Skip to main content

Minutes IETF116: cose

Meeting Minutes CBOR Object Signing and Encryption (cose) WG
Date and time 2023-03-27 04:00
Title Minutes IETF116: cose
State Active
Other versions markdown
Last updated 2023-03-29



Connection details

Action Items


  • jabber scribe:
  • Minutes taken by: Russ Housley, and Carsten Bormann (a bit)

Opening remarks - the chairs [13:00-13:05]
Mike Jones called to order. Full agenda. All presentations have been uploaded.
RATS group has requested +cwt media type discussion during AOB part of the
agenda. Request for show-of-hands for interest in aSCON for COSE. RFC 9338 and
9360 have been published since IETF 115. cose-aes-ctr-and-cbc has been submitted
for publication.

Post-Quantum Signatures draft-ietf-cose-{dilithium,sphincs,falcon} - Michael Prorock [13:05-13:30]
Speaker re-introduced motivation to PQC, specifically digital signatures.
SPHINCS+, Dilithium, Falcom are focus for 3 drafts, one for each signature
algorithm. W3C Verifiable Credential and DIDS efforts have dependency on COSE
PQC extensions. PQC - larger keys and longer sigs. Large number of parameters in
some cases. Would like to reduce optionality in target algm.'s. Initial draft
was split into 3 signe IETF 115 (algm. based) All are -00 drafts. 'sphincs-plus'
is used instead of '+' due to compatibility with media types. Authors want
feedback on the 'kty' choices. Also need help with test vectors. Mike Ounsworth
mentioned that PQIP could provide feedback on parameterization. J. Mattson
mentioned that test vectors may not be useful prior to NIST finalization.
Carsten Bormann countered that the drafts have to be written without waiting on
NIST, including test vectors. Russ Housley mentioned that different WG's have
documents on the same PQC algorithms. Recommendation is that there should be a
common split between algorithm identifiers and parameters. We want the same
crypto library to support all of the formats. Speaker agreed and stated that the
editors are coordinating. kty + alg: suggestion by speaker to allow for kty
extensibility. Mike Jones mentioned that different kty's implied that the key
types are semantically different. Mike Dunsworth: asked if encodings are being
accounted for, to which the speaker answered in affirmative.

draft-ietf-cose-bls-key-representations - Tobias Looker [13:30-13:40]
Draft defines necessary parameters for key representation of BLS elliptic curve.
Examples cited that make use of BLS sigs. Updated draft includes HWK and
additional COSE_Key examples. There is only one compressed point encoding
method, so draft defines uncompressed key representation (both x- and
y-coordinate). Will need to define compressed encoding. Orie Steele asked about
whether COSE can lead the way in defining a compressed format. Speaker mentioned
that zCash compression is being used. J. Mattson asked about use of this algn.
in other groups and whether key representation can be commonalized. Mike Jones
gave an example of key representation being IPR encumbered. M. Prorock: kty's
shouldn't be defined alone. J. Mattson stated that key types should be a
bytestream and avoid parameterization.

draft-ietf-cose-cwt-claims-in-headers - Tobias Looker [13:40-13:50]
Mike Jones recused himself from charing during this presentation, as he is a
co-author. CWT claims carriage in COSE header was introduced. e.g. allows for
conveyance of claims when payload is not a CWT. Similar feature in JWT. Draft
-03 published with CDDL description of new header, and clarified that it can be
in protected or unprotected headers. M. Prorock mentioned all his concerns
addressed in -03.

draft-ietf-cose-cbor-encoded-cert - Göran Selander [13:50-13:55]

OCSP may be specified or moved to a separate draft - planned for IETF 117.
Request for additional reviews. Editors expecting to progress draft during next
few months.

draft-ietf-cose-hpke - Hannes Tschofenig [13:55-14:10]

