Internet Engineering Task Force Interim Meetings, 14 Apr 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: COSE WG Interim Meeting, 2021-04-14

Description

COSE WG Interim Meeting, 2021-04-14

A

Okay, so hello, everyone- and this is the cozy virtual interim meeting.

A

um This is an official itf meeting and as such the not well applies. I believe everyone here is familiar with it, but if you have any questions, please do not hesitate to ask me or my jones about it.

A

This is the agenda for today. uh I think there might be some slight changes uh from discussions with the authors of different items. I don't know uh yeah and are you going to uh need to discuss anything about a registration policies now.

B

um I don't know I don't have any more input besides what we discussed. Okay at the idea, 110.

A

C

No more focus on the fido registrations or.

B

So we responded to that based on the um on on the discussion at the last working group meeting and I have not- I mean I'm not seeing any confirmation on that. So I I assume it's reached the the requesting party.

A

A

Yes and then maybe during the draft update, we will spend a little bit more time on the x509 draft.

A

So with that, I guess we can move on.

A

So here are the minutes. uh The meeting and the minutes are recorded. Please put your name in the minutes in order for us to be able to track the attendance. I've also shared this link in the chat.

A

A

Yes, is there any volunteers to help with the action items recording in the minutes.

A

Otherwise, maybe um my address can do that and of course everyone could help, and that would be greatly appreciated.

A

I don't expect there to be much communication on jabber, but we will be also trying to monitor that if you see anything that we have missed, please let us know.

D

I don't see the minutes link in the meeting invitation, so I don't know where it is.

A

A

Okay, I will share it. I shared it in the chats in webex. I will send it to you as.

D

A

Okay, now you should have it uh so their chartering is completed. Thank you, everyone for uh your participation.

A

uh We with that we have our new chapter, and now we can formally adopt the cyborg certificates draft and, given that there has been no objection to this and some support in the mailing list, I think we can just go ahead and.

A

Post this on the mailing list, of course, if anyone has any objections to this, please let the chairs know.

A

Otherwise, I don't believe there is much change in the status of and sasha and.

A

These documents.

A

D

About which document or documents are we prepared to adopt.

A

uh We are going to adopt.

A

And then this documentary maths and calls the simple certificate compress, and I guess we will rename it at that time, as was discussed.

C

Yeah should be so, should we already now update upload this as draft idf cosy, or should we wait for some that you mailed something out to the mailing list or.

A

I believe I would first email this to the mailing list and then you can send it since within a few days. I guess I will we will approve it.

A

Should there be no objections? Otherwise we will discuss, of course,.

C

Yeah, maybe we wait until you. The tears gives best if teachers mail the orders, when you think we should upload the adopted person.

A

Yes, that sounds good.

A

A

A

um Michael richardson, maybe you can tell us if there are any updates for the code encounters then documents.

E

I finished the shepard report. I posted those questions to the mailing list about updates about what it should formally update and we had the conversation uh and I guess uh I was expecting uh russell housley- would add to the updates list, but um regardless, I think, there's con. I think there's mostly consensus that it should update both the new document, the the 50 81 52 bit struct and 80 rfc 8152.

A

Okay, okay, I will reach out to us.

A

To make sure this happens? Yes, I remember that this was the consensus.

A

A

And then for the x509 document, I saw that there are three full requests in github.

A

um It appears that there are still one or two items that have not been answered to. I believe ben kaduk had commented on a march request from john, uh otherwise they looked good to me and I didn't see any other objections, so please take a look at them and otherwise.

A

Our intention is to merge those pull requests and then continue from there.

A

John, do you want to add anything about this.

C

No, I I, after the last meeting I tried to update my my pull request, based on all the discussion and agreement during the meeting then I saw after I did that there was some comment from lawrence and michael richardson. But after that I went on vacation for a couple of weeks. I have not really been following the discussion, but I saw that ben also got involved, but.

A

Okay, so I then do want me or someone else to take a look at the new comments, or do you intend to reply to them.

C

Yeah I can also I will take a look at the comments. I guess someone else is owning the document that needs to take the final decisions.

A

Okay, yes, oh thank.

A

A

B

Sorry, what about the open issues are those addressed by by the pr. So there are eight open issues, and at least I mean I see five of those is since december, and I I don't think all the pull requests cover all the open issues have we have we really gone through those and.

A

I did not check that. I know it covers some of the issues, but uh yes, that is a good point. I'm not sure if that covers all of them.

A

So as the current editor of the draft, I will take a look at that and come back to you.

A

Before the next interview meeting- because yes I I did not check this.

B

A

That's a good point. Thank you.

A

A

Okay and then next item is the schedule for the next interim meetings.

A

uh We became aware that the proposed time that was posted on the mailing list might be in conflict with course, interims at least have some overlapping.

A

So we are suggesting, if that is uh going to work for everyone to move and our interims by half an hour so that we can avoid, and that overlap and does that work for everyone. Or should I phrase it?

A

Are there any objections to this proposal.

A

uh It appears that there are no objections, so when we schedule the next entrance, we will schedule them for half an hour later.

