Skip to content

Commit

Permalink
Script updating gh-pages from f3a63e8. [ci skip]
Browse files Browse the repository at this point in the history
  • Loading branch information
ID Bot committed Jul 4, 2024
1 parent 9ae38a2 commit 7fa695b
Show file tree
Hide file tree
Showing 2 changed files with 53 additions and 45 deletions.
38 changes: 23 additions & 15 deletions draft-ietf-rats-uccs.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1474,7 +1474,11 @@ <h3 id="name-privacy-preservation">
</h3>
<p id="section-5.2-1">A Secure Channel which preserves the privacy of the Attester may provide
security properties equivalent to COSE, but only inside the life-span of the
session established. In general, when a privacy preserving Secure Channel is employed for conveying a conceptual message the receiver cannot correlate the message with the senders of other received UCCS messages.<a href="#section-5.2-1" class="pilcrow"></a></p>
session established. In general, when a privacy preserving Secure
Channel is employed for conveying a conceptual message, the receiver
cannot correlate the message with the senders of
other received UCCS messages beyond the information the Secure Channel
authentication provides.<a href="#section-5.2-1" class="pilcrow"></a></p>
<p id="section-5.2-2">An Attester must consider whether any UCCS it returns over a privacy
preserving Secure Channel compromises the privacy in unacceptable ways. As
an example, the use of the EAT UEID Claim <span><a href="https://datatracker.ietf.org/doc/html/draft-ietf-rats-eat-28#section-4.2.1" class="relref">Section 4.2.1</a> of [<a href="#I-D.ietf-rats-eat" class="cite xref">I-D.ietf-rats-eat</a>]</span> in UCCS over a privacy
Expand Down Expand Up @@ -1710,7 +1714,8 @@ <h2 id="name-security-considerations">
</h2>
<p id="section-7-1">The security considerations of <span>[<a href="#RFC8949" class="cite xref">RFC8949</a>]</span> apply.
The security considerations of <span>[<a href="#RFC8392" class="cite xref">RFC8392</a>]</span> need to be applied analogously,
replacing the function of COSE with that of the Secure Channel.<a href="#section-7-1" class="pilcrow"></a></p>
replacing the function of COSE with that of the Secure Channel; in
particular "it is not only important to protect the CWT in transit but also to ensure that the recipient can authenticate the party that assembled the claims and created the CWT".<a href="#section-7-1" class="pilcrow"></a></p>
<p id="section-7-2"><a href="#secchan" class="auto internal xref">Section 3</a> discusses security considerations for Secure Channels, in which
UCCS might be used.
This document provides the CBOR tag definition for UCCS and a discussion
Expand Down Expand Up @@ -1966,23 +1971,26 @@ <h3 id="name-informative-references">
<h2 id="name-cddl">
<a href="#appendix-A" class="section-number selfRef">Appendix A. </a><a href="#name-cddl" class="section-name selfRef">CDDL</a>
</h2>
<p id="appendix-A-1">The Concise Data Definition Language (CDDL), as defined in <span>[<a href="#RFC8610" class="cite xref">RFC8610</a>]</span> and
<p id="appendix-A-1">This appendix is informative.<a href="#appendix-A-1" class="pilcrow"></a></p>
<p id="appendix-A-2">The Concise Data Definition Language (CDDL), as defined in <span>[<a href="#RFC8610" class="cite xref">RFC8610</a>]</span> and
<span>[<a href="#RFC9165" class="cite xref">RFC9165</a>]</span>, provides an easy and unambiguous way to express
structures for protocol messages and data formats that use CBOR or
JSON.<a href="#appendix-A-1" class="pilcrow"></a></p>
<p id="appendix-A-2"><span>[<a href="#RFC8392" class="cite xref">RFC8392</a>]</span> does not define CDDL for CWT Claims Sets.<a href="#appendix-A-2" class="pilcrow"></a></p>
<p id="appendix-A-3"><span class="cref" id="cpa601">RFC-Editor: This document uses the CPA (code point allocation)
JSON.<a href="#appendix-A-2" class="pilcrow"></a></p>
<p id="appendix-A-3"><span>[<a href="#RFC8392" class="cite xref">RFC8392</a>]</span> does not define CDDL for CWT Claims Sets.<a href="#appendix-A-3" class="pilcrow"></a></p>
<p id="appendix-A-4"><span class="cref" id="cpa601">RFC-Editor: This document uses the CPA (code point allocation)
convention described in [I-D.bormann-cbor-draft-numbers].
Please replace the number 601 in the code blocks below by the
