Subject: [dispatch] Discussion and Schedule for draft-secure-credential-transfer-01

From: Matthew Byington <[email-masked]>
Date: Fri, 22 Oct 2021 11:30:43 -0700

Hello Dispatch,

Recently, we published a new draft to IETF entitled "draft-secure-credential-transfer”.

The current revision is 01.

I am sending this email to the Dispatch distribution in order to kick off a discussion around the draft, and establish the appropriate working group.

The working group may be an existing working group or we may endeavor to create a new one. If the dispatch team could assist us with this decision that would be great.

A link to our draft is here:
https://www.ietf.org/archive/id/draft-secure-credential-transfer-01.html

The required participants for the initial discussion would be, at a minimum, the full list of authors:

Dmitry Vinokurov
Apple Inc
Email: [email-masked]

Matt Byington
Apple Inc
Email: [email-masked]

Ben Chester
Apple Inc
Email: [email-masked]

Matthias Lerch
Apple Inc
Email: [email-masked]

Crystal Qin
Alphabet Inc
Email: [email-masked]

Adam Bar-Niv
Alphabet Inc
Email: [email-masked]

Nick Sha
Alphabet Inc
Email: [email-masked]

Thank you,
Matt Byington

---

From: Ben Schwartz <[email-masked]>
Date: Tue, 26 Oct 2021 09:38:05 -0400

I'm not familiar with this draft, but a quick note on the encryption:
instead of re-specifying AES-GCM from the NIST reference here, I think you
should probably reference the IANA AEAD registry [1].  That will save you
some text and improve algorithmic agility.

For compatibility reasons, it may be appropriate to define AEAD_AES_128_GCM
and AEAD_AES_255_GCM as "mandatory to implement", which would seem to
reproduce the current requirements.

[1] https://www.iana.org/assignments/aead-parameters/aead-parameters.xhtml

On Fri, Oct 22, 2021 at 2:31 PM Matthew Byington <mbyington=
[email-masked]> wrote:

> I am sending this email to the Dispatch distribution in order to kick off
> a discussion around the draft, and establish the appropriate working group.
>
> The working group may be an existing working group or we may endeavor to
> create a new one. If the dispatch team could assist us with this decision
> that would be great.
>
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch
>

---

From: Matthew Byington <[email-masked]>
Date: Tue, 26 Oct 2021 15:54:26 -0700

Hi Ben,

Thank you very much. We are discussing internally and we will likely make the appropriate modification that you are suggesting in the next few days to our draft.

Matt

> On Oct 26, 2021, at 6:38 AM, Ben Schwartz <bemasc=[email-masked]> wrote:
> 
> I'm not familiar with this draft, but a quick note on the encryption: instead of re-specifying AES-GCM from the NIST reference here, I think you should probably reference the IANA AEAD registry [1].  That will save you some text and improve algorithmic agility.
> 
> For compatibility reasons, it may be appropriate to define AEAD_AES_128_GCM and AEAD_AES_255_GCM as "mandatory to implement", which would seem to reproduce the current requirements.
> 
> [1] https://www.iana.org/assignments/aead-parameters/aead-parameters.xhtml <https://www.iana.org/assignments/aead-parameters/aead-parameters.xhtml>
> On Fri, Oct 22, 2021 at 2:31 PM Matthew Byington <mbyington=[email-masked] <mailto:[email-masked]>> wrote:
> Hello Dispatch,
> 
> https://www.ietf.org/archive/id/draft-secure-credential-transfer-01.html <https://www.ietf.org/archive/id/draft-secure-credential-transfer-01.html>
> 
> Email: [email-masked] <mailto:[email-masked]>
> 
> Matt Byington
> Apple Inc
> Email: [email-masked] <mailto:[email-masked]>
> 
> Ben Chester
> Apple Inc
> Email: [email-masked] <mailto:[email-masked]>
> 
> Matthias Lerch
> Apple Inc
> Email: [email-masked] <mailto:[email-masked]>
> 
> Crystal Qin
> Alphabet Inc
> Email: [email-masked] <mailto:[email-masked]>
> 
> Adam Bar-Niv
> Alphabet Inc
> Email: [email-masked] <mailto:[email-masked]>
> 
> Nick Sha
> Alphabet Inc
> Email: [email-masked] <mailto:[email-masked]>
> 
> Thank you,
> Matt Byington
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/dispatch <https://www.ietf.org/mailman/listinfo/dispatch>

---

From: Ben Schwartz <[email-masked]>
Date: Tue, 26 Oct 2021 20:51:26 -0400

Great.  You may also want to check out JSON Web Encryption (RFC 7516) to
avoid defining your own encrypted object format.

On Tue, Oct 26, 2021, 6:54 PM Matthew Byington <mbyington=
[email-masked]> wrote:

> Hi Ben,
>
> Thank you very much. We are discussing internally and we will likely make
> the appropriate modification that you are suggesting in the next few days
> to our draft.
>
> Matt
>
> On Oct 26, 2021, at 6:38 AM, Ben Schwartz <
> bemasc=[email-masked]> wrote:
>
> For compatibility reasons, it may be appropriate to define
> AEAD_AES_128_GCM and AEAD_AES_255_GCM as "mandatory to implement", which
> would seem to reproduce the current requirements.
>