Subject: [Teep] Call for adoption of draft-thaler-teep-otrp-over-http

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Mon, 27 May 2019 23:11:29 +0000

Hi,
At the IETF 104 TEEP session, we discussed the need to transport the OTrP messages and Dave has drafted a document to specify HTTPs as a transport.
This begins a 2 week period to determine interest in adopting this draft as a working group item.  The poll will close on June 10th EOD PDT.

The draft is:
https://datatracker.ietf.org/doc/draft-thaler-teep-otrp-over-http/

Minutes from IETF 104:
https://datatracker.ietf.org/doc/minutes-104-rats/

Warm regards,
                Nancy

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 28 May 2019 07:41:52 +0200

Hi Nancy & Co,
I have a couple of related questions.

The IoT market has adopted CBOR rather than JSON.  Is the plan to later revive something along the lines of:
https://www.ietf.org/archive/id/draft-liu-opentrustprotocol-cbor-00.txt ?

OTrP over HTTP for the client-centric (constrained devices, mobile phones) world and the "Cloud" are considered identical. I don't fully understand how that is intended to work:
https://github.com/ietf-teep/OTrP/issues/14
Maybe I'm simply missing some vital information?

Best regards,
Anders

On 2019-05-28 01:11, Nancy Cam-Winget (ncamwing) wrote:
> _______________________________________________
> TEEP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/teep
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 28 May 2019 11:45:16 +0000

Hi Anders,

We talked about the use of CBOR for OTrP in the past and I believe it would be a useful addition to cover some IoT segments.
However, we have so far been busy working on the architecture and therefore had not time to work on these details.

I am not sure I understand the second part of your question.

Ciao
Hannes

-----Original Message-----
From: TEEP <[email-masked]> On Behalf Of Anders Rundgren
Sent: Dienstag, 28. Mai 2019 07:42
To: Nancy Cam-Winget (ncamwing) <[email-masked]>; [email-masked]
Subject: Re: [Teep] Call for adoption of draft-thaler-teep-otrp-over-http

Hi Nancy & Co,

Best regards,
Anders

_______________________________________________
TEEP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/teep
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Dave Thaler <[email-masked]>
Date: Tue, 28 May 2019 18:47:55 +0000

Inline below.

-----Original Message-----
From: TEEP <[email-masked]> On Behalf Of Anders Rundgren
Sent: Monday, May 27, 2019 10:42 PM
To: Nancy Cam-Winget (ncamwing) <[email-masked]>; [email-masked]
Subject: Re: [Teep] Call for adoption of draft-thaler-teep-otrp-over-http

Hi Nancy & Co,

The IoT market has adopted CBOR rather than JSON.

That’s a bit overstated, “IoT” is very broad and hence there are _many_ IoT “markets”, and many of them have not adopted CBOR.

For example, if you look in industrial IoT, the dominant protocol is OPC UA, which uses neither CBOR nor JSON.
In consumer IoT like in devices on shelves now, I think you will find that JSON is far more deployed than CBOR is (e.g., Hue light bulbs and many other IoT devices use JSON-over-HTTP).

It is true that some of the IoT market has adopted CBOR.  For example, OCF adopted CBOR, but OCF has very little actual deployment today.

Is the plan to later revive something along the lines of: https://www.ietf.org/archive/id/draft-liu-opentrustprotocol-cbor-00.txt ?

That is still possible, yes.   It’s orthogonal to the question of the transport though which is the subject of this thread.

Issue 14 still requires discussion from the WG.  I do not have a strong opinion on the matter, but if there are multiple implementations that would want to deploy and interop in the way you suggest, then the WG should definitely look at it.   I’m waiting to hear whether there’s interest from the rest of the WG.   In my view, this shouldn’t hold up adoption of the draft, but would be an important conversation to close on before it’s done.