value that has been assigned for CPA601 and remove this note.</span><a href="#appendix-A-3" class="pilcrow"></a></p>
<p id="appendix-A-4">This specification proposes using the definitions in <a href="#fig-claims-set" class="auto internal xref">Figure 1</a>
for the CWT Claims Set defined in <span>[<a href="#RFC8392" class="cite xref">RFC8392</a>]</span>. Note that these definitions
value that has been assigned for CPA601 and remove this note.</span><a href="#appendix-A-4" class="pilcrow"></a></p>
<p id="appendix-A-5">In <a href="#fig-claims-set" class="auto internal xref">Figure 1</a>,
this specification shows how to use CDDL
for defining the CWT Claims Set defined in <span>[<a href="#RFC8392" class="cite xref">RFC8392</a>]</span>.
Note that these CDDL rules
have been built such that they also can describe <span>[<a href="#RFC7519" class="cite xref">RFC7519</a>]</span> Claims sets by
disabling feature "cbor" and enabling feature "json", but this
flexibility is not the subject of the present specification.<a href="#appendix-A-4" class="pilcrow"></a></p>
flexibility is not the subject of the present specification.<a href="#appendix-A-5" class="pilcrow"></a></p>
<span id="name-cddl-definition-for-claims-"></span><div id="fig-claims-set">
<figure id="figure-1">
<div class="lang-cddl sourcecode" id="appendix-A-5.1">
<div class="lang-cddl sourcecode" id="appendix-A-6.1">
<pre>
UCCS-Untagged = Claims-Set
UCCS-Tagged = #6.601(UCCS-Untagged)
Expand Down Expand Up @@ -2019,9 +2027,9 @@ <h2 id="name-cddl">
<a href="#name-cddl-definition-for-claims-" class="selfRef">CDDL definition for Claims-Set</a>
</figcaption></figure>
</div>
<p id="appendix-A-6">Specifications that define additional Claims should also supply
additions to the $$Claims-Set-Claims socket, e.g.:<a href="#appendix-A-6" class="pilcrow"></a></p>
<div class="lang-cddl sourcecode" id="appendix-A-7">
<p id="appendix-A-7">Specifications that define additional Claims should also supply
additions to the $$Claims-Set-Claims socket, e.g.:<a href="#appendix-A-7" class="pilcrow"></a></p>
<div class="lang-cddl sourcecode" id="appendix-A-8">
<pre>
; [RFC8747]
$$Claims-Set-Claims //= ( 8: CWT-cnf ) ; cnf
Expand All @@ -2039,7 +2047,7 @@ <h2 id="name-cddl">
;;; definitions. This can be done manually or automated by a
;;; tool that implements an import directive such as:
;# import rfc9052
</pre><a href="#appendix-A-7" class="pilcrow"></a>
</pre><a href="#appendix-A-8" class="pilcrow"></a>
</div>
</section>
</div>
Expand Down
60 changes: 30 additions & 30 deletions draft-ietf-rats-uccs.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ Table of Contents
5. Considerations for Using UCCS in Other RATS Contexts . . . . 7
5.1. Delegated Attestation . . . . . . . . . . . . . . . . . . 7
5.2. Privacy Preservation . . . . . . . . . . . . . . . . . . 7
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8
6.1. CBOR Tag registration . . . . . . . . . . . . . . . . . . 8
6.2. Media-Type application/uccs+cbor Registration . . . . . . 8
6.3. Content-Format registration . . . . . . . . . . . . . . . 9
Expand All @@ -99,9 +99,9 @@ Table of Contents
7.3. AES-GCM . . . . . . . . . . . . . . . . . . . . . . . . . 11
7.4. AES-CCM . . . . . . . . . . . . . . . . . . . . . . . . . 11
7.5. ChaCha20 and Poly1305 . . . . . . . . . . . . . . . . . . 11
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 11
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 12
8.1. Normative References . . . . . . . . . . . . . . . . . . 12
8.2. Informative References . . . . . . . . . . . . . . . . . 12
8.2. Informative References . . . . . . . . . . . . . . . . . 13
Appendix A. CDDL . . . . . . . . . . . . . . . . . . . . . . . . 14
Appendix B. Example . . . . . . . . . . . . . . . . . . . . . . 16
Appendix C. JSON Support . . . . . . . . . . . . . . . . . . . . 16
Expand Down Expand Up @@ -371,8 +371,9 @@ Internet-Draft Unprotected CWT Claims Sets July 2024
provide security properties equivalent to COSE, but only inside the
life-span of the session established. In general, when a privacy
preserving Secure Channel is employed for conveying a conceptual
message the receiver cannot correlate the message with the senders of
other received UCCS messages.
message, the receiver cannot correlate the message with the senders
of other received UCCS messages beyond the information the Secure
Channel authentication provides.