A

And with that, I think we can switch to the presentation from john.

A

So that's part of our presentation that was and started at the last idea. uh I don't remember exactly where you stopped john.

C

Jordan said it was, we should continue with page 13. Never remember correctly,.

A

C

So yeah we have them. Since the last meeting we have had been forced to spend our time on some other things, so there's not been extremely much work being done on the seaboard certificate.

C

C

So this is a continuous listing of the issues. I don't think we have it. So this is um the continued discussion on whether the seaboard certificate should be a simple sequence or a data item, and I don't think there's has been very much more more input when we discussed this last kersten commented that it was better to fix the tools than to fix the uh fix change. The draft and there's been some comments from lawrence that he thought the sequences were problematic with some tools.

C

uh One thing where we need to make certificates or uh certificate or chains of certificates and seaboard item is when we using them in a tag, so that is already done. Then it's put into an array and the array is tagged.

C

But otherwise I don't have much more. I think this needs to continue to be an open, open issue and I think it needs to be discussed quite high level concerning both a single certificate certificate chain and when it's used in a file or in various transport or tags, and so.

B

On I think, yeah.

C

Then we have next file format for saving c board certificate and csrs.

C

We have not had time to specify any csr format. There is another draft that specifies a csr format that I think the previous discussion showed that that format was very, not general enough and does not align with the zebra certificate draft or c509 certificate draft or whatever we will end up calling it.

C

uh There was a suggestion to use a file format for saving this. I noticed that michael richardson has written such a draft.

C

I don't understand the specific of this, but it seems I assume we will use this draft written by michael richardson to store seabor c509 certificates. But I I don't know exactly how it would be done. But, michael, please.

E

um So I think that so we wound up with two versions of it. One is that we prepend a cbor sequence- that's basically probably 12 bytes. Unless you do it wrong, um and that has the advantage that um you you can trivially remove those 12 bytes, you don't have to transmit them over the over the wire in your protocol, so they don't have any overhead impact.

E

uh The other way is that you put a tag on that or two tags. If you prefer um and and then you have the decision as to whether you are smart enough to remove that tag before you send it or whether you wind up using up bytes for the tag that you probably don't need, because it's probably in a I don't know a cozy uh header or something that's already told you what it is.

E

um So I reckon that's why I preferred the seabor sequence mechanism, because it means that when you put it on disk, it very clearly says what it is. um I think that uh yes, we want. We want a different tag for csrs and we probably if we have a private key format, which I think we might want to have um that um we uh we should tag that as well.

F

I concur with mike.

G

C

Yeah so concurring with mike means. We use um the draft draft idfc board file, magic and the sybor sequence option, and then we define different tags for for maybe a chain for a csr and for a private key or something.

F

Mike richardson's argument about using sequence that is easily removable and may and doesn't need to be transmitted over the air is very attractive to me. It. It makes a lot of sense for my use case and in general, which is why I support it.

C

Would anybody be willing to make a pull request to the c509 draw I'll? Do it great thanks.

A

C

um Then so issue 84 should attack be defined. This was raised by lawrence, and this has been added already to the to a recent version of the draft or recent submitted several months ago and the the tag use. The tag is for a chain, so the draft now defines a specific tag. That is a c 509 chain, and the structure of this is co c c c5, and this is the same structure that is suggested to be used for the c5 bag and c5 chain, and also for the c5.

C

U, which is the uri um header parameter in in cosi, uh and the structure here is just a concatenation of the sequences of the individual certificates and then all of that is wrapped in an array and then that air raid is wrapped in a tag that identifies a c509 chain.

C

So the suggestion is to define a tag for a chain only and that can then be used for a chain or for a individual.

C

C

To know if anybody has looked at that section of the draft or have any comments.

F

Confess that I did not, but it seems, useful to be able to to store the the chain as opposed to just one third.

G

We are looking at the cddl sibo certificate is a group that has a number of members and by by packing these members into an array, you would essentially have to count to.

G

2 11 and each group of 11 items is a certificate, so maybe we can spend another array tag there.

G

I mean people can count to 11, but that sounds a bit brutal if we ever change the number of uh pieces that make up a cbo certificate.

C

Yeah, that's fine, then this, let's change it to an so then the serious thing is to change this to an array of arrays.

C

Yes yeah, to do that, uh I'm fine with that! uh Typically I just if I don't have any comments. I just go for the the option with the list overhead and then we can change it later. That's fine! We do that and any other comments on this. Otherwise can move on to slide.

C

C

uh The so slide 16. This issue is about c r.

C

L and we have not made nobody- has made any concrete suggestion for a more general cbor crl format aligning with the c509 draft, but it is. We will definitely do that at some point in time. I think there was agreement in the group that a crl general serial format aligning with this route would be very useful.

C

There's also a comment that the ucsb stapling would probably be relevant.

C

And then I guess another issue not mentioned here is about certificate revocation lists.

C

I think most of this was captured in the in the charter. um I don't know it would. I think it would be good to have some priority list. What should we?

C

What should be the first focus, because we are, I think everybody has limited time to do something, so we should make sure that we do the most useful thing. First, would that be we're already doing certificate certificates?

