Subject: Re: [core] Update to external_aad in OSCORE

From: Francesca Palombini <[email-masked]>
Date: Wed, 13 Mar 2019 08:14:04 +0000

Hi,

To follow up on this: this was considered and finally rejected (issue here: https://github.com/core-wg/oscoap/issues/253 ), primarily because we do not have a reason to motivate including the ID Context in the external aad in unicast.

The discussion is still going on about group communication.

Thanks,
Francesca

From: Francesca Palombini <[email-masked]>
Date: Thursday, 31 January 2019 at 15:01
To: "[email-masked]" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Update to external_aad in OSCORE
Resent-From: <[email-masked]>
Resent-To: Göran Selander <[email-masked]>, John Mattsson <[email-masked]>, Francesca Palombini <[email-masked]>, Ludwig Seitz <[email-masked]>
Resent-Date: Thursday, 31 January 2019 at 15:00

Hi,

After receiving some review comments from Jim about Group OSCORE ( https://mailarchive.ietf.org/arch/msg/core/kx3ePNG3RbxtoFC9pZnYKggccew ), and following off-list discussion, we have a proposal to update the external_aad in OSCORE to add the ID Context.

More precisely, the external_aad would be modified from:

external_aad = bstr .cbor aad_array

aad_array = [
  oscore_version : uint,
  algorithms : [ alg_aead : int / tstr ],
  request_kid : bstr,
  request_piv : bstr,
  options : bstr,
]

to:

external_aad = bstr .cbor aad_array

aad_array = [

  oscore_version : uint,

  algorithms : [ alg_aead : int / tstr ],

  request_kid : bstr,

  request_piv : bstr,

  kid_context : bstr / nil,

  options : bstr,

]
where the kid_context is the ID Context (or nil if not present).

We have not identified any issues with ID Context not being part of the external_aad in OSCORE (unicast), as it is linked to the keying material via the security context key derivation. However, the same external_aad structure is used both in unicast and group settings, both for AEAD and for signing. As it could be helpful to have ID Context in the external_aad for the signature, we propose to do this change in unicast OSCORE to keep OSCORE and group OSCORE aligned.

This change means that the ID Context (which in Group OSCORE contains the group identifier) would be integrity protected (and signed in group OSCORE) in each message, rather than just part of the key derivation.

This change does not add any overhead to the message as external_aad is not sent, and is a very little modification implementation-wise. The biggest consequence would be draft-wise to re-create and update the test vectors in appendix C.

We have had discussions with some implementers, and they don’t see an issue with this change. If anybody sees a problem with it, please let us know.

Thanks,
Francesca