Subject: [Cose] Draft COSE charter

From: Mike Jones <[email-masked]>
Date: Thu, 26 Mar 2015 18:45:42 +0000

I wrote a possible first carter draft, intentionally largely based on http://datatracker.ietf.org/wg/jose/charter/.  Have at it!

                                                            -- Mike

CBOR Object Signing and Encryption (COSE)
Charter for Working Group
Concise Binary Object Representation (CBOR) is a compact binary format for the serialization of structured data described in RFC 7049. The CBOR format is often used for serializing and transmitting structured data over a network connection. With the increased usage of CBOR in protocols in the IETF and elsewhere, particularly in constrained device and Internet of Things (IoT) use cases, there is now a desire to offer security services that use message authentication codes (MACs), encryption, and digital signatures and that carry their data in CBOR format.

The JOSE working group recently completed producing representations with similar goals but using JSON data structures rather than CBOR data structures.  A goal of this working group is to reuse the work done by JOSE, where applicable to CBOR use cases, while adapting it to use CBOR data structures and incorporating other design decisions appropriate to those use cases.

The working group will strive to gather use cases to inform the design choices made, including use cases for protocols used by devices with size, power, bandwidth, and latency constraints and for Internet of Things (IoT) use cases.

This group is chartered to work on the following deliverables:

*        An Informational specification detailing Use Cases and Requirements for CBOR Object Signing and Encryption (COSE).

*        A Standards Track specification specifying a representation of integrity-protected data using CBOR data structures, where the data to be protected includes (but is not limited to) CBOR data structures. "Integrity protection" includes public-key digital signatures as well as symmetric-key MACs.  This deliverable will reuse those design decisions made in draft-ietf-jose-json-web-signature that are appropriate to the COSE use cases.

*        A Standards Track specification specifying a representation of encrypted data using CBOR data structures, where the data to be protected includes (but is not limited to) CBOR data structures.  This deliverable will reuse those design decisions made in draft-ietf-jose-json-web-encryption that are appropriate to the COSE use cases.

*        A Standards Track specification specifying how to represent cryptographic keys as CBOR-structured objects.  This deliverable will represent keys in a manner equivalent to draft-ietf-jose-json-web-key, but using CBOR rather than JSON data representations.

*        A Standards Track specification specifying algorithms and algorithm identifiers for the previous three specifications. This deliverable will reuse algorithms, identifiers, and registries already present in draft-ietf-jose-json-web-algorithms that are appropriate to the COSE use cases, while possibly extending the set of registered algorithms and identifiers in ways that are appropriate to the COSE use cases.
One or more of these goals may be combined into a single specification, in which case the concrete milestones for these goals will be satisfied by the consolidated specification(s).

Milestones
April 2015

Submit COSE use cases and requirements specification as a WG item

May 2015

Submit COSE object integrity specification as a WG item

May 2015

Submit COSE object encryption specification as a WG item

May 2015

Submit COSE key format specification as a WG item

May 2015

Submit COSE algorithm specification as a WG item

Jul 2015

WGLC for COSE use cases and requirements specification

Sep 2015

IETF last call for COSE use cases and requirements specification

Nov 2015

WGLC for COSE object integrity specification

Nov 2015

WGLC for COSE object encryption specification

Nov 2015

WGLC for COSE key format specification

Nov 2015

WGLC for COSE algorithm specification

Jan 2016

IETF last call for COSE object integrity specification

Jan 2016

IETF last call for COSE object encryption specification

Jan 2016

IETF last call for COSE key format specification

Jan 2016

IETF last call for COSE algorithm specification

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 27 Mar 2015 07:41:21 -0500

> I wrote a possible first carter draft, intentionally largely based on http://datatracker.ietf.org/wg/jose/charter/.  Have at it!

My first impression is that this proposed charter is massive overkill. One important lesson from the JOSE WG was that long schedules such as this become targets for "those people are already using this feature, so you can't change it in the spec even if it is bad".