C

I assume the next pri prioritized things would be c or l and then maybe ucsb and fourth, instead of get revocation lists and it's not clear that we will or should do all of these.

B

John, I think uh csr is, is high on the priority as well.

C

uh Okay, okay: this is this is a replication.

B

C

I I thought this was about csr uh yeah, I'm sorry! So.

B

The signing requests or the people.

C

That should be on the most. That should definitely be number two after certificates. I I it's my personal thinking yeah.

C

It would be good if somebody else has some other id and it would be good to get comments here. If, if we should, if you have time what should we do? First, your videos certificate verification list, or should we just do ucsb and ocsp stapling.

E

I I think that ocsp has a higher priority than crls.

E

Csrs are interesting and there's some discussion this week from elliott about some desire to change the csr attributes, requests um and that's actually a place where what we have in the asn1 is is is disastrously bad even for asn1 space where we made. This is a place where moving to uh uh a seabor certificate kind of space may be more sense to just just we're. Not no longer compressing is what I'm saying but doing something new, um because it looks pretty green field-ish to me.

E

I also don't think csrs actually have a lot to compress.

C

No, I think we just want to get some seabor encoding of that and maybe align it as much as possible with the c509 draft. So you can reuse a lot of the code.

B

Michael, could you provide a link to elliot's input? Please.

E

Yeah I'll find the link the ml archive just a moment. um You know what it's maybe a private conversation that's been told to go to lamp, so maybe I can't uh point to it so um I'll. I will point the cosi working group at it as soon as it becomes public.

C

C

Yeah seems so suggestion is that ocsp is csr is probably the most urgent thing to specify and ocsp is more important than crl.

C

By the way, the updated charter had a lot of changes by the iesd, for example, one the charter now opens up for certificates that are signed both over their encoding and c-bor encoding.

C

I don't know if this has been discussed on the on the list in recently or not, but did the working group have any comments on this? Is this something that we should support? That would be right now we have type zero and one which one of them are signed over there and the other is signed over c board. This would be them another type which is signed over provide signature over.

F

Both it seems useful to be able to sign cyborg, but I'd like to get back to the previous point, the relative importance of csv versus crl.

F

I would say that they are equally important, because ocsp would definitely be the preferred way for online verification, while if you are in a disconnected subnet for whatever reason, then crl that you pre-loaded is your only way to validate the account for possible revocations.

C

Wouldn't ocsp stapling would be an option.

F

Not in this case, I'm explicitly talking about uh disconnected when, when you can reach back to a server, then it doesn't matter you can reach back to crl server and you can reach back to a csp server, in which case ocsp is preferred.

F

But if you are disconnect, then, uh since you cannot know for sure in advance what certificates would be presented to you during your separation from the main network, you cannot pre-request and pre-load or csp responses.

F

Stapling, I don't think, would do anything for you in this case. Only three loading, a crl would ensure that while you would not have updates from between the crl issuing till now, you would still have updates from certificate issuing date to serial retrieval.

F

This is my point.

C

So, to summarize, your point would that be that ucsb and crl or equally prioritized.

F

I would ask for that. Yes,.

F

B

I think I'm practical point here would be what what goes into this. The c 509 draft and what goes into separate drafts and- and maybe others are interested in contributing some of these.

B

B

Adjustment in the interest of of getting something published.

B

B

No need to respond now, just think about it.

A

Yes, thank you for this point indeed interesting thing to consider.

A

Yes, I don't have any preference or opinion on this right now.

C

Yes, one one point could be that csr is needed to deploy this at all, or at least that was, I think, the comment from lawrence, while maybe some deployments don't use, revocation, even if they maybe should so, you could apply, deploy c509 certificates without revocation or use some proprietary revocation mechanisms, which is quite common. In, for example, I think most browsers use some some partly proprietary revocation mechanisms.

F

A yak pro proprietary mechanisms do have a smell, and especially considering that this is an atf group. Could we please stay with the official accepted methods? Please.

C

Pretty please yeah, I'm not arguing that we should um should.

C

Recommend proprietor mechanism- I think I think the important I think all of these it would be good if cbor encoding for all of this would be done. I think the important thing is to decide what what is most urgent. What should we spend our time on the next year to try to specify and what can wait another year.

C

But optimally if people want to help, I think the optimal would be to specify all of this in.

C

C

The conclusion seems to be that the group should long-term specify both certificates, csr, ocsp and crl in seaboard encoding.

A

This is what I hear as.

A

A

Any other thoughts on this topic, or should we move to the next.

C

C

Yeah, I don't think there are any. There are not any more details slides. This is just the overview about uh the issues.

C

So I don't know if, unless somebody has any questions or comments on the draft, I think this presentation is.

A

A

A

Are there any other commands or any other business that you would like to discuss.

G

Evaluate before you go away, I would like to ask you a few questions about yang ziva, which are not inside the material of this working group.

A

Okay, after we officially stop this meeting quick and discussing.

A

Okay, so if not thank you all for your participation and.

A

See you in the next meeting have a nice day.

B

Thank you, bye.