Subject: [COSE] FW: New Version Notification for draft-ietf-cose-msg-13.txt

From: "Jim Schaad" <[email-masked]>
Date: Fri, 17 Jun 2016 00:18:12 -0700

This draft responds to the vast majority of the last call comments that have been received.  Mail about outstanding issues was sent at the time the pull requests were created but no responses have been received.

I believe that any remaining issues could be treated as IETF last call comments or can be dealt with as the same time that AD comments are dealt with.  With this in mind, I would request that the chairs review the document for advancement.

Jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Friday, June 17, 2016 12:10 AM
> To: Jim Schaad <[email-masked]>
> Subject: New Version Notification for draft-ietf-cose-msg-13.txt
> 
> 
> A new version of I-D, draft-ietf-cose-msg-13.txt has been successfully submitted
> by Jim Schaad and posted to the IETF repository.
> 
> Name:		draft-ietf-cose-msg
> Revision:	13
> Title:		COSE: A Message Based Security Solution for CBOR
> Document date:	2016-06-17
> Group:		cose
> Pages:		115
> URL:            https://www.ietf.org/internet-drafts/draft-ietf-cose-msg-13.txt
> Status:         https://datatracker.ietf.org/doc/draft-ietf-cose-msg/
> Htmlized:       https://tools.ietf.org/html/draft-ietf-cose-msg-13
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-ietf-cose-msg-13
> 
> Abstract:
>    Concise Binary Object Representation (CBOR) is data format designed
>    for small code size and small message size.  There is a need for the
>    ability to have the basic security services defined for this data
>    format.  This document defines the CBOR Object Signing and Encyption
>    (COSE) specification.  This specification describes how to create and
>    process signature, message authentication codes and encryption using
>    CBOR for serialization.  This specifiction additionally specifies how
>    to representat cryptographic keys using CBOR.
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat

---

From: "Kepeng Li" <[email-masked]>
Date: Sat, 18 Jun 2016 21:34:09 +0800

Just some questions for clarification.

1. About the document title, COSE: A Message Based Security Solution for
CBOR, why don’t we use something like this: COSE: CBOR Object Signing and
Encyption specification?

2. Section 13, section title is just "keys“, should we be more specific?
Maybe it is too genetic to say just keys. We have talked about keys in
several sections. We need to diffentiate this section with other places
from the title.

3. Section 17, "implementation status“, this is an informative section.
Should we move it to appendix?

Kind Regards
Kepeng
(Individual)

在 17/6/16 3:18 pm， "Jim Schaad" <[email-masked]> 写入:

>This draft responds to the vast majority of the last call comments that
>have been received.  Mail about outstanding issues was sent at the time
>the pull requests were created but no responses have been received.
>
>I believe that any remaining issues could be treated as IETF last call
>comments or can be dealt with as the same time that AD comments are dealt
>with.  With this in mind, I would request that the chairs review the
>document for advancement.
>
>Jim
>
>
>> URL:            
>>https://www.ietf.org/internet-drafts/draft-ietf-cose-msg-13.txt
>_______________________________________________
>COSE mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/cose

---

From: "Jim Schaad" <[email-masked]>
Date: Sat, 18 Jun 2016 09:24:38 -0700

> From: Kepeng Li [mailto:[email-masked]]
> Sent: Saturday, June 18, 2016 6:34 AM
> To: Jim Schaad <[email-masked]>; [email-masked]
> Subject: Re: [COSE] FW: New Version Notification for
draft-ietf-cose-msg-13.txt
> 1. About the document title, COSE: A Message Based Security Solution for
CBOR,
> why don’t we use something like this: COSE: CBOR Object Signing and
Encyption
> specification?

I would prefer to use a title that is representative of what the document is
supposed to do.  It is possible that the second title will be required but
it is not my preference.

> Maybe it is too genetic to say just keys. We have talked about keys in
several
> sections. We need to diffentiate this section with other places from the
title.

Matching the other sections, the title should probably be "Key Objects".

> Should we move it to appendix?

This section is removed before publication - so it's location is not all of
that significant.

Jim

> >comments or can be dealt with as the same time that AD comments are
> >dealt with.  With this in mind, I would request that the chairs review
> >the document for advancement.
> >
> >Jim
> >
> >
> >> A new version of I-D, draft-ietf-cose-msg-13.txt has been
> >>successfully submitted  by Jim Schaad and posted to the IETF
> >>repository.
> >>
> >> Diff:
https://www.ietf.org/rfcdiff?url2=draft-ietf-cose-msg-13
> >> Please note that it may take a couple of minutes from the time of
> >>submission  until the htmlized version and diff are available at
> >>tools.ietf.org.
> >>
> >> The IETF Secretariat
> >
> >

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 18 Jun 2016 21:50:22 +0200

Hi Jim,

> COSE

The rfc Editor is going to insist on expanding that abbreviation anyway. Actually, I don't mind the result of doing that to your title.  