A different idea is a short charter for exactly one document that defines the COSE spec. The WG should collect use cases as we go on a Wiki. If someone wants to capture that later in an RFC, they can do so.

--Paul Hoffman

---

From: Mike Jones <[email-masked]>
Date: Fri, 27 Mar 2015 17:10:04 +0000

Hi Paul,

> From: Paul Hoffman [mailto:[email-masked]] 
>

If you think the milestones give too much time, by all means, suggest shorter ones.  If we have aggressive editors and an engaged working group, I'm sure we can beat the ones I wrote down as a strawman.  What do you think the milestones should be?

> A different idea is a short charter for exactly one document that defines the COSE spec.

As the draft that I posted says, the working group would free to combine any of those deliverables into a smaller set of documents, including one.  I still think that it's important to call out what the deliverables are.  (For instance, is a JWK equivalent in scope?  If so, I think the charter needs to say so.)  Do you believe that we should take any of the listed deliverables off the table?

> The WG should collect use cases as we go on a Wiki. If someone wants to capture that later in an RFC, they can do so.

I'm fine with that approach.  We could therefore weaken the description of that deliverable to say that the working group MAY produce a use cases RFC, so that if it decides to do so, it doesn't require rechartering.

				-- Mike

---

From: Carsten Bormann <[email-masked]>
Date: Fri, 27 Mar 2015 13:28:20 -0500

Here is an update of my charter proposal.
I took in the proposal to have the algorithm registrations in a separate
draft.

Since the adaptation of JOSE to CBOR is mostly straightforward, I think
we can be light on the usecases.  So I didn't bother to put usecases
into the charter at all.  If indeed a usecases document emerges from the
Wiki, I'd expect the ADs to be flexible enough to allow us to take this on.

Grüße, Carsten

---

From: Mike Jones <[email-masked]>
Date: Fri, 27 Mar 2015 18:32:11 +0000

Your document is silent on whether we'll develop a JWK-equivalent.  Talking to you in person, I think the answer is "yes".  Could you add that deliverable to your doc and republish, Carsten?

-----Original Message-----
From: Cose [mailto:[email-masked]] On Behalf Of Carsten Bormann
Sent: Friday, March 27, 2015 1:28 PM
To: Mike Jones
Cc: Paul Hoffman; [email-masked]
Subject: Re: [Cose] Draft COSE charter

Here is an update of my charter proposal.
I took in the proposal to have the algorithm registrations in a separate draft.

Since the adaptation of JOSE to CBOR is mostly straightforward, I think we can be light on the usecases.  So I didn't bother to put usecases into the charter at all.  If indeed a usecases document emerges from the Wiki, I'd expect the ADs to be flexible enough to allow us to take this on.

Grüße, Carsten

---

From: Carsten Bormann <[email-masked]>
Date: Fri, 27 Mar 2015 17:20:44 -0500

> Your document is silent on whether we'll develop a JWK-equivalent.  Talking to you in person, I think the answer is "yes".  Could you add that deliverable to your doc and republish, Carsten?

Indeed.

I was assuming that

> a single Standards-Track specification
> covering all of the functions achieved by JOSE

was covering this.  Is there a reason JWK needs to be called out in a
special way?  There is a couple of paragraphs covering JWK in
draft-schaad-cose-00.txt; what is missing?

Grüße, Carsten

---

From: Mike Jones <[email-masked]>
Date: Fri, 27 Mar 2015 22:26:27 +0000

The charter should be able to be clearly read and understood independently of any drafts related to it.

I'd add a sentence or two about keys since while signing and encryption address implied from the title, having support for keys isn't.

Clarity never hurts. :-)

Thanks,
-- Mike
________________________________
From: Carsten Bormann<mailto:[email-masked]>
Sent: ‎3/‎27/‎2015 5:20 PM
To: Mike Jones<mailto:[email-masked]>
Cc: Paul Hoffman<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Cose] Draft COSE charter

Indeed.

