Subject: [COSE] draft-ietf-cose-msg-04

From: Robert Taylor <[email-masked]>
Date: Fri, 11 Sep 2015 10:36:29 +0100

Hi,

Thanks for working on this draft. I'm working on a project where
having basic security for CBOR messages is ideal.

I was wondering why you've divergered from the JOSE WG RFCs so much?
You point out in Section 1 that you've re-examined the work that JOSE
has undertaken because some of their decisions aren't appropriate.
Could you ouline why you've diverged from the JOSE work? It doesn't
appear that the changes you've made outweigh the confusion caused by
significantly diverging from the RFCs produced by the JOSE WG.

Thanks,
Robert

---

From: Justin Richer <[email-masked]>
Date: Sun, 13 Sep 2015 22:12:27 -0400

Robert, 

Thank you for your question, as I believe it is very relevant to the potential success of this working group. At the Prague IETF meeting, the chairs (of which I’m one) strongly encouraged the members of the working group, including the editor, to ask the question “What Would JOSE Do?” throughout the design of the COSE process. This does not mean that we simply copy JOSE blindly, of course. It is our guidance and hope that this question remains in the mind of everyone involved here, and that we not forget the lessons of the very near past. We also encouraged people to consider the successes and failures of JOSE in the marketplace over the last four years, to help determine which features are worth replicating and which aren’t. The hope here was to keep participants from clinging desperately to their pet features that have seen little to no acceptance outside their original working group, and that we not carry that particular baggage with us. Nor do we want to throw out everything in JOSE, since there are many things that work fantastically well in practice that aren’t liked very much by some parties. 

We do not want to fully reinvent the wheel here in COSE. Instead our intended goal is to start with the wheel that JOSE produced and adapt it, refine it, for use in constrained environments with CBOR encoding. The language you reference in section 1 should reflect that mindset (though there’s an outstanding issue for making it clearer and less bitter). But in the end, the chairs do not dictate the direction of the working group, we can only help to facilitate the discussion and process of its members moving toward a usable and understandable standard. 

Thank you for raising this issue, and I call upon the members of the working group to answer for the current direction of the protocol and discussion.

Thank you, 
 — Justin (as chair)

> On Sep 11, 2015, at 5:36 AM, Robert Taylor <[email-masked]> wrote:
> 
> Hi,
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose

---

From: "Jim Schaad" <[email-masked]>
Date: Sun, 13 Sep 2015 21:31:12 -0700

It would be easier to address specific changes rather than to try and give
reasons for all of the changes.  Some are going to be more self-explanatory
than others (the use of a binary encoding rather than base64).  Some are
still under discussion (flattened recipients and signing structures). 

It is not clear yet that there is going to be a lot of confusion about the
specifications, my implementations in C# use almost identical APIs for both
JOSE and COSE.

The general reasons for changes are:
1)  COSE is going to be smaller in size for the same message.
2)  JOSE has some security confusion that has been noted in the literature
which we are trying to avoid.
3)  COSE implementations are probably going to be smaller by reducing the
number of places things can appear.

Jim

> -----Original Message-----
> From: COSE [mailto:[email-masked]] On Behalf Of Robert Taylor
> Sent: Friday, September 11, 2015 2:36 AM
> To: [email-masked]
> Subject: [COSE] draft-ietf-cose-msg-04
> 
> Hi,
> 
> Thanks for working on this draft. I'm working on a project where having
basic
> security for CBOR messages is ideal.
> 
> You point out in Section 1 that you've re-examined the work that JOSE has
> undertaken because some of their decisions aren't appropriate.
> Could you ouline why you've diverged from the JOSE work? It doesn't appear
> that the changes you've made outweigh the confusion caused by
significantly
> diverging from the RFCs produced by the JOSE WG.
> 
> Thanks,
> Robert
>