The Object Security for Constrained RESTful Environments (OSCORE) Profile of the Authentication and Authorization for Constrained Environments (ACE) Framework
draft-ietf-ace-oscore-profile-19
Revision differences
Document history
Date | Rev. | By | Action |
---|---|---|---|
2022-05-18
|
19 | (System) | RFC Editor state changed to AUTH48-DONE from AUTH48 |
2022-05-05
|
19 | (System) | RFC Editor state changed to AUTH48 from AUTH48-DONE |
2022-04-28
|
19 | (System) | RFC Editor state changed to AUTH48-DONE from AUTH48 |
2022-03-01
|
19 | (System) | RFC Editor state changed to AUTH48 |
2021-11-29
|
19 | (System) | RFC Editor state changed to RFC-EDITOR from REF |
2021-09-28
|
19 | (System) | RFC Editor state changed to REF from IANA |
2021-09-15
|
19 | (System) | IANA Action state changed to RFC-Ed-Ack from Waiting on RFC Editor |
2021-09-15
|
19 | (System) | IANA Action state changed to Waiting on RFC Editor from In Progress |
2021-09-15
|
19 | (System) | IANA Action state changed to In Progress from Waiting on Authors |
2021-09-14
|
19 | (System) | IANA Action state changed to Waiting on Authors from In Progress |
2021-09-13
|
19 | (System) | IANA Action state changed to In Progress from Waiting on Authors |
2021-09-07
|
19 | (System) | IANA Action state changed to Waiting on Authors from In Progress |
2021-09-03
|
19 | (System) | RFC Editor state changed to IANA from EDIT |
2021-09-02
|
19 | (System) | IANA Action state changed to In Progress from Waiting on Authors |
2021-09-01
|
19 | (System) | IANA Action state changed to Waiting on Authors from In Progress |
2021-09-01
|
19 | (System) | IANA Action state changed to In Progress from On Hold |
2021-08-13
|
19 | (System) | IANA Action state changed to On Hold from In Progress |
2021-08-13
|
19 | (System) | IANA Action state changed to In Progress from Waiting on Authors |
2021-08-12
|
19 | (System) | IANA Action state changed to Waiting on Authors from In Progress |
2021-08-12
|
19 | (System) | IANA Action state changed to In Progress from Waiting on Authors |
2021-08-11
|
19 | (System) | IANA Action state changed to Waiting on Authors from In Progress |
2021-08-11
|
19 | (System) | IANA Action state changed to In Progress from On Hold |
2021-07-27
|
19 | (System) | IANA Action state changed to On Hold from In Progress |
2021-07-26
|
19 | (System) | RFC Editor state changed to EDIT |
2021-07-26
|
19 | (System) | IESG state changed to RFC Ed Queue from Approved-announcement sent |
2021-07-26
|
19 | (System) | Announcement was received by RFC Editor |
2021-07-23
|
19 | (System) | IANA Action state changed to In Progress |
2021-07-23
|
19 | Amy Vezza | IESG state changed to Approved-announcement sent from Approved-announcement to be sent |
2021-07-23
|
19 | Amy Vezza | IESG has approved the document |
2021-07-23
|
19 | Amy Vezza | Closed "Approve" ballot |
2021-07-23
|
19 | Amy Vezza | Ballot approval text was generated |
2021-07-23
|
19 | (System) | Removed all action holders (IESG state changed) |
2021-07-23
|
19 | Benjamin Kaduk | IESG state changed to Approved-announcement to be sent from IESG Evaluation::AD Followup |
2021-07-23
|
19 | Benjamin Kaduk | RFC Editor Note was changed |
2021-07-23
|
19 | Benjamin Kaduk | RFC Editor Note for ballot was generated |
2021-07-23
|
19 | Benjamin Kaduk | RFC Editor Note for ballot was generated |
2021-05-12
|
19 | Roman Danyliw | [Ballot comment] Thank you to Kathleen Moriarty for the SECDIR review. Thanks you for addressing my DISCUSS and COMMENT feedback. |
2021-05-12
|
19 | Roman Danyliw | [Ballot Position Update] Position for Roman Danyliw has been changed to No Objection from Discuss |
2021-05-06
|
19 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-19.txt |
2021-05-06
|
19 | (System) | New version accepted (logged-in submitter: Francesca Palombini) |
2021-05-06
|
19 | Francesca Palombini | Uploaded new revision |
2021-04-14
|
18 | (System) | Sub state has been changed to AD Followup from Revised ID Needed |
2021-04-14
|
18 | (System) | IANA Review state changed to Version Changed - Review Needed from IANA OK - Actions Needed |
2021-04-14
|
18 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-18.txt |
2021-04-14
|
18 | (System) | New version accepted (logged-in submitter: Francesca Palombini) |
2021-04-14
|
18 | Francesca Palombini | Uploaded new revision |
2021-04-08
|
17 | Amanda Baber | IANA Review state changed to IANA OK - Actions Needed from IANA - Not OK |
2021-04-08
|
17 | Amanda Baber | Reviews OK. |
2021-04-08
|
17 | Amanda Baber | IANA Experts State changed to Expert Reviews OK from Reviews assigned |
2021-04-06
|
17 | Amanda Baber | JWT and CWT Confirmation Methods approved. Sent question to OAuth Parameters expert. |
2021-03-25
|
17 | (System) | Changed action holders to Ludwig Seitz, Benjamin Kaduk, Göran Selander, Francesca Palombini, Martin Gunnarsson (IESG state changed) |
2021-03-25
|
17 | Cindy Morgan | IESG state changed to IESG Evaluation::Revised I-D Needed from IESG Evaluation |
2021-03-25
|
17 | Robert Wilton | [Ballot Position Update] New position, No Objection, has been recorded for Robert Wilton |
2021-03-25
|
17 | Lars Eggert | [Ballot comment] All comments below are very minor change suggestions that you may choose to incorporate in some way (or ignore), as you see fit. … [Ballot comment] All comments below are very minor change suggestions that you may choose to incorporate in some way (or ignore), as you see fit. There is no need to let me know what you did with these suggestions. Paragraph 1, nit: Elwyn Davies' Gen-ART review (https://mailarchive.ietf.org/arch/msg/gen-art/Es7PhQvSnCixYRfEYs0RLqcLYC0/) contains a nits that I wanted to make sure you were aware of. Section 3.2, paragraph 14, nit: - the 'cnf' parameeter of the access token response. If included, the - - + the 'cnf' parameter of the access token response. If included, the |