An Attester must consider whether any UCCS it returns over a privacy
preserving Secure Channel compromises the privacy in unacceptable
Expand All @@ -384,7 +385,6 @@ Internet-Draft Unprotected CWT Claims Sets July 2024
physical sensor in a factory) and unacceptable in others (e.g., if
the Attesting Environment is a user device belonging to a child).

6. IANA Considerations



Expand All @@ -394,6 +394,8 @@ Birkholz, et al. Expires 5 January 2025 [Page 7]
Internet-Draft Unprotected CWT Claims Sets July 2024


6. IANA Considerations

6.1. CBOR Tag registration

In the CBOR Tags registry [IANA.cbor-tags] as defined in Section 9.2
Expand Down Expand Up @@ -440,8 +442,6 @@ Internet-Draft Unprotected CWT Claims Sets July 2024
Security considerations: Section 7 of RFCthis
Interoperability considerations: none
Published specification: RFCthis
Applications that use this media type: Applications that transfer
Unprotected CWT Claims Set(s) (UCCS) over Secure Channels



Expand All @@ -450,6 +450,8 @@ Birkholz, et al. Expires 5 January 2025 [Page 8]
Internet-Draft Unprotected CWT Claims Sets July 2024


Applications that use this media type: Applications that transfer
Unprotected CWT Claims Set(s) (UCCS) over Secure Channels
Fragment identifier considerations: The syntax and semantics of
fragment identifiers is as specified for "application/cbor". (At
publication of this document, there is no fragment identification
Expand Down Expand Up @@ -487,17 +489,15 @@ Internet-Draft Unprotected CWT Claims Sets July 2024

The security considerations of [RFC8949] apply. The security
considerations of [RFC8392] need to be applied analogously, replacing
the function of COSE with that of the Secure Channel.
the function of COSE with that of the Secure Channel; in particular
"it is not only important to protect the CWT in transit but also to
ensure that the recipient can authenticate the party that assembled
the claims and created the CWT".