Grüße, Carsten

---

From: "Jim Schaad" <[email-masked]>
Date: Sat, 18 Jun 2016 14:00:19 -0700

As I have said, I might lose that battle, but I think that expanding the acronyms in the title is actually counterproductive and I am willing to try and fight it.  I intend to bring it up as an issue to the right people in Berlin.

Jim

From: Carsten Bormann [mailto:[email-masked]] 
Sent: Saturday, June 18, 2016 12:50 PM
To: Jim Schaad <[email-masked]>
Cc: 'Kepeng Li' <[email-masked]>; " [email-masked] " <[email-masked]>
Subject: Re: [COSE] FW: New Version Notification for draft-ietf-cose-msg-13.txt

Hi Jim,

COSE

Grüße, Carsten 

On 18 Jun 2016 18:24, Jim Schaad wrote: 

-----Original Message----- 
From: Kepeng Li [mailto:[email-masked]] 
Sent: Saturday, June 18, 2016 6:34 AM 
To: Jim Schaad <[email-masked] <mailto:[email-masked]> >; [email-masked] <mailto:[email-masked]>  
Subject: Re: [COSE] FW: New Version Notification for 

CBOR, 

Encyption 

specification? 

several 

title. 

Jim 

Kind Regards 
Kepeng 
(Individual) 

在 17/6/16 3:18 pm， "Jim Schaad" <[email-masked] <mailto:[email-masked]> > 写入: 

Jim 

-----Original Message----- 
From: [email-masked] <mailto:[email-masked]>  [mailto:[email-masked]] 
Sent: Friday, June 17, 2016 12:10 AM 
To: Jim Schaad <[email-masked] <mailto:[email-masked]> > 
Subject: New Version Notification for draft-ietf-cose-msg-13.txt 

Abstract: 
(COSE) specification. This specification describes how to create 

and 

process signature, message authentication codes and encryption using 
CBOR for serialization. This specifiction additionally specifies 

how 

The IETF Secretariat 

_______________________________________________ 
COSE mailing list 
[email-masked] <mailto:[email-masked]>  
https://www.ietf.org/mailman/listinfo/cose 

_______________________________________________ 
COSE mailing list 
[email-masked] <mailto:[email-masked]>  
https://www.ietf.org/mailman/listinfo/cose

---

From: "Jim Schaad" <[email-masked]>
Date: Sun, 19 Jun 2016 11:07:44 -0700

I should have read the section rather than just the TOC.  The correct
section title would be "Key Object Parameters" not "Key Object" as that
should be the title for section 7.

Jim

> From: COSE [mailto:[email-masked]] On Behalf Of Jim Schaad
> Sent: Saturday, June 18, 2016 9:25 AM
> To: 'Kepeng Li' <[email-masked]>; [email-masked]
> supposed to do.  It is possible that the second title will be required but
it is not
> my preference.
> This section is removed before publication - so it's location is not all
of that
> significant.
> > >This draft responds to the vast majority of the last call comments
> > >that have been received.  Mail about outstanding issues was sent at
> > >the time the pull requests were created but no responses have been
received.
> > >
> > >I believe that any remaining issues could be treated as IETF last
> > >call comments or can be dealt with as the same time that AD comments
> > >are dealt with.  With this in mind, I would request that the chairs
> > >review the document for advancement.
> > >
> > >Jim
> > >
> > >

---

From: Justin Richer <[email-masked]>
Date: Sun, 19 Jun 2016 16:22:57 -0400

I agree with Kepeng and others on the title: "COSE: CBOR Object Signing 
and Encryption".

  -- Justin

On 6/18/2016 9:34 AM, Kepeng Li wrote:
>>> submission

---

From: "Jim Schaad" <[email-masked]>
Date: Sun, 19 Jun 2016 15:31:13 -0700

Ok, there are two possible reasons for that statement.  The first is you just think that the title that I like is a worse title. The second is following on from Carsten's mail which says that we need to expand acronyms.  If it is the latter, then the correct title of the document is:

COSE: Concise Binary Object Representation (CBOR) Object Signing and Encryption.

Or

Concise Binary Object Representation (CBOR) Object Signing and Encryption (COSE)

Of those two titles, I prefer the second and it does not try to be prose but is just the expansion.

