Subject: [Teep] Open Trust Protocol & CBOR encoding

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 22 Feb 2017 08:15:46 +0000

Hi all,

Ned Smith (from Intel) privately asked me whether we had considered using a CBOR encoding during the design of the protocol.

I thought it was a good question and so I wanted to share my view about the topic with others on the list.

CBOR clearly has benefits compared to JSON. However, the main use cases focused on the smart phone/tablet environment and JSON is more widely used by developers. I believe this was the reason for re-using JSON and the already mature JOSE security work. When it comes to code availability COSE (the CBOR security work) is far, far behind JOSE. Since the security components require more implementation time I think it is fair to consider them as well.

Ned suggested to separate the information model from the actual encoding to later be able to switch to a different encoding easily. I like that idea and I think we should do that.

What do others think?

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: "方强(强五)" <[email-masked]>
Date: Wed, 22 Feb 2017 17:07:49 +0800

Hi, Hannes and all,

I want to share some ideas about CBOR.

CBOR is very suitable for use in the scenario of IoT area ,  and because
CBOR is based on the wildly successful JSON data model: numbers, strings,
arrays, maps (called objects in JSON), and a few values such as false, true,
and null, implement of  the switch between the Json and Cbor should not be
particularly difficult. We have already started writing a draft in Cbor.

Regards,

Adam 

--

Alibaba

 <mailto:[email-masked]> [email-masked]

发件人: Hannes Tschofenig [mailto:[email-masked]] 
发送时间: 2017年2月22日 16:16
收件人: [email-masked]' <[email-masked]>
主题: [Teep] Open Trust Protocol & CBOR encoding

Hi all, 

Ned Smith (from Intel) privately asked me whether we had considered using a
CBOR encoding during the design of the protocol. 

I thought it was a good question and so I wanted to share my view about the
topic with others on the list. 

CBOR clearly has benefits compared to JSON. However, the main use cases
focused on the smart phone/tablet environment and JSON is more widely used
by developers. I believe this was the reason for re-using JSON and the
already mature JOSE security work. When it comes to code availability COSE
(the CBOR security work) is far, far behind JOSE. Since the security
components require more implementation time I think it is fair to consider
them as well. 

Ned suggested to separate the information model from the actual encoding to
later be able to switch to a different encoding easily. I like that idea and
I think we should do that. 

What do others think? 

Ciao

Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are
confidential and may also be privileged. If you are not the intended
recipient, please notify the sender immediately and do not disclose the
contents to any other person, use it for any purpose, or store or copy the
information in any medium. Thank you.

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 22 Feb 2017 09:16:11 +0000

Thanks for the quick response, Adam.

Is it fair to assume that you are going to submit the draft in time for this IETF draft submission deadline?

Can you say something about the use case you had in mind in the IoT environment? I always tend to make a differentiation between Cortex A class processor and M-class processors. While there are IoT devices out there that use A class processors the majority are, however, using M-class processors due to their lower price tag, and lower energy consumption.

Ciao
Hannes

From: 方强(强五) [mailto:[email-masked]]
Sent: 22 February 2017 10:08
To: Hannes Tschofenig; [email-masked]
Subject: 答复: [Teep] Open Trust Protocol & CBOR encoding

Hi, Hannes and all,

CBOR is very suitable for use in the scenario of IoT area ,  and because  CBOR is based on the wildly successful JSON data model: numbers, strings, arrays, maps (called objects in JSON), and a few values such as false, true, and null, implement of  the switch between the Json and Cbor should not be particularly difficult. We have already started writing a draft in Cbor.

Regards,

Adam
--
Alibaba
[email-masked]<mailto:[email-masked]>

发件人: Hannes Tschofenig [mailto:[email-masked]]
发送时间: 2017年2月22日 16:16
收件人: [email-masked]' <[email-masked]<mailto:[email-masked]>>
主题: [Teep] Open Trust Protocol & CBOR encoding

Hi all,

What do others think?

Ciao
Hannes

---

From: "方强(强五)" <[email-masked]>
Date: Wed, 22 Feb 2017 17:43:48 +0800

Hi, Hannes

For the first question, my answer is: yes, we are going to submit the draft
in time for this IETF draft submission deadline.

For the second question, I would like to share my view below:

Cortex A is usually used in some of better scalability (such as with large
off-line storage) equipment, these devices include: mobile phones, unmanned
aerial vehicles.