2 new versions since IETF 115. encapsulated_key_array introduced. -04 was
foundation for IETF 116 hackathon. 2 layer COSE_Encrypt was verified. Use of
HPKE for COSE_MAC is being considered. Also considering emtpy string for info
field. O. Steele asked about the need to prioritize authenticated mode at this
stage of the draft. L. Lundblade mentioned that this could be useful, but should
not be a reason to hold up draft. O. Steele mentioned that ECDH-1PU (ECDH-ES
derivative) may provide a potential use case for HPKE auth mode. Mike Jones
mentioned that shepherd write-up would not be able to provide whether HPKE
reflects efforts of the group, or whether it reflects the efforts of a few
individuals within the group. He requested reviewers from the group. Tim
Hollebeek: I will review the discussion. L. Lundblade also volunteered to review
the draft. And so did AJITOMI Daisuke. And Cartsen Bormann.

draft-ajitomi-cose-cose-key-jwk-hpke-kem - AJITOMI Daisuke [14:10-14:20]
Proposal focuseds on key encapsulation for HPKE. Recommendation is to use
COSE_Key and JWK for representation. Recommendation to define a kty 'HPKE-KEM'
Speaker recommended not to accept existing key types for HPKE. O. Steele spoke
in support of adoption of the draft, and work on resolution of contentious
issues as outlined by speaker. L. Lundblade also spoke in support of adoption,
but recommended that it focus on COSE_Key. He pointed out that COSE_Key is a key
representation, not an algorithmic representation. He also stated that alg use
should be discussed in the draft. M. Prorock was supportive of adoption. 5
persons confirmed having read the draft. (O. Steele, M. Prorock, S. Das, L.
Lundblade, H. Tschofenig) Chairs will post a call-for-adoption on the list.

draft-birkholz-cose-tsa-tst-header-parameter - Maik Riechert and Henk Birkholz [14:20-14:30]
RFC 3161 describes a protocol to communicate with a timestamp authority that can
provide a trusted timestamp (DER encoded). Request for a COSE header parameter
to carry timestamp token byte string. Carsten Bormann mentioned that CBOR was
designed to convey byte strings to allow for other formats. COSE similarly
included X.509. It is a logical extension. M. Prorock also spoke in support of
adoption, and volunteered to write sec cons section. 5 confirmed to have read
doc (S. Das, O. Stele, C. Bormann, M. Prorock, T. Fossati). Chair will send call
for adoption to mailing list.

draft-steele-cose-merkle-tree-proofs - Orie Steele [14:30-14:40]
Draft introduces use of COSE_Sign1 for carriage of Merkle proof. Useful building
block for SCITT and other WG's that use COSE, and key/cert transparency. Initial
draft. 'tree agility' needs to be addressed, with a tree algm. registry to be
established. Therefore draft is not ready for WG call for adoption. C. Bormann
mentioned need for registries to capture variation in algorithms. Russ Housley
recommended need to associate service (e.g. in header) with algorithm. Speaker
agreed. Volunteers to review draft: H. Tschofenig, C. Bormann, Roy Williams
People aware of usecases, please provide those to Orie.

draft-fossati-cose-profiles - Henk Birkholz and Thomas Fossati [14:40-14:50]

Introduces concept of profiling for COSE, to allow for interop. COSE message
typining primitives don't exist, outside of CBOR tagging. COSE-profile header
parameter is introduced, with different type choices. M. Jones mentioned that
ACE WG has defined a profile parameter. C. Bormann stated that ACE profiles are
RFC-level complexity, and what may be sought with the proposal is a feature set.
Recommended an acid test: if the profile is lost in transit, can the COSE still
be processed by the receiver? Henk responded that lost alg. field will result in
error. L. Lundblade asked about whether COSE profiles included ciphersuite
negotiation. Henk responded no, but it could be revisited. M. Prorock stated
that this is not a unique issue to COSE, but a profile identifier could be
useful. But it would need to be scoped properly. Henk responded that the draft
includes scoping ("the rules").

AOB [14:50-15:00]

M. Richardson introduced the topic of cwt+ media types. RATS WG is currently
registering the applicatio/eat+cwt media type as a comparison. Question: why
should 'cbor+cose' or 'cose+cbor' be used. C. Bormann stated that the media
types allow for partial processing in case an endpoint cannot process both media
types. O. Steele stated that as of today '+cwt' is not recommended, as JWT best
practices recommend to use specialized media types when possible. T. Looker
mentioned tht +cwt implies that all processing rules for CWT must apply. Mike
Jones stated that a draft should register '+cwt'.