2021-03-25
|
17 | Lars Eggert | [Ballot Position Update] New position, No Objection, has been recorded for Lars Eggert |
2021-03-25
|
17 | Martin Vigoureux | [Ballot Position Update] New position, No Objection, has been recorded for Martin Vigoureux |
2021-03-24
|
17 | Murray Kucherawy | [Ballot comment] I tried, but failed, to come up with a reason to DISCUSS this document just to troll my new co-AD. As in one … [Ballot comment] I tried, but failed, to come up with a reason to DISCUSS this document just to troll my new co-AD. As in one of the other ACE documents, the variable use of apostrophes and quotes created mental dissonance. Here, though, it's not just in the JSON-like examples, but even in the prose. It's consistent until about Section 4, and then it begins to change. The second-last paragraph of Section 4.2 even uses both. Within Section 1.1, the text describes the draft variably as "this document", "this specification", "the document", and "this memo". That's weird. And "memo" appears again in Acknowledgements. In Section 6, you might want to clarify that the context is discarded when any of the things in that list occur. Or is it only when all of them occur? In Section 7, is "provisionings" a word? Perhaps change "considerably more token provisionings than expected" to "considerably more tokens provisioned than would be expected". |
2021-03-24
|
17 | Murray Kucherawy | [Ballot Position Update] New position, No Objection, has been recorded for Murray Kucherawy |
2021-03-24
|
17 | (System) | IANA Review state changed to IANA - Not OK from Version Changed - Review Needed |
2021-03-24
|
17 | Erik Kline | [Ballot Position Update] New position, No Objection, has been recorded for Erik Kline |
2021-03-24
|
17 | Warren Kumari | [Ballot comment] Thanks to Linda Dunbar for the OpsDir review, and to the authors for addressing it. It's always nice when directorate reviews improve the … [Ballot comment] Thanks to Linda Dunbar for the OpsDir review, and to the authors for addressing it. It's always nice when directorate reviews improve the document. |
2021-03-24
|
17 | Warren Kumari | Ballot comment text updated for Warren Kumari |
2021-03-24
|
17 | Warren Kumari | [Ballot comment] Thanks to Linda Dunbar for the OpsDir review, and to the authors for addressing it. It's great when directorate reviews improve the document. |
2021-03-24
|
17 | Warren Kumari | [Ballot Position Update] New position, No Objection, has been recorded for Warren Kumari |
2021-03-24
|
17 | Zaheduzzaman Sarker | [Ballot comment] Thanks for this document. I support Roman's discuss and have similar observations when it comes to normative text usage (see Roman's discuss comments). … [Ballot comment] Thanks for this document. I support Roman's discuss and have similar observations when it comes to normative text usage (see Roman's discuss comments). Some nits below -- * Section 2: This profile RECOMMENDS the use of OSCORE between client and AS, to reduce the number of libraries the client has to support, but other protocols fulfilling the security requirements defined in section 5 of [I-D.ietf-ace-oauth-authz] (such as TLS or DTLS) MAY be used as well. [TLS, DTLS] reference is missing. * Section 3.2: Typo : s/parameeter/parameter |
2021-03-24
|
17 | Zaheduzzaman Sarker | [Ballot Position Update] New position, No Objection, has been recorded for Zaheduzzaman Sarker |
2021-03-24
|
17 | Éric Vyncke | [Ballot comment] Thank you for the work put into this document. I found no points to comment/discuss on. As a side comment, I find it … [Ballot comment] Thank you for the work put into this document. I found no points to comment/discuss on. As a side comment, I find it sad that the data tracker is missing the doc shepherd's name (except if Jim Schaad's family has requested the change). Regards, -éric |
2021-03-24
|
17 | Éric Vyncke | [Ballot Position Update] New position, No Objection, has been recorded for Éric Vyncke |
2021-03-23
|
17 | Elwyn Davies | Request for Telechat review by GENART Completed: Ready with Nits. Reviewer: Elwyn Davies. Sent review to list. |
2021-03-23
|
17 | Alvaro Retana | [Ballot Position Update] New position, No Objection, has been recorded for Alvaro Retana |
2021-03-23
|
17 | Amanda Baber | JWT Confirmation Method approved. Question from OAuth Parameters expert. Waiting for CWT Confirmation Method expert. |
2021-03-23
|
17 | Francesca Palombini | [Ballot comment] Recusing as one of the authors of this document. |
2021-03-23
|
17 | Francesca Palombini | Ballot comment text updated for Francesca Palombini |
2021-03-22
|
17 | Roman Danyliw | [Ballot discuss] (A simple editorial fix) Per Section 5.8.2 of [I-D.ietf-ace-oauth-authz], the name of the parameter in the C-to-AS communication is “ace_profile” (not … [Ballot discuss] (A simple editorial fix) Per Section 5.8.2 of [I-D.ietf-ace-oauth-authz], the name of the parameter in the C-to-AS communication is “ace_profile” (not “profile”). The “ace_profile” parameter is mistakenly referenced as “profile” in the following place: (a) Section 3.2. The AS can signal that the use of OSCORE is REQUIRED for a specific access token by including the "profile" parameter with the value "coap_oscore" in the access token response |
2021-03-22
|
17 | Roman Danyliw | [Ballot comment] Thank you to Kathleen Moriarty for the SECDIR review. ** In addition to the normative text noted in the DISCUSS, the examples in … [Ballot comment] Thank you to Kathleen Moriarty for the SECDIR review. ** In addition to the normative text noted in the DISCUSS, the examples in Figure 4 and Figure 7 also have the same typo (but that doesn’t rise to a DISCUSS) ** Section 7. Per “Developers should avoid using multiple access tokens for a same client”, is there a reason not to use a normative SHOULD here? The DTLS profile has nearly the identical words and uses a normative SHOULD? Likewise should “This profile recommends that the that RS maintains a single access token for each client” be “This profile RECOMMENDS”? ** Editorial nits Section 3.2. Typo. s/The applications needs/The application needs/ Section 3.2. Typo. s/parameeter/parameter/ Section 4. Typo. s/Note that the RS and client authenticates/Note that the RS and client authenticate/ Section 4.1. Typo. s/The client may also chose/The client may also choose/ |
2021-03-22
|
17 | Roman Danyliw | [Ballot Position Update] New position, Discuss, has been recorded for Roman Danyliw |
2021-03-22
|
17 | Francesca Palombini | [Ballot Position Update] New position, Recuse, has been recorded for Francesca Palombini |
2021-03-22
|
17 | Amy Vezza | Notification list changed to none from Jim Schaad <ietf@augustcellars.com> |
2021-03-22
|
17 | Amy Vezza | Document shepherd changed to (None) |
2021-03-19
|
17 | Martin Duke | [Ballot comment] Sec 4.1. I don't understand how the OSCORE security context is secure. In Sec 4.1 it says the C-RS communications need not be … [Ballot comment] Sec 4.1. I don't understand how the OSCORE security context is secure. In Sec 4.1 it says the C-RS communications need not be protected. But the context is fully derived from parameters that go back and forth over this channel. Why can't an observer simply compute the OSCORE keys? |
2021-03-19
|
17 | Martin Duke | [Ballot Position Update] New position, No Objection, has been recorded for Martin Duke |
2021-03-17
|
17 | Amanda Baber | IANA Experts State changed to Reviews assigned |
2021-03-12
|
17 | Jean Mahoney | Request for Telechat review by GENART is assigned to Elwyn Davies |
2021-03-12
|
17 | Jean Mahoney | Request for Telechat review by GENART is assigned to Elwyn Davies |
2021-03-08
|
17 | Amy Vezza | Placed on agenda for telechat - 2021-03-25 |
2021-03-08
|
17 | Benjamin Kaduk | Ballot has been issued |
2021-03-08
|
17 | Benjamin Kaduk | [Ballot Position Update] New position, Yes, has been recorded for Benjamin Kaduk |
2021-03-08
|
17 | Benjamin Kaduk | Created "Approve" ballot |
2021-03-08
|
17 | (System) | Changed action holders to Benjamin Kaduk (IESG state changed) |
2021-03-08
|
17 | Benjamin Kaduk | IESG state changed to IESG Evaluation from Waiting for Writeup::AD Followup |
2021-03-08
|
17 | Benjamin Kaduk | Ballot writeup was changed |
2021-03-08
|
17 | Göran Selander | New version available: draft-ietf-ace-oscore-profile-17.txt |
2021-03-08
|
17 | (System) | New version accepted (logged-in submitter: Göran Selander) |
2021-03-08
|
17 | Göran Selander | Uploaded new revision |
2021-01-28
|
16 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-16.txt |
2021-01-28
|
16 | (System) | New version approved |
2021-01-28
|
16 | (System) | Request for posting confirmation emailed to previous authors: Francesca Palombini , Goeran Selander , Ludwig Seitz , Martin Gunnarsson |
2021-01-28
|
16 | Francesca Palombini | Uploaded new revision |
2021-01-28
|
16 | Francesca Palombini | Uploaded new revision |
2021-01-26
|
15 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-15.txt |
2021-01-26
|
15 | (System) | New version approved |
2021-01-26
|
15 | (System) | Request for posting confirmation emailed to previous authors: Francesca Palombini , Goeran Selander , Ludwig Seitz , Martin Gunnarsson |
2021-01-26
|
15 | Francesca Palombini | Uploaded new revision |
2021-01-26
|
15 | Francesca Palombini | Uploaded new revision |
2020-12-14
|
14 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-14.txt |
2020-12-14
|
14 | (System) | New version approved |
2020-12-14
|
14 | (System) | Request for posting confirmation emailed to previous authors: Martin Gunnarsson , Goeran Selander , Francesca Palombini , Ludwig Seitz |
2020-12-14
|
14 | Francesca Palombini | Uploaded new revision |
2020-12-14
|
14 | Francesca Palombini | Uploaded new revision |
2020-12-03
|
13 | Kathleen Moriarty | Request for Last Call review by SECDIR Completed: Ready. Reviewer: Kathleen Moriarty. Sent review to list. |
2020-10-27
|
13 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-13.txt |
2020-10-27
|
13 | (System) | New version approved |
2020-10-27
|
13 | (System) | Request for posting confirmation emailed to previous authors: Goeran Selander , Francesca Palombini , Martin Gunnarsson , Ludwig Seitz |
2020-10-27
|
13 | Francesca Palombini | Uploaded new revision |
2020-10-27
|
13 | (System) | Request for posting confirmation emailed to previous authors: Francesca Palombini , Goeran Selander , Martin Gunnarsson , Ludwig Seitz |
2020-10-27
|
13 | Francesca Palombini | Uploaded new revision |
2020-10-27
|
13 | Francesca Palombini | Uploaded new revision |
2020-09-21
|
12 | (System) | Sub state has been changed to AD Followup from Revised ID Needed |
2020-09-21
|
12 | (System) | IANA Review state changed to Version Changed - Review Needed from IANA - Not OK |
2020-09-21
|
12 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-12.txt |
2020-09-21
|
12 | (System) | New version approved |
2020-09-21
|
12 | (System) | Request for posting confirmation emailed to previous authors: Goeran Selander , Martin Gunnarsson , Francesca Palombini , Ludwig Seitz |
2020-09-21
|
12 | Francesca Palombini | Uploaded new revision |
2020-09-21
|
12 | Francesca Palombini | Uploaded new revision |
2020-07-27
|
11 | Benjamin Kaduk | We should update for at least the genart reviewer's comments (but ideally all comments from the IETF LC). |
2020-07-27
|
11 | Benjamin Kaduk | IESG state changed to Waiting for Writeup::Revised I-D Needed from Waiting for Writeup |
2020-07-21
|
11 | Elwyn Davies | Request for Last Call review by GENART Completed: Almost Ready. Reviewer: Elwyn Davies. Sent review to list. |
2020-07-20
|
11 | (System) | IANA Review state changed to IANA - Not OK from IANA - Review Needed |
2020-07-20
|
11 | Sabrina Tanamal | (Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs: The IANA Functions Operator has completed its review of draft-ietf-ace-oscore-profile-11. If any part of this review is inaccurate, please let … (Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs: The IANA Functions Operator has completed its review of draft-ietf-ace-oscore-profile-11. If any part of this review is inaccurate, please let us know. The IANA Functions Operator has a question about one of the actions requested in the IANA Considerations section of this document. The IANA Functions Operator understands that, upon approval of this document, there are six actions which we must complete. IANA understands that some of the actions requested in the IANA Considerations section of this document are dependent upon the approval of and completion of IANA Actions in another document: draft-ietf-ace-oauth-authz-35. Section 8.8 of that document creates a new registry with the following fields: Name: The name of the profile, to be used as the value of the profile attribute. Description: Text giving an overview of the profile and the context it is developed for. CBOR Value: CBOR abbreviation for this profile name. Different ranges of values use different registration policies [RFC8126]. Integer values from -256 to 255 are designated as Standards Action. Integer values from -65536 to -257 and from 256 to 65535 are designated as Specification Required. Integer values greater than 65535 are designated as "Expert Review". Integer values less than -65536 are marked as Private Use. Reference: This contains a pointer to the public specification of the profile abbreviation if one exists. First, in the new registry created by section 8.8 of draft-ietf-ace-oauth-authz-35 a single, new registration will be made as follows: Name: coap_oscore Description: Profile for using OSCORE to secure communication between constrained nodes using the Authentication and Authorization for Constrained Environments framework. CBOR Value: [ TBD-at-Registration ] Reference: [ RFC-to-be ] Second, in the OAuth Parameters Registry on the OAuth Parameters registry page located at: https://www.iana.org/assignments/oauth-parameters/ two, new registrations are to be made as follows: Name: nonce1 Parameter Usage Location: token request Change Controller: IETF Reference: [ RFC-to-be ] Name: nonce2 Parameter Usage Location: token response Change Controller: IETF Reference: [ RFC-to-be ] As this document requests registrations in a Specification Required (see RFC 8126) registry, the IESG-designated expert for the OAuth Parameters registry has asked that you send a review request to the mailing list oauth-ext-review@ietf.org. This review must be completed before the document's IANA state can be changed to "IANA OK." Third, in the new registry created by section 8.10 of draft-ietf-ace-oauth-authz-35 two, new registrations will be made as follows: Name: nonce1 CBOR Key: [ TBD-at-Registration ] Value Type: bstr Reference: [ RFC-to-be ] Name: nonce2 CBOR Key: [ TBD-at-Registration ] Value Type: IESG Reference: [ RFC-to-be ] Fourth, a new registry is to be created called the OSCORE Security Context Parameters registry. IANA Question --> Where should this new registry be located? Should it be added to an existing registry page? If not, does it belong in an existing category at http://www.iana.org/protocols? The new registry will be managed as follows (see RFC 8126): CBOR Label Registration Value Policy ------------------+--------------------------------- less than -65536 Private Use -65536 to -257 Specification required -256 to 255 Standards track document required 256 to 65535 Specification required greater than 65536 Expert review String length = 1 Standards track document required String length = 2 Specification required String length > 2 Expert review There are initial registrations in the new registry as follows (all of these initial registrations will have a reference of [ RFC-to-be ] and [RFC8613]: Name: version CBOR label: 0 CBOR type: int Registry: Description: OSCORE Version Name: ms CBOR label: 1 CBOR type: bstr Registry: Description: OSCORE Master Secret value Name: clientId CBOR label: 2 CBOR type: bstr Registry: Description: OSCORE Sender ID value of the client, OSCORE Recipient ID value of the server Name: serverId CBOR label: 3 CBOR type: bstr Registry: Description: OSCORE Sender ID value of the server, OSCORE Recipient ID value of the client Name: hkdf CBOR label: 4 CBOR type: tstr / int Registry: COSE Algorithm Values (HMAC-based) Description: OSCORE HKDF value Name: alg CBOR label: 5 CBOR type: tstr / int Registry: COSE Algorithm Values (AEAD) Description: OSCORE AEAD Algorithm value Name: salt CBOR label: 6 CBOR type: bstr Registry: Description: OSCORE Master Salt value Name: contextId CBOR label: 7 CBOR type: bstr Registry: Description: OSCORE ID Context value Fifth, in the CWT Confirmation Methods registry on the CBOR Web Token (CWT) Claims registry page located at: https://www.iana.org/assignments/cwt/ a single registration will be made as follows: Confirmation Method Name: "osc" Confirmation Method Description: OSCORE_Security_Context carrying the parameters for using OSCORE per-message security with implicit key confirmation Confirmation Key: [ TBD-at-Registration ] (value between 4 and 255) Confirmation Value Type(s): map Change Controller: IESG Reference: [ RFC-to-be; Section 3.2.1 ] As this also requests registrations in a Specification Required (see RFC 8126) registry, the IESG-designated experts for the CWT Confirmation Methods registry have also asked that you send a review request to the mailing list cwt-reg-review@ietf.org. This review must be completed before the document's IANA state can be changed to "IANA OK." Sixth, in the JWT Confirmation Methods registry on the JSON Web Token (JWT) registry page located at: https://www.iana.org/assignments/jwt/ a single, new registration will be made as follows: Confirmation Method Value: "osc" Confirmation Method Description: OSCORE_Security_Context carrying the parameters for using OSCORE per-message security with implicit key confirmation Change Controller: IESG Reference: [ RFC-to-be; Section 3.2.1 ] As this also requests registrations in a Specification Required (see RFC 8126) registry, the IESG-designated experts for the JWT Confirmation Methods registry have also asked that you send a review request to the mailing list jwt-reg-review@ietf.org. This review must be completed before the document's IANA state can be changed to "IANA OK." The IANA Functions Operator understands that these are the only actions required to be completed upon approval of this document. Note: The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is meant only to confirm the list of actions that will be performed. Thank you, Sabrina Tanamal Senior IANA Services Specialist |
2020-07-20
|
11 | (System) | IESG state changed to Waiting for Writeup from In Last Call |
2020-07-19
|
11 | Linda Dunbar | Request for Last Call review by OPSDIR Completed: Has Nits. Reviewer: Linda Dunbar. Sent review to list. |
2020-07-16
|
11 | Gunter Van de Velde | Request for Last Call review by OPSDIR is assigned to Linda Dunbar |
2020-07-16
|
11 | Gunter Van de Velde | Request for Last Call review by OPSDIR is assigned to Linda Dunbar |
2020-07-10
|
11 | Tero Kivinen | Request for Last Call review by SECDIR is assigned to Kathleen Moriarty |
2020-07-10
|
11 | Tero Kivinen | Request for Last Call review by SECDIR is assigned to Kathleen Moriarty |
2020-07-09
|
11 | Jean Mahoney | Request for Last Call review by GENART is assigned to Elwyn Davies |
2020-07-09
|
11 | Jean Mahoney | Request for Last Call review by GENART is assigned to Elwyn Davies |
2020-07-06
|
11 | Amy Vezza | IANA Review state changed to IANA - Review Needed |
2020-07-06
|
11 | Amy Vezza | The following Last Call announcement was sent out (ends 2020-07-20): From: The IESG To: IETF-Announce CC: ietf@augustcellars.com, draft-ietf-ace-oscore-profile@ietf.org, ace@ietf.org, Jim Schaad , … The following Last Call announcement was sent out (ends 2020-07-20): From: The IESG To: IETF-Announce CC: ietf@augustcellars.com, draft-ietf-ace-oscore-profile@ietf.org, ace@ietf.org, Jim Schaad , kaduk@mit.edu, ace-chairs@ietf.org Reply-To: last-call@ietf.org Sender: Subject: Last Call: (OSCORE profile of the Authentication and Authorization for Constrained Environments Framework) to Proposed Standard The IESG has received a request from the Authentication and Authorization for Constrained Environments WG (ace) to consider the following document: - 'OSCORE profile of the Authentication and Authorization for Constrained Environments Framework' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the last-call@ietf.org mailing lists by 2020-07-20. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This memo specifies a profile for the Authentication and Authorization for Constrained Environments (ACE) framework. It utilizes Object Security for Constrained RESTful Environments (OSCORE) to provide communication security, server authentication, and proof-of-possession for a key owned by the client and bound to an OAuth 2.0 access token. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-ace-oscore-profile/ No IPR declarations have been submitted directly on this I-D. |
2020-07-06
|
11 | Amy Vezza | IESG state changed to In Last Call from Last Call Requested |
2020-07-06
|
11 | Amy Vezza | Last call announcement was changed |
2020-07-04
|
11 | Benjamin Kaduk | Last call was requested |
2020-07-04
|
11 | Benjamin Kaduk | Last call announcement was generated |
2020-07-04
|
11 | Benjamin Kaduk | Ballot approval text was generated |
2020-07-04
|
11 | Benjamin Kaduk | Ballot writeup was generated |
2020-07-04
|
11 | Benjamin Kaduk | IESG state changed to Last Call Requested from AD Evaluation::External Party |
2020-06-18
|
11 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-11.txt |
2020-06-18
|
11 | (System) | New version accepted (logged-in submitter: Francesca Palombini) |
2020-06-18
|
11 | Francesca Palombini | Uploaded new revision |
2020-04-28
|
10 | Benjamin Kaduk | We're hoping to get some additional text discussing the nonce sizes. |
2020-04-28
|
10 | Benjamin Kaduk | IESG state changed to AD Evaluation::External Party from AD Evaluation::AD Followup |
2020-03-09
|
10 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-10.txt |
2020-03-09
|
10 | (System) | New version approved |
2020-03-09
|
10 | (System) | Request for posting confirmation emailed to previous authors: Francesca Palombini , Ludwig Seitz , Goeran Selander , Martin Gunnarsson |
2020-03-09
|
10 | Francesca Palombini | Uploaded new revision |
2020-03-09
|
10 | Francesca Palombini | Uploaded new revision |
2020-03-02
|
09 | (System) | Sub state has been changed to AD Followup from Revised ID Needed |
2020-03-02
|
09 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-09.txt |
2020-03-02
|
09 | (System) | New version approved |
2020-03-02
|
09 | (System) | Request for posting confirmation emailed to previous authors: ace-chairs@ietf.org, Goeran Selander , Martin Gunnarsson , Ludwig Seitz , Francesca Palombini |
2020-03-02
|
09 | Francesca Palombini | Uploaded new revision |
2020-03-02
|
09 | Francesca Palombini | Uploaded new revision |
2020-01-07
|
08 | Benjamin Kaduk | IESG state changed to AD Evaluation::Revised I-D Needed from AD Evaluation |
2020-01-02
|
08 | Benjamin Kaduk | IESG state changed to AD Evaluation from Publication Requested |
2020-01-01
|
08 | Jim Schaad | As required by RFC 4858, this is the current template for the Document Shepherd Write-Up. Changes are expected over time. This version is dated … As required by RFC 4858, this is the current template for the Document Shepherd Write-Up. Changes are expected over time. This version is dated 24 February 2012. (1) This is requested to be a Proposed Standard. The header of the document correctly reflects this. (2) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up. Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections: Technical Summary The OAuth authentication and Authorization for Constrained Devices provides a message format and framework for moving keys and tokens between authority servers, clients, and resource servers. This document provides a set of security services so that the communication and authorizations can be performed. Working Group Summary Once the CoRE document dealing with OSCORE there was only one issue of significance. That issue was how to deal with re-use of tokens in order to make sure that the same transport key was not going to be regenerated. This has been addressed. Document Quality The document has been fairly extensively vetted. There are at least two implementations of a version of the document prior to the WGLC being done. Personnel Jim Schaad is acting as the Document Shepherd. Benjamin Kaduk is the Responsible Area Director. (3) I have read and implemented the protocol in the document. I have done a full read through the document prior to releasing it as well as double checking my implementation against the current document. (4) I have no concerns with the review of this document. It is expected that an updated interop test will be run at the Prague Hackathon. (5) There are no portions of this document that need extra review. (6) Given the current state of the OSCORE document, some attention may need to be focused on the method used to add randomness to the key derivation process. I believe that what is done is sufficient, but others may want to look at it. (7) All authors have confirmed that all IPR disclosures have been made. Ludwig 2/25/19 Francesca 1/31/19 Goeran 2/25/19 Martin 2/16/19 (8) No IPR disclosures have been filed on this document. (9) This document represents a strong consensus of a small group of people. Most of the reviews came from me and the authors. (10) There are not any indications of appeals or extreme discontent. (11) No ID nits were found in the document. (12) There is no formal review required. (13) All references are appropriately normative or informative. (14) All normative references are either complete or soon to advance to the IESG (15) There are no downward normative references. (16) This document contains all new material and does not modify any existing RFCs. (17) I checked that all items that were setup as being defined in the text also occurred in the registration sections. Went through and verified that the template for registering new OSCORE Security Context Parameters made sense. (18) This document creates one new registry: OSCORE Security Context Parameters Registry - This registry is setup to require expert review. This registry is similar but not identical in usage to the currently existing COSE_Key registry. As such a combination of current DEs for that registry and authors for the OSCORE document (draft-ietf-core-object-security) would be recommended to act as the DEs for ths registry. (19) There are no external reviews or automated checks needed. |
2019-07-08
|
08 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-08.txt |
2019-07-08
|
08 | (System) | New version approved |
2019-07-08
|
08 | (System) | Request for posting confirmation emailed to previous authors: Ludwig Seitz , Goeran Selander , Martin Gunnarsson , Francesca Palombini |
2019-07-08
|
08 | Francesca Palombini | Uploaded new revision |
2019-07-08
|
08 | Francesca Palombini | Uploaded new revision |
2019-03-05
|
07 | Jim Schaad | As required by RFC 4858, this is the current template for the Document Shepherd Write-Up. Changes are expected over time. This version is dated … As required by RFC 4858, this is the current template for the Document Shepherd Write-Up. Changes are expected over time. This version is dated 24 February 2012. (1) This is requested to be a Proposed Standard. The header of the document correctly reflects this. (2) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up. Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections: Technical Summary The OAuth authentication and Authorization for Constrained Devices provides a message format and framework for moving keys and tokens between authority servers, clients, and resource servers. This document provides a set of security services so that the communication and autthorizations can be performed. Working Group Summary Was there anything in WG process that is worth noting? For example, was there controversy about particular points or were there decisions where the consensus was particularly rough? Document Quality The document has been fairly extensively vetted. There are at least two implementations of a version of the document prior to the WGLC being done. Personnel Jim Schaad is acting as the Document Shepherd. Benjamin Kaduk is the Responsible Area Director. (3) I have read and implemented the protocol in the document. I have done a full read through the document prior to releasing it as well as double checking my implementation againist the current document. (4) I have no concerns with the review of this document. It is expected that an updated interop test will be run at the Prague Hackathon. (5) There are no portions of this document that need extra review. (6) Given the current state of the OSCORE document, some attention may need to be focused on the method used to add randomness to the key derivation process. I believe that what is done is sufficent, but others may want to look at it. (7) All authors have confirmed that all IPR disclosures have been made. Ludwig 2/25/19 Francesca 1/31/19 Goeran 2/25/19 Martin 2/16/19 (8) No IPR disclosures have been filed on this document. (9) This document represents a strong consensus of a small group of people. Most of the reviews came from me and the authors. (10) There are not any indications of appeals or extreme discontent. (11) No ID nits were found in the document. (12) There is no formal review required. (13) All references are appropriately normative or informative. (14) All normative references are either complete or soon to advance to the IESG (15) There are no downward normative references. (16) This document contains all new material and does not modify any existing RFCs. (17) I checked that all items that were setup as being defined in the text also occured in the registration sections. Went through and verified that the template for registering new OSCORE Security Context Parameters made sense. (18) This document creates one new registry: OSCORE Security Context Parameters Registry - This registry is setup to require expert review. This registry is similar but not identical in usage to the currently existing COSE_Key registry. As such a combination of current DEs for that registry and authors for the OSCORE document (draft-ietf-core-object-security) would be recommended to act as the DEs for ths registry. (19) There are no external reviews or automated checks needed. |
2019-03-05
|
07 | Jim Schaad | Responsible AD changed to Benjamin Kaduk |
2019-03-05
|
07 | Jim Schaad | IETF WG state changed to Submitted to IESG for Publication from In WG Last Call |
2019-03-05
|
07 | Jim Schaad | IESG state changed to Publication Requested from I-D Exists |
2019-03-05
|
07 | Jim Schaad | IESG process started in state Publication Requested |
2019-03-05
|
07 | Jim Schaad | Tag Revised I-D Needed - Issue raised by WGLC cleared. |
2019-03-05
|
07 | Jim Schaad | Changed consensus to Yes from Unknown |
2019-03-05
|
07 | Jim Schaad | Intended Status changed to Proposed Standard from None |
2019-03-02
|
07 | Jim Schaad | As required by RFC 4858, this is the current template for the Document Shepherd Write-Up. Changes are expected over time. This version is dated … As required by RFC 4858, this is the current template for the Document Shepherd Write-Up. Changes are expected over time. This version is dated 24 February 2012. (1) This is requested to be a Proposed Standard. The header of the document correctly reflects this. (2) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up. Recent examples can be found in the "Action" announcements for approved documents. The approval announcement contains the following sections: Technical Summary The OAuth authentication and Authorization for Constrained Devices provides a message format and framework for moving keys and tokens between authority servers, clients, and resource servers. This document provides a set of security services so that the communication and autthorizations can be performed. Working Group Summary Was there anything in WG process that is worth noting? For example, was there controversy about particular points or were there decisions where the consensus was particularly rough? Document Quality The document has been fairly extensively vetted. There are at least two implementations of a version of the document prior to the WGLC being done. Personnel Jim Schaad is acting as the Document Shepherd. Benjamin Kaduk is the Responsible Area Director. (3) I have read and implemented the protocol in the document. I have done a full read through the document prior to releasing it as well as double checking my implementation againist the current document. (4) I have no concerns with the review of this document. It is expected that an updated interop test will be run at the Prague Hackathon. (5) There are no portions of this document that need extra review. (6) Given the current state of the OSCORE document, some attention may need to be focused on the method used to add randomness to the key derivation process. I believe that what is done is sufficent, but others may want to look at it. (7) All authors have confirmed that all IPR disclosures have been made. Ludwig 2/25/19 Francesca 1/31/19 Goeran 2/25/19 Martin 2/16/19 (8) No IPR disclosures have been filed on this document. (9) This document represents a strong consensus of a small group of people. Most of the reviews came from me and the authors. (10) There are not any indications of appeals or extreme discontent. (11) No ID nits were found in the document. (12) There is no formal review required. (13) All references are appropriately normative or informative. (14) All normative references are either complete or soon to advance to the IESG (15) There are no downward normative references. (16) This document contains all new material and does not modify any existing RFCs. (17) I checked that all items that were setup as being defined in the text also occured in the registration sections. Went through and verified that the template for registering new OSCORE Security Context Parameters made sense. (18) This document creates one new registry: OSCORE Security Context Parameters Registry - This registry is setup to require expert review. This registry is similar but not identical in usage to the currently existing COSE_Key registry. As such a combination of current DEs for that registry and authors for the OSCORE document (draft-ietf-core-object-security) would be recommended to act as the DEs for ths registry. (19) There are no external reviews or automated checks needed. |
2019-02-19
|
07 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-07.txt |
2019-02-19
|
07 | (System) | New version approved |
2019-02-19
|
07 | (System) | Request for posting confirmation emailed to previous authors: Ludwig Seitz , Goeran Selander , Martin Gunnarsson , Francesca Palombini |
2019-02-19
|
07 | Francesca Palombini | Uploaded new revision |
2019-02-19
|
07 | Francesca Palombini | Uploaded new revision |
2019-01-28
|
06 | Jim Schaad | Notification list changed to Jim Schaad <ietf@augustcellars.com> |
2019-01-28
|
06 | Jim Schaad | Document shepherd changed to Jim Schaad |
2019-01-03
|
06 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-06.txt |
2019-01-03
|
06 | (System) | New version approved |
2019-01-03
|
06 | (System) | Request for posting confirmation emailed to previous authors: Ludwig Seitz , Goeran Selander , Martin Gunnarsson , Francesca Palombini |
2019-01-03
|
06 | Francesca Palombini | Uploaded new revision |
2019-01-03
|
06 | Francesca Palombini | Uploaded new revision |
2018-11-07
|
05 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-05.txt |
2018-11-07
|
05 | (System) | New version approved |
2018-11-07
|
05 | (System) | Request for posting confirmation emailed to previous authors: Ludwig Seitz , Goeran Selander , Martin Gunnarsson , Francesca Palombini |
2018-11-07
|
05 | Francesca Palombini | Uploaded new revision |
2018-11-07
|
05 | Francesca Palombini | Uploaded new revision |
2018-11-04
|
04 | Jim Schaad | Tag Revised I-D Needed - Issue raised by WGLC set. |
2018-10-22
|
04 | Jim Schaad | Added to session: IETF-103: ace Thu-1610 |
2018-10-08
|
04 | Jim Schaad | IETF WG state changed to In WG Last Call from WG Document |
2018-10-08
|
04 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-04.txt |
2018-10-08
|
04 | (System) | New version approved |
2018-10-08
|
04 | (System) | Request for posting confirmation emailed to previous authors: Ludwig Seitz , Goeran Selander , Martin Gunnarsson , Francesca Palombini |
2018-10-08
|
04 | Francesca Palombini | Uploaded new revision |
2018-10-01
|
03 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-03.txt |
2018-10-01
|
03 | (System) | New version approved |
2018-10-01
|
03 | (System) | Request for posting confirmation emailed to previous authors: Ludwig Seitz , Goeran Selander , Martin Gunnarsson , Francesca Palombini |
2018-10-01
|
03 | Francesca Palombini | Uploaded new revision |
2018-07-14
|
02 | Roman Danyliw | Added to session: IETF-102: ace Mon-0930 |
2018-06-29
|
02 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-02.txt |
2018-06-29
|
02 | (System) | New version approved |
2018-06-29
|
02 | (System) | Request for posting confirmation emailed to previous authors: Ludwig Seitz , Goeran Selander , Martin Gunnarsson , Francesca Palombini |
2018-06-29
|
02 | Francesca Palombini | Uploaded new revision |
2018-03-13
|
01 | Jim Schaad | Added to session: IETF-101: ace Mon-0930 |
2018-03-05
|
01 | Ludwig Seitz | New version available: draft-ietf-ace-oscore-profile-01.txt |
2018-03-05
|
01 | (System) | New version approved |
2018-03-05
|
01 | (System) | Request for posting confirmation emailed to previous authors: Ludwig Seitz , ace-chairs@ietf.org, Martin Gunnarsson , Francesca Palombini |
2018-03-05
|
01 | Ludwig Seitz | Uploaded new revision |
2017-12-12
|
00 | Benjamin Kaduk | This document now replaces draft-seitz-ace-oscoap-profile instead of None |
2017-12-12
|
00 | Francesca Palombini | New version available: draft-ietf-ace-oscore-profile-00.txt |
2017-12-12
|
00 | (System) | WG -00 approved |
2017-12-12
|
00 | Francesca Palombini | Set submitter to "Francesca Palombini ", replaces to draft-seitz-ace-oscoap-profile and sent approval email to group chairs: ace-chairs@ietf.org |
2017-12-12
|
00 | Francesca Palombini | Uploaded new revision |