun 2020 23:44:10 +0200

Instead of working on the (great) comments in the reviews, I went ahead and added permissions for dynamic resources.  Enjoy:

Html:           https://www.ietf.org/id/draft-bormann-core-ace-aif-09.html
Htmlized:       https://tools.ietf.org/html/draft-bormann-core-ace-aif-09
Diff:           https://tools.ietf.org/rfcdiff?url2=draft-bormann-core-ace-aif-09.txt

(Yes, the comments are next, I just had to dump the results of recent discussions into the draft first.  EBRAINFULL)

Grüße, Carsten