Dave (as transport spec editor)

Best regards,

Anders

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-thaler-teep-otrp-over-http%2F&amp;data=02%7C01%7Cdthaler%40microsoft.com%7Ca645898291624863026c08d6e32f38d5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636946189285648486&amp;sdata=r0oaeFJbI0xWwA4T%2Fr8W9ha0Xw23mpY9VC%2BNYBRZqMc%3D&amp;reserved=0

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fminutes-104-rats%2F&amp;data=02%7C01%7Cdthaler%40microsoft.com%7Ca645898291624863026c08d6e32f38d5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636946189285648486&amp;sdata=YTvPq7M725hzurUxNA0XLrwUCVf1jhR08d2ozGBvDbo%3D&amp;reserved=0

> [email-masked]<mailto:[email-masked]>

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep&amp;data=02%7C01%7Cdthaler%40microsoft.com%7Ca645898291624863026c08d6e32f38d5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636946189285648486&amp;sdata=kHfSSP9YBRHgUO15QvMKGRGcD5mXt0ol73hMfvtnyU4%3D&amp;reserved=0

TEEP mailing list

[email-masked]<mailto:[email-masked]>

https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep&amp;data=02%7C01%7Cdthaler%40microsoft.com%7Ca645898291624863026c08d6e32f38d5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636946189285648486&amp;sdata=kHfSSP9YBRHgUO15QvMKGRGcD5mXt0ol73hMfvtnyU4%3D&amp;reserved=0

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 28 May 2019 21:06:11 +0200

> Hi Anders,

Hi Hannes,

> However, we have so far been busy working on the architecture and therefore had not time to work on these details.

As an independent developer who [fortunately...] do not have existing deployments or GlobalPlatform compatibility to worry about, I see three alternatives:
- Status quo: Duplication like in the current EAT spec. (which from a pure engineering point of view doesn't feel overly cool).
- Moderate revision: Using CBOR as the common denominator since any system can deal with CBOR.
- Major revision: Decoupling OTrP formats from TEEP through an enhanced architecture as outlined on GitHub.

> I am not sure I understand the second part of your question.

I imagined that a common "Cloud" use-case would be *upload* of customer-written TAs using the traditional client-server/request-response model which doesn't seem to be covered by the current draft.

Note: I only want to get the options on the table and leave adoption decisions to others :-)

Cheers,
Anders

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 29 May 2019 14:34:30 +0000

*   The IoT market has adopted CBOR rather than JSON.

  *   That’s a bit overstated, “IoT” is very broad and hence there are _many_ IoT “markets”, and many of them have not adopted CBOR. For example, if you look in industrial IoT, the dominant protocol is OPC UA, which uses neither CBOR nor JSON. In consumer IoT like in devices on shelves now, I think you will find that JSON is far more deployed than CBOR is (e.g., Hue light bulbs and many other IoT devices use JSON-over-HTTP). It is true that some of the IoT market has adopted CBOR.  For example, OCF adopted CBOR, but OCF has very little actual deployment today.

I agree with Dave here. I think it is fair to say that the JWT has been implement and deployed by the Web community. Particularly in the OAuth context it is widely deployed.

CBOR has been suggested for IoT-related specifications but CBOR, COSE and CWT is definitely not widely implement and even less widely used.

The question I wonder is whether the current deployment status matters in our case and I don’t think it has any relationship to the call for adoption of draft-thaler-teep-otrp-over-http.

When the initial version of OTrP was written there was the assumption that the encoding of the protocol in JSON would be more convenient for Web developers given that the main deployment use case was for mobile phones and tablets.

Now, there is of course the question whether Web developers should be exposed to the details and the encoding of the OTrP protocol itself. I think that’s an important question. Afterall, we are trying to make the life of developers simpler with this work.

Since the formation of the TEEP group we have also added other use cases extending our original goals for OTrP. This makes me believe that it is worthwhile to look into a CBOR-based encoding as well. I also would like to take advance of ongoing working work in SUIT & RATS.

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 29 May 2019 14:35:34 +0000

I support the adoption of this document. I believe it is a good starting point for work on an HTTP-based transport in the TEEP working group.

From: TEEP <[email-masked]> On Behalf Of Nancy Cam-Winget (ncamwing)
Sent: Dienstag, 28. Mai 2019 01:11
To: [email-masked]
Subject: [Teep] Call for adoption of draft-thaler-teep-otrp-over-http

Hi,

The draft is:

Minutes from IETF 104:

Warm regards,
                Nancy

---

From: "Wheeler, David M" <[email-masked]>
Date: Wed, 29 May 2019 14:43:10 +0000

I am more in favor of a CBOR/CWT binding than JSON, although I agree that JSON and JWT is more commonly deployed at the moment.
The direction I think we should push this is toward CBOR. However, I think that it is fine to build JSON into the OTrP protocol spec and then have an alternative specification that provides CBOR bindings – I would be willing to work with Anders on a such a specification (after the arch document is complete 😉 ).