I was assuming that

Grüße, Carsten

---

From: Carsten Bormann <[email-masked]>
Date: Fri, 27 Mar 2015 18:41:26 -0500

Mike Jones wrote:
> I'd add a sentence or two about keys since while signing and encryption
> address implied from the title, having support for keys isn't.

Does the below work?

Grüße, Carsten

---

From: Mike Jones <[email-masked]>
Date: Sat, 28 Mar 2015 00:03:48 +0000

Good - thanks.
Sent: ‎3/‎27/‎2015 6:41 PM

Does the below work?

Grüße, Carsten

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 28 Mar 2015 11:50:21 -0700

The wording in the last paragraph (deliverables) needs a bit more work. The "single" is confusing because it is followed by a second document. Also, "functions" seems like the wrong word here.

Current:
The deliverable of the WG is a single Standards-Track specification
covering all of the functions achieved by JOSE (including JWS, JWE,
JWK), CBOR Object Signing and Encryption (COSE).  In addition, a
number of algorithms (JWA) will be registered that are appropriate for
constrained environments (such as AES-CCM-8).

Proposed:
The WG will have two deliverables:
- a standards-track specification covering the same cryptographic
formats from JOSE, expressed in CBOR
- registration for algorithms (such as AES-CCM-8) that are appropriate
for constrained environments

In addition, I think the charter should mention use cases so that the greater IESG community understands how we will handle them. Proposed addition:
The Working Group will use a wiki to track desired use cases for its work,
but does not intend to publish this as an RFC.

--Paul Hoffman

---

From: Mike Jones <[email-masked]>
Date: Sat, 28 Mar 2015 18:52:57 +0000

s/but does not intend to publish this as an RFC/but may or may not decide to publish use cases as an RFC/

Let's not tie our hands whether to do this in the charter or not.  Let the WG decide later.

-----Original Message-----
From: Cose [mailto:[email-masked]] On Behalf Of Paul Hoffman
Sent: Saturday, March 28, 2015 11:50 AM
To: [email-masked]
Subject: Re: [Cose] Draft COSE charter

Current:
The deliverable of the WG is a single Standards-Track specification covering all of the functions achieved by JOSE (including JWS, JWE, JWK), CBOR Object Signing and Encryption (COSE).  In addition, a number of algorithms (JWA) will be registered that are appropriate for constrained environments (such as AES-CCM-8).

Proposed:
The WG will have two deliverables:
- a standards-track specification covering the same cryptographic formats from JOSE, expressed in CBOR
- registration for algorithms (such as AES-CCM-8) that are appropriate for constrained environments

In addition, I think the charter should mention use cases so that the greater IESG community understands how we will handle them. Proposed addition:
The Working Group will use a wiki to track desired use cases for its work, but does not intend to publish this as an RFC.

--Paul Hoffman
_______________________________________________
Cose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cose

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 28 Mar 2015 12:04:00 -0700

> Let's not tie our hands whether to do this in the charter or not.  Let the WG decide later.

The purpose of an IETF WG charter is to commit to a list of work items. If the WG wants to later add items, it can ask the IETF to revise the charter. Thus, "may or may not" is not appropriate text for a work item in a charter.

--Paul Hoffman

---

From: Mike Jones <[email-masked]>
Date: Sat, 28 Mar 2015 19:41:41 +0000

Fair enough

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Saturday, March 28, 2015 12:04 PM
To: Mike Jones
Cc: [email-masked]
Subject: Re: [Cose] Draft COSE charter

--Paul Hoffman

---

From: "Kepeng Li" <[email-masked]>
Date: Sun, 29 Mar 2015 23:11:03 +0800

Thanks for the input.Based on the discussion, now the draft charter 2015-03-29 is:# CBOR Object Signing and Encryption (COSE)

## Charter for Working Group

Concise Binary Object Representation (CBOR, RFC 7049) is a concise
binary format for the serialization of data structured to an extended
version of the JSON data model. One motivation for CBOR was to make
this data model more amenable to constrained nodes and constrained
node networks (RFC 7228).

