Subject: [COSE] Replacement of the term "Key Management"

From: "Jim Schaad" <[email-masked]>
Date: Wed, 22 Jul 2015 14:47:22 +0200

There is a problem with the document currently in that it uses the term "Key
management" to deal with the general process of getting content encryption
keys from a sender to a recipient.  I use this term because it is what I am
used to from CMS where the term is used for this purpose.   

When the charter was being written, the statement that we are not doing "Key
Management" was placed in into it as a statement that the COSE working group
is not doing Key Lifecycle protocols (i.e. how you distribute keys from a
trusted server to a client or how pubic keys are transferred from a client
to a server with appropriate identity binding). 

This conflict needs to get resolved either by clarifying the charter or
changing the term that is being used in the document.   I propose that we
switch from "Key Management" to "Content Key Management" in the document so
that it clear it is not lifecycle management.  This term is correct for two
deep messages and can be finessed for three deep messages which are not
expected to be used in any event.

Do any other people have suggestions for a better term?

Jim

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 22 Jul 2015 14:52:56 +0200

Key conveyance?

Grüße, Carsten

Jim Schaad wrote:
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose
>

---

From: Brian Campbell <[email-masked]>
Date: Thu, 23 Jul 2015 06:53:30 +0200

I sort of like "Key Conveyance"

---

From: Mike Jones <[email-masked]>
Date: Thu, 23 Jul 2015 05:00:29 +0000

That works for me too.

-- Mike
________________________________
From: Brian Campbell<mailto:[email-masked]>
Sent: ‎7/‎23/‎2015 6:54 AM
To: Carsten Bormann<mailto:[email-masked]>
Cc: Jim Schaad<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [COSE] Replacement of the term "Key Management"

On Wed, Jul 22, 2015 at 2:52 PM, Carsten Bormann <[email-masked]<mailto:[email-masked]>> wrote:
Key conveyance?

Grü?e, Carsten

Jim Schaad wrote:
> [email-masked]<mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/cose<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c16fb045aadbf48df2d9208d2931abb60%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=HxUNzMNvM4p5PLZemoVJ%2fmcJy%2bhS7jRpNq%2bhklgwht8%3d>
>

_______________________________________________
COSE mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/cose<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c16fb045aadbf48df2d9208d2931abb60%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=HxUNzMNvM4p5PLZemoVJ%2fmcJy%2bhS7jRpNq%2bhklgwht8%3d>

---

From: John Bradley <[email-masked]>
Date: Thu, 23 Jul 2015 12:40:10 +0200

How about content key establishment.   Is it always conveyed and never agreed?  I don't care deeply and can live with Conveyance.  

John B.  

Sent from my iPhone

> On Jul 23, 2015, at 7:00 AM, Mike Jones <[email-masked]> wrote:
> 
> That works for me too.
> 
> -- Mike
> From: Brian Campbell
> To: Carsten Bormann
> Cc: Jim Schaad; [email-masked]

---

From: Brian Campbell <[email-masked]>
Date: Thu, 23 Jul 2015 13:34:58 +0200

One could reasonably consider agreement as a kind of conveyance, no? I did
anyway. But my grasp of language is known to be suspect so perhaps my
interpretation isn't one to rely on. Maybe key establishment is a better
term.

On Thu, Jul 23, 2015 at 12:40 PM, John Bradley <[email-masked]> wrote:

> How about content key establishment.   Is it always conveyed and never
> agreed?  I don't care deeply and can live with Conveyance.
>
> John B.
>
> Sent from my iPhone
>
>   ------------------------------
> From: Brian Campbell <[email-masked]>
> To: Carsten Bormann <[email-masked]>
> Cc: Jim Schaad <[email-masked]>; [email-masked]
>> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c16fb045aadbf48df2d9208d2931abb60%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=HxUNzMNvM4p5PLZemoVJ%2fmcJy%2bhS7jRpNq%2bhklgwht8%3d>
>> >
>>
>> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c16fb045aadbf48df2d9208d2931abb60%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=HxUNzMNvM4p5PLZemoVJ%2fmcJy%2bhS7jRpNq%2bhklgwht8%3d>
>>
>

---

From: Brian Campbell <[email-masked]>
Date: Thu, 23 Jul 2015 14:53:36 +0200

RFC 4949 <https://tools.ietf.org/html/rfc4949>, which I only just learned
about from overhearing it mentioned in the saag meeting, has the text below
for "key establishment". The second definition seems to fit for COSE. It
seems a fine color for the bikeshed.

   $ key establishment (algorithm or protocol)
      1. (I) A procedure that combines the key-generation and key-
      distribution steps needed to set up or install a secure
      communication association.

      2. (I) A procedure that results in keying material being shared
      among two or more system entities. [A9042
<https://tools.ietf.org/html/rfc4949#ref-A9042>, SP56
<https://tools.ietf.org/html/rfc4949#ref-SP56>]

      Tutorial: The two basic techniques for key establishment are "key
      agreement" and "key transport".

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 23 Jul 2015 15:00:50 +0200

"Key establishment" sounds like the establishment of state.
That is the "management" that the charter tries to exclude.
I was trying to find a term that expresses the statelessness of the
expression of the key within the COSE object.

But, of course, I also ultimately don't care, as long as we don't use
the no-no term "key management".

Grüße, Carsten

Brian Campbell wrote:
> RFC 4949 <https://tools.ietf.org/html/rfc4949>, which I only just
> learned about from overhearing it mentioned in the saag meeting, has the
> text below for "key establishment". The second definition seems to fit
> for COSE. It seems a fine color for the bikeshed.
> 
>       among two or more system entities. [A9042 <https://tools.ietf.org/html/rfc4949#ref-A9042>, SP56 <https://tools.ietf.org/html/rfc4949#ref-SP56>]
> 
> On Thu, Jul 23, 2015 at 1:34 PM, Brian Campbell
> <[email-masked] <mailto:[email-masked]>> wrote:
> 
>     One could reasonably consider agreement as a kind of conveyance, no?
>     I did anyway. But my grasp of language is known to be suspect so
>     perhaps my interpretation isn't one to rely on. Maybe key
>     establishment is a better term.
> 
>     On Thu, Jul 23, 2015 at 12:40 PM, John Bradley <[email-masked]
>     <mailto:[email-masked]>> wrote:
> 
>         How about content key establishment.   Is it always conveyed and
>         never agreed?  I don't care deeply and can live with Conveyance.  
> 
>         John B.  
> 
>         Sent from my iPhone
> 
>         On Jul 23, 2015, at 7:00 AM, Mike Jones
>         <[email-masked]
>         <mailto:[email-masked]>> wrote:
> 
>>         That works for me too.
>>
>>         -- Mike
>>         ------------------------------------------------------------------------
>>         From: Brian Campbell <mailto:[email-masked]>
>>         To: Carsten Bormann <mailto:[email-masked]>
>>         Cc: Jim Schaad <mailto:[email-masked]>; [email-masked]
>>         <mailto:[email-masked]>
>>             > [email-masked] <mailto:[email-masked]>
>>             [email-masked] <mailto:[email-masked]>
>>         [email-masked] <mailto:[email-masked]>