Jim

> From: Justin Richer [mailto:[email-masked]]
> Sent: Sunday, June 19, 2016 1:23 PM
> To: Kepeng Li <[email-masked]>; Jim Schaad
> <[email-masked]>; [email-masked]
> I agree with Kepeng and others on the title: "COSE: CBOR Object Signing and
> Encryption".
> 
>   -- Justin
> 
> 
> > 1. About the document title, COSE: A Message Based Security Solution
> > for CBOR, why don’t we use something like this: COSE: CBOR Object
> > Signing and Encyption specification?
> >
> > several sections. We need to diffentiate this section with other
> > places from the title.
> >
> >> the time the pull requests were created but no responses have been received.
> >>

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 20 Jun 2016 01:03:07 +0200

> Concise Binary Object Representation (CBOR) Object Signing and Encryption (COSE)

That is pretty funny :-)

The RFC editor has not insisted on expanding the term "JSON" in titles
such as

	JSON Responses for the Registration Data Access Protocol (RDAP).

I hope we can do the same for CBOR.

But COSE is a new abbreviation to be introduced by this very RFC, so
that indeed should be expanded.  (If its expansion means something;
e.g., SOAP famously doesn't any more.)

Grüße, Carsten

---

From: "Jim Schaad" <[email-masked]>
Date: Sun, 19 Jun 2016 17:39:06 -0700

I would argue that it does not really mean anything.  The fact that Object is basically repeated twice in the expansion is an artifact of trying to get something pronounceable but no something that makes sense.  If we were going for something that made sense, I would argue that CSE would be more reasonable as it does not duplicate the object of CBOR.  COSE was chosen as much to parallel with JOSE as anything else but those specs are JWE and JWS not JOSE.  

Maybe we should start from scratch and build a new acronym that makes sense and stop using COSE.

(By the way, I note that CBOR is not on https://www.rfc-editor.org/materials/abbrev.expansion.txt so you might want to ask the RFC Editor to add it.)

Jim

> Sent: Sunday, June 19, 2016 4:03 PM
> Cc: 'Justin Richer' <[email-masked]>; 'Kepeng Li' <kepeng.lkp@alibaba-
> inc.com>; [email-masked]
> The RFC editor has not insisted on expanding the term "JSON" in titles such as
> 
> But COSE is a new abbreviation to be introduced by this very RFC, so that indeed
> should be expanded.  (If its expansion means something; e.g., SOAP famously
> doesn't any more.)
> 
> Grüße, Carsten

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 20 Jun 2016 08:14:03 +0200

> I would argue that it does not really mean anything.  The fact that Object is basically repeated twice in the expansion is an artifact of trying to get something pronounceable but no something that…

CWS and CWE would not make that much sense *).
(I also don't know why we'd need multiple initialisms for what is
essentially a single format.)

I'm actually very comfortable about the O (Object) in the name, as COSE
can be used for what is widely called Object Security.

> Maybe we should start from scratch and build a new acronym that makes sense and stop using COSE.

It seems most people here are quite happy with the name.
It also has been publicized a bit already.
And the analogism with JOSE is quite useful.

> (By the way, I note that CBOR is not on https://www.rfc-editor.org/materials/abbrev.expansion.txt so you might want to ask the RFC Editor to add it.)

So far there has been no need to do this, as no other RFC (besides RFC
7049, which is defining the abbreviation) has had CBOR in the title yet.
Indeed, this RFC would be the occasion where we make this request.

Grüße, Carsten

*) Yeah, we now could be arguing about CWT, but that is another WG's job :-)

---

From: Justin Richer <[email-masked]>
Date: Mon, 20 Jun 2016 07:47:39 -0400

It’s both, really. I don’t think the other title is descriptive. We need to expand COSE, since we define it, but we don’t need to expand CBOR, since that’s already defined by another RFC. You don’t see other RFC’s expanding HTTP except for the HTTP RFC’s, for example, so your argument below is a bit extreme in making the alternative look absurd. The title should be:

CBOR Object Signing and Encryption (COSE)

or:

COSE: CBOR Object Signing and Encryption

Either style is fine with me. 

You seem to be the only one arguing for the other title, which tells me that there’s not consensus to change the name away from COSE as stated on the working group description page, charter, and everywhere else to date:

https://datatracker.ietf.org/wg/cose/

As such, please use one of the two titles above.

Thank you,
 — Justin

> On Jun 19, 2016, at 6:31 PM, Jim Schaad <[email-masked]> wrote:
>

---

From: Ludwig Seitz <[email-masked]>
Date: Mon, 20 Jun 2016 14:52:50 +0200

On 2016-06-20 13:47, Justin Richer wrote:
> It’s both, really. I don’t think the other title is descriptive. We
> need to expand COSE, since we define it, but we don’t need to expand
> CBOR, since that’s already defined by another RFC. You don’t see
> other RFC’s expanding HTTP except for the HTTP RFC’s, for example, so
> your argument below is a bit extreme in making the alternative look
> absurd. The title should be:
>

I have a slight preference for this one, since it follows the patterns 
of the JOSE specs:

"JSON Web * (JW*)"

and as Justin said in his introductory presentation at IETF 93:

"What would JOSE do?"

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se