Section 3 discusses security considerations for Secure Channels, in
which UCCS might be used. This document provides the CBOR tag
definition for UCCS and a discussion on security consideration for
the use of UCCS in RATS. Uses of UCCS outside the scope of RATS are
not covered by this document. The UCCS specification -- and the use
of the UCCS CBOR tag, correspondingly -- is not intended for use in a
scope where a scope-specific security consideration discussion has
not been conducted, vetted and approved for that use. In order to be
able to use the UCCS CBOR tag in another such scope, the secure



Expand All @@ -506,6 +506,11 @@ Birkholz, et al. Expires 5 January 2025 [Page 9]
Internet-Draft Unprotected CWT Claims Sets July 2024


not covered by this document. The UCCS specification -- and the use
of the UCCS CBOR tag, correspondingly -- is not intended for use in a
scope where a scope-specific security consideration discussion has
not been conducted, vetted and approved for that use. In order to be
able to use the UCCS CBOR tag in another such scope, the secure
channel and/or the application protocol (e.g., TLS and the protocol
identified by ALPN) MUST specify the roles of the endpoints in a
fashion that the security properties of conveying UCCS via a Secure
Expand Down Expand Up @@ -549,11 +554,6 @@ Internet-Draft Unprotected CWT Claims Sets July 2024
* Ensuring that appropriate protections are in place to address
potential traffic analysis attacks.

The remaining subsections of this section highlight some aspects of
specific cryptography choices that are detailed further in [RFC9053].






Expand All @@ -562,6 +562,9 @@ Birkholz, et al. Expires 5 January 2025 [Page 10]
Internet-Draft Unprotected CWT Claims Sets July 2024


The remaining subsections of this section highlight some aspects of
specific cryptography choices that are detailed further in [RFC9053].

7.2. AES-CBC_MAC

* A given key should only be used for messages of fixed or known
Expand Down Expand Up @@ -608,16 +611,15 @@ Internet-Draft Unprotected CWT Claims Sets July 2024
Section 4.3.1 of [RFC9053] contains a detailed explanation of these
considerations.

8. References




Birkholz, et al. Expires 5 January 2025 [Page 11]

Internet-Draft Unprotected CWT Claims Sets July 2024


8. References

8.1. Normative References

[IANA.cbor-tags]
Expand Down Expand Up @@ -665,15 +667,15 @@ Internet-Draft Unprotected CWT Claims Sets July 2024
DOI 10.17487/RFC9165, December 2021,
<https://www.rfc-editor.org/rfc/rfc9165>.

8.2. Informative References



Birkholz, et al. Expires 5 January 2025 [Page 12]

Internet-Draft Unprotected CWT Claims Sets July 2024


8.2. Informative References

[I-D.ietf-rats-eat]
Lundblade, L., Mandyam, G., O'Donoghue, J., and C.
Wallace, "The Entity Attestation Token (EAT)", Work in
Expand Down Expand Up @@ -723,8 +725,6 @@ Internet-Draft Unprotected CWT Claims Sets July 2024





Birkholz, et al. Expires 5 January 2025 [Page 13]

Internet-Draft Unprotected CWT Claims Sets July 2024
Expand All @@ -746,6 +746,8 @@ Internet-Draft Unprotected CWT Claims Sets July 2024

Appendix A. CDDL

This appendix is informative.

The Concise Data Definition Language (CDDL), as defined in [RFC8610]
and [RFC9165], provides an easy and unambiguous way to express
structures for protocol messages and data formats that use CBOR or
Expand All @@ -759,8 +761,8 @@ Appendix A. CDDL
// replace the number 601 in the code blocks below by the value that
// has been assigned for CPA601 and remove this note.

This specification proposes using the definitions in Figure 1 for the
CWT Claims Set defined in [RFC8392]. Note that these definitions
In Figure 1, this specification shows how to use CDDL for defining
the CWT Claims Set defined in [RFC8392]. Note that these CDDL rules
have been built such that they also can describe [RFC7519] Claims
sets by disabling feature "cbor" and enabling feature "json", but
this flexibility is not the subject of the present specification.
Expand All @@ -779,8 +781,6 @@ Appendix A. CDDL





Birkholz, et al. Expires 5 January 2025 [Page 14]

Internet-Draft Unprotected CWT Claims Sets July 2024
Expand Down

0 comments on commit 7fa695b

Please sign in to comment.