The JOSE working group recently completed producing representations
for message authentication (MACs), encryption, and digital signatures,
using JSON representation. This working group will reuse the work
done by JOSE, adapting it to the capabilities of CBOR. This will rely
on the JOSE registries, which, where this provides additional
efficiency, will be expanded with additional information.

The resulting formats will not be cryptographically convertible from
or to JOSE formats. This lack of a need for bit-for-bit compabitility
which will enable some simplification in the adaptation process.

The WG will have two deliverables:
- a standards-track specification covering the same cryptographic
formats from JOSE, expressed in CBOR;
- registration for algorithms (such as AES-CCM-8) that are appropriate
for constrained environments.

## Milestones

* March 2015: Submit COSE specification as a WG item

* April 2015: Submit COSE constrained-appropriate algorithms as a WG item

* June 2015: Submit COSE specification to the IESG, for publication as
 a Proposed Standard

* July 2015: Submit COSE constrained-appropriate algorithms to the
 IESG, for publication as a Proposed Standard

I will put the draft charter to a wiki page, so we can track changes from that.Please provide further feedback about the current charter.Thanks,Kind RegardsKepeng------------------------------------------------------------------
发件人：Mike Jones <[email-masked]>
发送时间：2015年3月29日(星期日) 03:41
收件人：Paul Hoffman <[email-masked]>
抄　送：[email-masked] <[email-masked]>
主　题：Re: [Cose] Draft COSE charter

Fair enough

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Saturday, March 28, 2015 12:04 PM
To: Mike Jones
Cc: [email-masked]
Subject: Re: [Cose] Draft COSE charter

--Paul Hoffman

---

From: Mike Jones <[email-masked]>
Date: Sun, 29 Mar 2015 16:12:28 +0000

This leaves out the statement about also doing a JWK making that Carsten agreed to.  And this will be directly cryptographically mappable, so that in the proposed charter would need to be scoped to only signature and encryption representations but not keys or algorithms.
________________________________
From: Kepeng Li<mailto:[email-masked]>
Sent: ‎3/‎29/‎2015 8:11 AM
To: Paul Hoffman<mailto:[email-masked]>; Mike Jones<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>
Subject: [Cose]  Draft COSE charter 2015-03-29

Thanks for the input.

Based on the discussion, now the draft charter 2015-03-29 is:

# CBOR Object Signing and Encryption (COSE)

## Milestones

I will put the draft charter to a wiki page, so we can track changes from that.

Please provide further feedback about the current charter.

Thanks,

Kind Regards
Kepeng

------------------------------------------------------------------
???:Mike Jones <[email-masked]>
????:2015?3?29?(???) 03:41
???:Paul Hoffman <[email-masked]>
???:[email-masked] <[email-masked]>
???:Re: [Cose] Draft COSE charter

Fair enough

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]]
Sent: Saturday, March 28, 2015 12:04 PM
To: Mike Jones
Cc: [email-masked]
Subject: Re: [Cose] Draft COSE charter

--Paul Hoffman

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 29 Mar 2015 12:25:43 -0700

> This leaves out the statement about also doing a JWK making that Carsten agreed to.  And this will be directly cryptographically mappable, so that in the proposed charter would need to be scoped to…

Why should this group do a JWK mapping? As long as the project has a structure that has the same properties as JWKs (such as those in draft-schaad-cose-00), what is the need for an actual mapping?

--Paul Hoffman

---

From: Mike Jones <[email-masked]>
Date: Sun, 29 Mar 2015 20:47:45 +0000

The JWK mapping needs to be defined to be able to reuse the JWK registries in the COSE key representation.
________________________________
From: Paul Hoffman<mailto:[email-masked]>
Sent: ‎3/‎29/‎2015 12:26 PM
To: Mike Jones<mailto:[email-masked]>
Cc: Kepeng Li<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Cose]  Draft COSE charter 2015-03-29

--Paul Hoffman