The use of Cortex M on embedded devices is very extensive, and these devices
have very limited CPU and memory resources (total memory may only be 1M),
these devices include: Smart bracelet, industrial control devices on the
car, and other smart home devices without screens . In these scenarios, in
order to be able to save resources, the use of binary programs is very
necessary.

Regards,

Adam 

--

Alibaba

 

发件人: Hannes Tschofenig [mailto:[email-masked]] 
发送时间: 2017年2月22日 17:16
收件人: 方强(强五) <[email-masked]>; [email-masked]' <teep@ietf.
org>
主题: RE: [Teep] Open Trust Protocol & CBOR encoding

Is it fair to assume that you are going to submit the draft in time for this
IETF draft submission deadline? 

Can you say something about the use case you had in mind in the IoT
environment? I always tend to make a differentiation between Cortex A class
processor and M-class processors. While there are IoT devices out there that
use A class processors the majority are, however, using M-class processors
due to their lower price tag, and lower energy consumption. 

Ciao
Hannes

From: 方强(强五) [mailto:[email-masked]] 
Sent: 22 February 2017 10:08
To: Hannes Tschofenig; [email-masked] <mailto:[email-masked]> 
Subject: 答复: [Teep] Open Trust Protocol & CBOR encoding

Hi, Hannes and all,

 

Regards,

Adam 

--

Alibaba

 

发件人: Hannes Tschofenig [mailto:[email-masked]] 
发送时间: 2017年2月22日 16:16
收件人: [email-masked]' <[email-masked] <mailto:[email-masked]> >
主题: [Teep] Open Trust Protocol & CBOR encoding

Hi all, 

What do others think? 

Ciao

Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 22 Feb 2017 09:51:17 +0000

Hi Adam,

Thanks for your response.

I suspect you are focusing on the A class devices with CBOR encoding that are using bandwidth constrained connectivity.

Ciao
Hannes

PS: For ARMv6-M/v7-M class devices there is no TrustZone support. Hence, the open trust protocol wouldn’t be particularly useful there and better alternatives exist.

From: 方强(强五) [mailto:[email-masked]]
Sent: 22 February 2017 10:44
To: Hannes Tschofenig; [email-masked]
Subject: 答复: [Teep] Open Trust Protocol & CBOR encoding

Hi, Hannes

For the first question, my answer is: yes, we are going to submit the draft in time for this IETF draft submission deadline.

Cortex A is usually used in some of better scalability (such as with large off-line storage) equipment, these devices include: mobile phones, unmanned aerial vehicles.

The use of Cortex M on embedded devices is very extensive, and these devices have very limited CPU and memory resources (total memory may only be 1M), these devices include: Smart bracelet, industrial control devices on the car, and other smart home devices without screens . In these scenarios, in order to be able to save resources, the use of binary programs is very necessary.

Regards,

Adam

发件人: Hannes Tschofenig [mailto:[email-masked]]
发送时间: 2017年2月22日 17:16
收件人: 方强(强五) <[email-masked]<mailto:[email-masked]>>; [email-masked]' <[email-masked]<mailto:[email-masked]>>
主题: RE: [Teep] Open Trust Protocol & CBOR encoding

Ciao
Hannes

From: 方强(强五) [mailto:[email-masked]]
Sent: 22 February 2017 10:08
To: Hannes Tschofenig; [email-masked]<mailto:[email-masked]>
Subject: 答复: [Teep] Open Trust Protocol & CBOR encoding

Hi, Hannes and all,

Regards,

Adam

Hi all,

What do others think?

Ciao
Hannes

---

From: Nick Cook <[email-masked]>
Date: Wed, 22 Feb 2017 09:55:56 +0000

Hi,

Whilst I agree with having a profile for “compact” formatting, this should not be considered in isolation as it won’t achieve the ultimate goal of having a slimmer profile for OTrP. The contents of some of the OTrP messages require certificate exchange – the format of this needs to be considered also to ensure that the overall profile provides the right level of compactness.

Nick Cook
Chief Innovations Officer
Intercede
Digital trust    people ǀ devices ǀ apps
Office: +44 (0)1455 558 111 ǀ Mobile: +44 (0) 7780 954 442
www.intercede.com<http://www.intercede.com>
Legal Disclaimer <http://www.intercede.com/investors/privacy-policy/>
From: Hannes Tschofenig [mailto:[email-masked]]
Sent: 22 February 2017 09:16
To: '方强(强五)' <[email-masked]>; [email-masked]' <[email-masked]>
Subject: Re: [Teep] Open Trust Protocol & CBOR encoding

Ciao
Hannes

Hi, Hannes and all,

Regards,

Adam

Hi all,

What do others think?

