Subject: [core] I-D Action: draft-ietf-core-object-security-13.txt

From: [email-masked]
Date: Wed, 27 Jun 2018 06:16:30 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Constrained RESTful Environments WG of the IETF.

        Title           : Object Security for Constrained RESTful Environments (OSCORE)
        Authors         : Göran Selander
                          John Mattsson
                          Francesca Palombini
                          Ludwig Seitz
	Filename        : draft-ietf-core-object-security-13.txt
	Pages           : 78
	Date            : 2018-06-27

Abstract:
   This document defines Object Security for Constrained RESTful
   Environments (OSCORE), a method for application-layer protection of
   the Constrained Application Protocol (CoAP), using CBOR Object
   Signing and Encryption (COSE).  OSCORE provides end-to-end protection
   between endpoints communicating using CoAP or CoAP-mappable HTTP.
   OSCORE is designed for constrained nodes and networks supporting a
   range of proxy operations, including translation between different
   transport protocols.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-core-object-security/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-core-object-security-13
https://datatracker.ietf.org/doc/html/draft-ietf-core-object-security-13

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-core-object-security-13

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Göran Selander <[email-masked]>
Date: Wed, 27 Jun 2018 13:21:18 +0000

Dear all,

We have submitted a new version of OSCORE. One of the review comments from
IESG was to provide more details of the security properties to simplify
the review. The basic content for this was already in version -12, but in
the process of completing this exercise, we went back to the assumptions
made on the protection of the CoAP options and made some reassessments as
is described below. This work involved the authors, some old and new
implementors. Meanwhile we also received further reviews which were
integrated in this version.

The following changes were made to the options:

* Observe is now additionally Inner, which enables the endpoints to verify
each others intent and simplifies the processing at the cost of making
some of the proxy processing out of scope. This resulted in a change of
Observe processing and we then took the opportunity to split out
option-specific processing which simplified the specification.

* No-Response is now essentially Inner, i.e. protected end-to-end,
resulting from a review from Jim Schaad. The processing is rewritten
accordingly.

* Uri-Host/Port processing is clarified in a separate subsection.

A corresponding change of the analysis of unprotected header fields was
made in appendix D.

We also did the following updates:

* HTTP processing updated based on comments from Martin Thomson.

* CoAP-to-CoAP Forwarding Proxy description is expanded.

* ID Context added to the security context. The message format already
contained the COSE header parameter 'kid context', and this is now
dedicated for transporting the ID Context. Such a parameter was already in
use by Group OSCORE and 6tisch Minimal Security and they can now apply
this in a common way.

* Updated deployment examples and test vectors (appendices B and C)

* Updated references

Best regards,
Göran

On 2018-06-27, 15:16, "core on behalf of [email-masked]"
<[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>core mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/core