Thanks,
Dave Wheeler

From: TEEP <[email-masked]> On Behalf Of Hannes Tschofenig
Sent: Wednesday, May 29, 2019 7:35 AM
To: Dave Thaler <dthaler=[email-masked]>; Anders Rundgren <[email-masked]>; Nancy Cam-Winget (ncamwing) <[email-masked]>; [email-masked]
Subject: Re: [Teep] Call for adoption of draft-thaler-teep-otrp-over-http

Ciao
Hannes

---

From: "Wheeler, David M" <[email-masked]>
Date: Wed, 29 May 2019 14:43:26 +0000

I also support the adoption of this document.

From: TEEP <[email-masked]> On Behalf Of Hannes Tschofenig
Sent: Wednesday, May 29, 2019 7:36 AM
To: Nancy Cam-Winget (ncamwing) <[email-masked]>; [email-masked]
Subject: Re: [Teep] Call for adoption of draft-thaler-teep-otrp-over-http

From: TEEP <[email-masked]<mailto:[email-masked]>> On Behalf Of Nancy Cam-Winget (ncamwing)
Sent: Dienstag, 28. Mai 2019 01:11
To: [email-masked]<mailto:[email-masked]>
Subject: [Teep] Call for adoption of draft-thaler-teep-otrp-over-http

Hi,

The draft is:

Minutes from IETF 104:

Warm regards,
                Nancy

---

From: "faibish, sorin" <[email-masked]>
Date: Wed, 29 May 2019 14:59:28 +0000

Based on our IoT customer base we currently know that JSON is the only one used today. That said I agree with Hannes that we should consider CBOR as well but I think we can adopt the draft as it is and maybe later add CBOR support. I am looking mainly at the industrial markets we serve many use JSON but I am looking from the storage users perspective so I cannot attest that they don’t use neither. In summary I will adopt the draft as it is. Thanks

./Sorin

From: TEEP <[email-masked]> On Behalf Of Hannes Tschofenig
Sent: Wednesday, May 29, 2019 10:35 AM
To: Dave Thaler; Anders Rundgren; Nancy Cam-Winget (ncamwing); [email-masked]
Subject: Re: [Teep] Call for adoption of draft-thaler-teep-otrp-over-http

[EXTERNAL EMAIL]

Ciao
Hannes

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 29 May 2019 20:39:29 +0200

Hi David,
Since you mention the unfinished architecture document, have you seen https://github.com/ietf-teep/architecture/issues/52#issuecomment-493652265 ?

This is about creating a *unified* (JSON/CBOR independent) TEE management API.

Ten years ago I had something similar to OTrP but felt it was becoming "clunky" and limiting, so I threw it out and haven't regretted it a second.
The switch wasn't that difficult after getting the core mechanics in place.
Much later when I was forced switching protocol format from XML to JSON, *not a single bit* changed in the API.

Regards,
Anders

On 2019-05-29 16:43, Wheeler, David M wrote:
> *From:* TEEP <[email-masked]> *On Behalf Of *Hannes Tschofenig
> *Sent:* Wednesday, May 29, 2019 7:35 AM
> *To:* Dave Thaler <dthaler=[email-masked]>; Anders Rundgren <[email-masked]>; Nancy Cam-Winget (ncamwing) <[email-masked]>; [email-masked]
> *Subject:* Re: [Teep] Call for adoption of draft-thaler-teep-otrp-over-http
> 
>   * That’s a bit overstated, “IoT” is very broad and hence there are _/many/_ IoT “markets”, and many of them have not adopted CBOR. For example, if you look in industrial IoT, the dominant protocol is OPC UA, which uses neither CBOR nor JSON. In consumer IoT like in devices on shelves now, I think you will find that JSON is far more deployed than CBOR is (e.g., Hue light bulbs and many other IoT devices use JSON-over-HTTP). It is true that /some/ of the IoT market has adopted CBOR.  For example, OCF adopted CBOR, but OCF has very little actual deployment today.
>