Ciao
Hannes

---

From: Nick Cook <[email-masked]>
Date: Wed, 22 Feb 2017 10:20:27 +0000

Hi,

I agree, these changes should be considered with a view to bandwidth and not endpoint capacity. My previous post about needing to consider what is being transported and not just the wrapper for it is on that same point – the items being transported are much bigger in comparison to the JSON wrapper today in OTrP. We can do something about this and I suggest that this is the focus needed for a revision.

Nick Cook
Sent: 22 February 2017 09:51

Hi Adam,

Ciao
Hannes

Hi, Hannes

Regards,

Adam

Ciao
Hannes

Hi, Hannes and all,

Regards,

Adam

Hi all,

What do others think?

Ciao
Hannes

---

From: "方强(强五)" <[email-masked]>
Date: Wed, 22 Feb 2017 18:44:10 +0800

Hi, Hannes

My view is that the use of Cbor should depend on whether the device
resources are limited. The resources mentioned here include storage
resources and communication bandwidth and so on.

BTW, because ARM V8M class has begun to support TrustZone , whether will
there be a new requirement for updating TA in binary in this area? .

Regards,

Adam 

--

Alibaba

 

发送时间: 2017年2月22日 17:51

Hi Adam, 

I suspect you are focusing on the A class devices with CBOR encoding that
are using bandwidth constrained connectivity. 

Ciao

Hannes

PS: For ARMv6-M/v7-M class devices there is no TrustZone support. Hence, the
open trust protocol wouldn’t be particularly useful there and better
alternatives exist. 

Hi, Hannes

 

Regards,

Adam 

--

Alibaba

 

发件人: Hannes Tschofenig [mailto:[email-masked]] 
发送时间: 2017年2月22日 17:16
收件人: 方强(强五) <[email-masked]
<mailto:[email-masked]> >; [email-masked]' <[email-masked]
<mailto:[email-masked]> >
主题: RE: [Teep] Open Trust Protocol & CBOR encoding

Ciao
Hannes

Hi, Hannes and all,

 

Regards,

Adam 

--

Alibaba

 

Hi all, 

What do others think? 

Ciao

Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 22 Feb 2017 12:30:29 +0000

Hi Adam,

For devices that are connected using WiFi or 3G, like mobile phones and tablets, I don’t see a reason of using CBOR/COSE. The developer convenience provided by JSON/JOSE is a much bigger advantage there. If you are, however, thinking about using some of the low power radio technologies then the story is indeed different.

Regarding TrustZone for v8-M I believe the story is different to TrustZone for A-class devices. I personally believe that solutions, like LwM2M, are more suitable for use with v8-M devices. Here are my reasons:

・       These devices are not expected to run two operating systems, like A-class TrustZone devices would do. In a smart phone you would have, for example, Android running in the normal world and some RTOS running in the secure world. Android has its own concept of software updates and security concept and in the secure world the Open Trust Protocol (or proprietary protocols today) would fulfil the same purpose. There is no reason for a device supporting TrustZone for v8-M to run two separate credential and software update mechanisms. If there is only one then the design can be much simpler, like LwM2M since you do not necessarily need some special application layer protocol.

・       The software for these devices is typically put together by a single company. There are no “apps” downloaded and installed from different sources. The code that runs in the secure world is small and the programmer model is just very different than in A-class devices. As such, there is also no concept of security domains. Needless to say that you then also need to manage those security domains using a protocol like the Open Trust Protocol either.

Of course, this is just my expectation since at this point TrustZone for v8-M only runs in a simulator (for example in the Keil MDK IDE) or on a FPGA. So, there is just not enough experience with it.

Ciao
Hannes

From: 方强(强五) [mailto:[email-masked]]
Sent: 22 February 2017 11:44
To: Hannes Tschofenig; [email-masked]
Subject: 答复: [Teep] Open Trust Protocol & CBOR encoding

Hi, Hannes

My view is that the use of Cbor should depend on whether the device resources are limited. The resources mentioned here include storage resources and communication bandwidth and so on.

BTW, because ARM V8M class has begun to support TrustZone , whether will there be a new requirement for updating TA in binary in this area? .

Regards,

Adam

Hi Adam,

Ciao
Hannes

Hi, Hannes

Regards,

Adam

Ciao
Hannes

Hi, Hannes and all,

Regards,

Adam

Hi all,

What do others think?

Ciao
Hannes