Subject: [core] COSE requirements from CORE/ACE

From: Göran Selander <[email-masked]>
Date: Mon, 31 Aug 2015 10:50:46 +0000

Dear CORE and ACE members,

In the COSE WG meeting in Prague one of the topics was requirements from a
constrained node network point of view on message format, crypto suites
etc. Some issues were discussed in the meeting and some in smaller groups
after the meeting. It would be good to collect the views of what people
think are important requirements for COSE to consider. I list a few issues
here, feel free to add (and enumerate) others in this thread.

1. Message size. 

There is a trade-off between making the message format applicable to many
settings and optimizing it for certain settings. Do you know of an
important application or setting with specific requirements on upper limit
of message size? One relevant parameter is if the application requires
signed messages (asymmetric key) or if MACs (symmetric key) is sufficient,
since the signature is much larger than the MAC.

One figure mentioned in the meeting was 90 bytes UDP payload in a 6tisch
setting which may need signed messages.

2. MAC-only?

Do you know of an important application or setting which require that
messages are only protected by a message authentication code, i.e. where
the message must be in plain text and integrity protected using a
symmetric key algorithm?

Clearly there are applications where encryption and message authentication
based on symmetric algorithms (authenticated encryption) is needed. The
question is what is gained by allowing MAC-only algorithms, since in order
to verify the message you anyway need the symmetric key.

3. Symmetric encryption + digital signature.

For closed subscriber groups, where the data must be encrypted and where
each subscriber must be able to verify that the message originates from
the publisher, there is a need to combine symmetric encryption with
digital signature.  This can be done by first symmetric encryption and
then digital signature, or first digital signature and then symmetric
encryption. Do you know of an important application or setting that
require a certain order of the operations?

One example is where the pub-sub broker should be able to verify the
signature of the message without disclosing the plain text publication.

Thanks,
Göran

---

From: "Cuellar, Jorge" <[email-masked]>
Date: Mon, 31 Aug 2015 11:08:49 +0000

Dear Göran and all,

> 2. MAC-only?
> Do you know of an important application or setting which require
> that messages are only protected by a message authentication code...

Indeed, there are some.  For instance, some use cases in Smart Cities (buses scheduling/delays information, some aspects of environmental monitoring, garbage collection management, etc) do not require confidentiality but integrity.  As today is the case, the general user may be unable to verify the integrity of the information, but the "main recipient" (say, the city council) can verify it.

Best,
Jorge

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Göran Selander
Sent: 31 August 2015 12:51
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: [Ace] COSE requirements from CORE/ACE

In the COSE WG meeting in Prague one of the topics was requirements from a constrained node network point of view on message format, crypto suites etc. Some issues were discussed in the meeting and some in smaller groups after the meeting. It would be good to collect the views of what people think are important requirements for COSE to consider. I list a few issues here, feel free to add (and enumerate) others in this thread.

1. Message size. 

There is a trade-off between making the message format applicable to many settings and optimizing it for certain settings. Do you know of an important application or setting with specific requirements on upper limit of message size? One relevant parameter is if the application requires signed messages (asymmetric key) or if MACs (symmetric key) is sufficient, since the signature is much larger than the MAC.

One figure mentioned in the meeting was 90 bytes UDP payload in a 6tisch setting which may need signed messages.

2. MAC-only?

Do you know of an important application or setting which require that messages are only protected by a message authentication code, i.e. where the message must be in plain text and integrity protected using a symmetric key algorithm?

Clearly there are applications where encryption and message authentication based on symmetric algorithms (authenticated encryption) is needed. The question is what is gained by allowing MAC-only algorithms, since in order to verify the message you anyway need the symmetric key.

For closed subscriber groups, where the data must be encrypted and where each subscriber must be able to verify that the message originates from the publisher, there is a need to combine symmetric encryption with digital signature.  This can be done by first symmetric encryption and then digital signature, or first digital signature and then symmetric encryption. Do you know of an important application or setting that require a certain order of the operations?

One example is where the pub-sub broker should be able to verify the signature of the message without disclosing the plain text publication.

Thanks,
Göran

_______________________________________________
Ace mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ace

---

From: Göran Selander <[email-masked]>
Date: Mon, 31 Aug 2015 12:22:54 +0000

Dear Jorge,

Thanks for quick reply.

One question we got in this context was, if there is a "main recipient" as
you call it, why should anyone else be able to read it? E.g. consider IAB
statement on confidentiality.

And if there are cases where an intermediary that should be able to read
in order to perform an action based on that information, should not that
entity also be able to verify the data before performing the action?

If the intermediary need to verify the data, then either

A) it is trusted with not altering the value and could have access to the
symmetric key. But then the data could just as well also have been
encrypted, or 

B) it is not trusted with altering the value, and then that would require
asymmetric keys (i.e. signature), which is not the case we are considering
here.

Clearly we need to support signature-only, but do we really need MAC-only?

Regards,
Göran

On 2015-08-31 13:08, "Cuellar, Jorge" <[email-masked]> wrote:

>Indeed, there are some.  For instance, some use cases in Smart Cities
>(buses scheduling/delays information, some aspects of environmental
>monitoring, garbage collection management, etc) do not require
>confidentiality but integrity.  As today is the case, the general user
>may be unable to verify the integrity of the information, but the "main
>recipient" (say, the city council) can verify it.
>
>Best,
>Jorge
>
>In the COSE WG meeting in Prague one of the topics was requirements from
>a constrained node network point of view on message format, crypto suites
>think are important requirements for COSE to consider. I list a few
>issues here, feel free to add (and enumerate) others in this thread.
>
>1. Message size. 
>
>important application or setting with specific requirements on upper
>limit of message size? One relevant parameter is if the application
>requires signed messages (asymmetric key) or if MACs (symmetric key) is
>sufficient, since the signature is much larger than the MAC.
>
>Clearly there are applications where encryption and message
>authentication based on symmetric algorithms (authenticated encryption)
>is needed. The question is what is gained by allowing MAC-only
>algorithms, since in order to verify the message you anyway need the
>symmetric key.
>
>