Subject: [core] CoRE @ IETF 109 - Minutes and summary

From: Marco Tiloca <[email-masked]>
Date: Mon, 23 Nov 2020 14:48:19 +0100

Dear all,

The minutes for the two CoRE sessions are available at [1]. Thanks to
the fantastic note takers Christian, Francesca, Michael and Göran!

Please, send possible fixes and updates to [email-masked] or to
the mailing list, preferably within the next 7 days.

The recordings of the two CoRE sessions are now available at [2][3].

Finally, you can find below the usual summary of the two sessions, with
fewer technical details. This summary, together with the raw minutes, is
also available at [4].

Thank you all for your participation and contribution!

Best,
Marco and Jaime

[1] https://datatracker.ietf.org/meeting/109/session/core

[2] https://www.youtube.com/watch?v=aCiY4HS0-IY

[3] https://www.youtube.com/watch?v=A70LOOSrfdg

[4]
https://github.com/core-wg/wg-materials/blob/master/ietf109/core-109-summary.md

----------

# Summary

## WG and document status

* RFC Editor Queue
    * draft-ietf-core-stateless-08

* IESG Processing:
    * draft-ietf-core-resource-directory-26: IESG Evaluation::AD Followup
       
* In Last Call
    * draft-ietf-core-dev-urn-08
    * draft-ietf-core-echo-request-tag-11

* In Post-WGLC processing:
    * draft-ietf-core-comi-10: under shepherd write-up
    * draft-ietf-core-sid-14: under shepherd write-up
    * draft-ietf-core-yang-cbor-13: under shepherd write-up
    * draft-ietf-core-yang-library-02: under shepherd write-up
    * draft-ietf-core-oscore-groupcomm-10: processed WGLC comments; one
new review to process

## Resource Directory

* draft-ietf-core-resource-directory-26

Reviews from the IESG were processed and answered. Three open points
will be addressed in version -27 coming in December, about DTLS replay
protection, trusting links from the RD and ambiguities of Link Format.
One point from Ben Kaduk requires an explicit follow-up.

## Stateless

* draft-ietf-core-stateless-08

The latest version addressed all comments left since May from IESG
review. The remaining DISCUSS ballot was cleared up.

During the IETF week, the document was approved for publication as
Proposed Standard and entered the RFC Queue.

## Groupcomm-bis

* draft-ietf-core-groupcomm-bis-02

The document aims at obsoleting RFC 7390 towards a Standards Track, now
that there is a possible security mode for CoAP group communication.
This version closes issues from earlier reviews.

Next steps include handling of multiple responses from a same server to
a same request, cachability of responses and usage of ETAGs, and
implementation tests.

Pending reviews: Christian and Francesca.

## Group OSCORE

* draft-ietf-core-oscore-groupcomm-10

This version addresses comments from the July WGLC and around IETF 108.
The third round of interop tests occurred during the hackathon, with
three different implementations, covering also the pairwise mode for
message protection.

The main next step is running more tests and addressing a new review
from Christian, covering among other points the need for a better
distinction between anti-replay and freshness requirements. Other points
to cover include optimization and generalization of the external_aad format.

## OSCORE Group Discovery

* draft-tiloca-core-oscore-discovery-07

Method to use the Resource Directory to find links for joining OSCORE
groups at their Group Manager (GM). Full support for Link Format or CoRAL.

Latest updates include an alignment with draft-ietf-ace-oscore-gm-admin
as to the names of the application groups, and considerations on an
application group using multiple security groups.

It was noted that the link relation between a security group and an ACE
Authorization Server is a general thing that may be better handled in
ACE, possibly as a dedicated document.

Next steps include adding parameters about the pairwise mode of Group
OSCORE, alignment with upcoming updates to the Resource Directory
document, more security considerations, and early tests among
implementations.

## Multicast Notifications

* draft-tiloca-core-observe-multicast-notifications-04

Method to send observe notifications to a set of clients observing a
same resource at the server, by using multicast responses. These are
responses to a phantom observation request that the server creates.

Latest updates include encoding of informative response
(transport-dependent and transport-specific information, flexible for
non-UDP transport); improved rough counting of clients; added support
for proxies.

Next steps will focus on improving the examples with proxies, the
negotiation for client supporting this mechanisms or not, making some
content optional, and specifying a possible server acting as its own
OSCORE Group Manager.

The document has its core approach stable for a while now, and there has
been interest for adoption from 12 people.

People to review: Göran and Carsten (since IETF 108), Jaime, Esko and
Thomas.

## Groupcomm proxy

* draft-tiloca-core-groupcomm-proxy-02

Method for proxies to work in a CoAP group communication setting,
addresses the related issues from draft-ietf-core-groupcomm-bis. The
proxy forwards back to the client the individual responses from the
servers, for an amount of time indicated by the client. The client can
distinguish the different servers originating the responses and learn
their addresses. Two new CoAP options are defined. Group OSCORE is
possible between client and servers; any security between client and proxy.

Latest updates include improved semantics and encoding of the two new
CoAP options, and support for a chain of forward proxies.

Next steps will focus on support for HTTP-to-CoAP cross proxies, to
enable HTTP clients to talk to a group of CoAP servers.

Need for reviews; promised at IETF 108 are from Christian, Carsten and
Francesca.

## OSCORE with EDHOC

* draft-palombini-core-oscore-edhoc-01

Different approaches to combine an execution of EDHOC with the first
OSCORE exchange following it. The different approaches can also be
signaled in different ways. The third and final EDHOC message from the
client is merged with the first OSCORE request protected with the
derived security context. This would reduce the overall number of
roundtrips.

Following feedback from IETF 108, this update reduces the candidate
approaches to the one using "EDHOC in OSCORE". The goal is now to select
the exact way for signaling this approach, as either a flag bit in the
OSCORE option or a dedicated new CoAP option (which seems preferred).
Both ways require an IANA registration.

Need for reviews; promised at IETF 108 are from Christian and Carsten.

## SenML Versions

* draft-ietf-core-senml-versions-01

This version includes only minor updates; it needs reviews before WGLC.
There is a working implementation from Ari.

Alexey reviewed preview versions. Need for more reviews before WGLC.

Will review this version: Jaime and Bill.

## SenML Data CT

* draft-ietf-core-senml-data-ct-02

Need to integrate the comments following the WGLC after IETF 108. After
that, plan to request publication.

The document refers to draft-bormann-core-media-content-type-format
(MCTF) , which would preferably be an adopted draft before this document
is sent to the IESG.

It's not clear where MCTF belongs to (out of scope for EMAILCORE, very
generic for CoRE), so it will go through DISPATCH. Alexey offered as
shepherd for MCTF, while Barry can possibly sponsor it as AD.

## New Block

* draft-ietf-core-new-block-02

This update addresses all major points. The WG has decided to call the
approach "Q-Block". Will submit -03 soon with minor additions, then need
for more reviews (also about the usage of OSCORE), then WGLC.

Will review: Christian.

## Dynlink

* draft-ietf-core-dynlink-11

Work is ongoing on new parameters and their usage, also relevant in OMA
LwM2M, i.e. 'pmin', 'pmax', 'edge' and 'con'. Related issues are open on
Github for comments.

It seems reasonable to allow pmin == pmax. It's still open if and how
this should support the presence of proxies, that are not used in LwM2M
but have to be assumed in REST as scope of CoRE.

There will be more discussion at the next series of CoRE interim meetings.

## Fasor

* draft-ietf-core-fasor-01

Presented status and planned next steps; authors see the document as
stable and needing for review, also from tsvarea. After addressing
review comments, WGLC would be a target. Characteristics of the approach
have been emulated but there are no plans for further evaluation.

Will review: Carles Gomez

CoRE chairs will approach tsvarea chairs for more reviews.

## CoAP over GATT

* draft-amsuess-core-coap-over-gatt-01

Presented updates on the exchange of CoAP messages on GATT, a mode of
Bluetooth Low Energy, targeting applications with limited APIs. The goal
is to gather implementation experience and have this as Experimental
"This is how a few people do it" document.

There was consensus that it is good to extend support for CoAP on more
environments/platforms, and that Experimental is the right type of
target at the moment. It was noted that GATT specific new COAP URI
scheme might need detailed examination.

## Rekeying for OSCORE and AEAD limits

* https://mailarchive.ietf.org/arch/msg/core/bbzZCt6ZZn4ysR7yLujPNscBF3g/

Depending on the used encryption algorithm, a safe limit exists in terms
of performed encryptions or failed decryptions using the same key. Once
passed the limit, the key should not be used any longer. This affects
also OSCORE, especially when using CCM_8, and should be considered also
for Group OSCORE.

Some preliminary assessment was presented, and more work is required to
have a better model and better values to take as threshold. It has to be
taken into account that CCM_8 is used today.

The immediate next step is a new draft where the problem is better
documented and analyzed. Building on that, it will be possible to better
understand if OSCORE needs a new lightweight, symmetric-key rekeying
mechanism.

There will be more discussion at the next series of CoRE interim meetings.

-- 
Marco Tiloca
Ph.D., Senior Researcher

RISE Research Institutes of Sweden
Division ICT
Isafjordsgatan 22 / Kistagången 16
SE-164 40 Kista (Sweden)

Phone: +46 (0)70 60 46 501
https://www.ri.se

---

From: Marco Tiloca <[email-masked]>
Date: Sat, 28 Nov 2020 09:22:56 +0100

Dear all,

On 2020-11-23 14:48, Marco Tiloca wrote:
> The recordings of the two CoRE sessions are now available

Due to audio issues in some segments, the recording for the Friday
session has been fixed and re-uploaded on Youtube, and the old flawed
version was deleted.

Please, find the recordings of the two sessions at [Day1][Day2].

Best,
/Marco

[Day1] https://www.youtube.com/watch?v=aCiY4HS0-IY

[Day2] https://www.youtube.com/watch?v=iCWg3hMirOQ

-- 
Marco Tiloca
Ph.D., Senior Researcher