Subject: [netconf] what to call different RFC8366 format artifacts

From: Michael Richardson <[email-masked]>
Date: Tue, 03 Nov 2020 12:05:35 -0500

Hi, RF8366 specifies a YANG module for a voucher, and the format as
serialized to JSON, and signed by CMS.

In section 5.4, it is written:

 5.4.  CMS Format Voucher Artifact
    The IETF evolution of PKCS#7 is CMS [RFC5652].  A **CMS-signed voucher**,

In section 8.3, it is written:
   Encoding considerations:  *CMS-signed JSON* vouchers are ASN.1/DER
      encoded.

So it became natural for me to write "CMS-signed-JSON".
In development of RFC8366, we argued for using JOSE rather than CMS, but
there were, at the time (2016) lack of familiarity with JOSE, and concerns
about having FIPS-140 validation of that code.

In draft-ietf-anima-constrained-voucher, we introduce two new things:
  1) signing with COSE
  2) encoding with CBOR.

A number of people have written, rather than "CMS-signed-JSON", instead,
"JSON in CMS".   I wondered at the BRSKI design team call last Thursday if
perhaps that order of words translates better into Dutch or German, or ???

So to bikeshed the whole thing, please comment on preference in naming:

1) RFC8366:    CMS-signed-JSON  vs JSON-in-CMS.
2) CV:         CMS-signed-CBOR  vs CBOR-in-CMS.
3) CV:         COSE-signed-CBOR vs CBOR-in-COSE.
4) future ID:  JWS-signed-JSON  vs JSON-in-JOSE.

I note that for some of these "signed" is redundant.
We do not have COSE-signed-JSON, or JWS-signed-CBOR.

Which feels more natural to you?

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 3 Nov 2020 21:23:55 +0100

> Which feels more natural to you?

For me, all the $foo-signed-$bar expansions make sense and they stress
the signature aspect:

CMS-signed-JSON  = Cryptographic Message Syntax signed
                   JavaScript Object Notation
CMS-signed-CBOR  = Cryptographic Message Syntax signed
                   Concise Binary Object Representation
COSE-signed-CBOR = CBOR Object Signing and Encryption signed
                   Concise Binary Object Representation
JWS-signed-JSON  = JSON Web Signature signed
                   JavaScript Object Notation

The $foo-in-$bar alternative somehow stresses containment but I assume
the primary reason for using CMS / COSE / JWS is for signatures, not
for containment.

/js (German, in case that matters.)

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 6 Nov 2020 17:05:58 +0100

I like FOO-signed-BAR better because it reminds readers whose life does
not enter around FOO or BAR what this is about (signed object).

Maybe some time there are different options how FOO can sign BAR,
then we may need to add additional distinctions

> _______________________________________________
> Anima mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima

-- 
---
[email-masked]