Subject: [core] OSCORE: Status Update on the C Implementation of an OSCORE Server

From: Jaro Fietz <[email-masked]>
Date: Thu, 13 Dec 2018 15:40:12 +0100

Hey everyone,

after I've received several follow-up mails about my minimal C 
implementation of an OSCORE server on top of the embedded OS Zephyr, 
I've decided to give everyone an update on my progress. I've implemented 
a subset of the OSCORE Draft Version 14 in C, leaving out most optional 
features. My implementation provides a minimal working OSCORE server for 
an embedded board (in my case the 96 Boards BLE Nitrogen). It is based 
on Zephyr as the underlying embedded operating system but should be 
easily adaptable to other needs.

The implementation is now finished feature wise. Key derivation was 
tested against the Appendix C.1.2 testcase from the specification [1]. 
Additionally, the server successfully responds to the OSCORE Test_1a [1] 
(executed with aiocoap's plugtest script). I haven't performed other 
tests, but this should be good enough to exchange simple encrypted messages.

I'm currently in the works of open sourcing the project. I expect the 
source code to be published on github mid to late January. I hope that 
this will be quick enough for RIOT. I'll write to the ML once the source 
code is available (or only to individual people in case this information 
isn't relevant to the ML).

BR,
Jaro

[1]: 
https://tools.ietf.org/html/draft-ietf-core-object-security-14#appendix-C.1.2
[2]: https://ericssonresearch.github.io/OSCOAP/test-spec5.html#test-1a

On 11/26/18 3:18 PM, Göran Selander wrote:
> Hi Jaro,
>
> Thanks for the update!
>
> I understand you can't promise anything here. The question I got was for a C-implementation which was not tailored for a particular constrained platform OS, like what exists for Contiki NG and Open WSN. For your information, the people I talked to at RIOT wants to start after the new year holidays, so anything available around that time would be very welcome.
>
> Thanks,
> Göran
>
>
> On 2018-11-26, 14:39, "Jaro Fietz" <[email-masked]> wrote:
>
>      Hello Göran,
>      
>      we are planning on open-sourcing the C implementation, I'm in the works
>      of filling in the paperwork. Currently I'm in the bugfixing stage, so
>      the code isn't functional quite yet. Once I have a minimal working
>      example and we have the go-ahead for open-sourcing it, I'll let you
>      know. I hope that it'll happen within the next month, but can't
>      guarantee anything.
>      
>      BR,
>      Jaro
>      
>      On 11/23/18 4:04 PM, Göran Selander wrote:
>      > Hello Jaro,
>      >
>      > I'm curious about the continued story of one of the questions from Christian, below.
>      >
>      > On 2018-10-11, 14:42, "core on behalf of Jaro Fietz" <[email-masked] on behalf of [email-masked]> wrote:
>      >
>      >      Hello Christian,
>      >
>      >      thanks for your quick answer, it clarified the second of my questions.
>      >
>      >      On 10/11/18 1:09 PM, Christian Amsüss wrote:
>      >      > The expectation is that the shortest (zero-length) ID would be used in
>      >      > cases wherever that's beneficial, eg. when a constrained device
>      >      > primarily utilizes one context in which it is addressed as a server.
>      >      This is an interesting optimization. I'm not too sure about the actual
>      >      benefits though. To me this would only result in the constrained nodes
>      >      being able to shave off a few bytes of allocation when constructing the
>      >      response and saving their sender_id to persistent storage.
>      >      > You briefly had me worried I got it wrong myself -- but the
>      >      > left-trimming that's happenign is on the sequence numbers, not on the
>      >      > sender IDs.
>      >      Sorry, I must have skipped incorrectly over the tuple construction.
>      >      Reading through it again, your code is, of course, correct :)
>      >      > Slightly off topic: Would that happen to be a freely licensed
>      >      > implementation? If so, I know of an embedded operating system project
>      >      > that would love to hear about this.
>      >      I'm implementing OSCORE on top of zephyr (not integrated into it) for an
>      >      embedded board. Currently it isn't open source, but I asked my advisor,
>      >      who'll forward the request to the supervisor.
>      >      Judging from your github history I expect you ask for RIOT-OS? :)
>      >
>      > Have you decided about open source? I also got question from people working RIOT-OS __
>      >
>      > BR
>      > Göran
>      >
>      >
>      >
>      >
>      
>      
>

---

From: Göran Selander <[email-masked]>
Date: Fri, 14 Dec 2018 10:33:39 +0000

Hello Jaro,

Great news, thanks for sharing this! Please keep us updated on the progress.

Best regards,
Göran

On 2018-12-13, 15:42, "Jaro Fietz" <[email-masked]> wrote:

    Hey everyone,

    
    
    BR,
    Jaro
    
    [1]: