Joining OSCORE groups in ACE
draft-tiloca-ace-oscoap-joining-04

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04

ACE Working Group                                              M. Tiloca
Internet-Draft                                                 RISE SICS
Intended status: Standards Track                                 J. Park
Expires: December 31, 2018                   Universitaet Duisburg-Essen
                                                           June 29, 2018

                      Joining OSCORE groups in ACE
                   draft-tiloca-ace-oscoap-joining-04

Abstract

   This document describes a method to join a group where communications
   are based on CoAP and secured with Object Security for Constrained
   RESTful Environments (OSCORE).  The proposed method delegates the
   authentication and authorization of client nodes that join an OSCORE
   group through a Group Manager server.  This approach builds on the
   ACE framework for Authentication and Authorization, and leverages
   protocol-specific profiles of ACE to achieve communication security,
   proof-of-possession and server authentication.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on December 31, 2018.

Copyright Notice

   Copyright (c) 2018 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect

Tiloca & Park           Expires December 31, 2018               [Page 1]
Internet-Draft         OSCORE group joining in ACE             June 2018

   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   3
   2.  Protocol Overview . . . . . . . . . . . . . . . . . . . . . .   4
   3.  Joining Node to Authorization Server  . . . . . . . . . . . .   6
     3.1.  Authorization Request . . . . . . . . . . . . . . . . . .   6
     3.2.  Authorization Response  . . . . . . . . . . . . . . . . .   7
   4.  Joining Node to Group Manager . . . . . . . . . . . . . . . .   8
     4.1.  Join Request  . . . . . . . . . . . . . . . . . . . . . .   8
     4.2.  Join Response . . . . . . . . . . . . . . . . . . . . . .   9
   5.  Public Keys of Joining Nodes  . . . . . . . . . . . . . . . .  10
   6.  Security Considerations . . . . . . . . . . . . . . . . . . .  12
   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  12
   8.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  13
   9.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  13
     9.1.  Normative References  . . . . . . . . . . . . . . . . . .  13
     9.2.  Informative References  . . . . . . . . . . . . . . . . .  14
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  14

1.  Introduction

   Object Security for Constrained RESTful Environments (OSCORE)
   [I-D.ietf-core-object-security] is a method for application-layer
   protection of the Constrained Application Protocol (CoAP) [RFC7252],
   using CBOR Object Signing and Encryption (COSE) [RFC8152] and
   enabling end-to-end security of CoAP payload and options.

   As described in [I-D.ietf-core-oscore-groupcomm], OSCORE may be used
   also to protect CoAP group communication over IP multicast [RFC7390].
   This relies on a Group Manager entity, which is responsible for
   managing an OSCORE group, where members exchange CoAP messages
   secured with OSCORE.  In particular, the Group Manager coordinates
   the join process of new group members and can be responsible for
   multiple groups.

   This specification builds on the ACE framework for Authentication and
   Authorization [I-D.ietf-ace-oauth-authz] and defines how a client
   joins an OSCORE group through a resource server acting as Group
   Manager.  The client acting as joining node relies on an Access
   Token, which is bound to a proof-of-possession key and authorizes the