search

ace-wg / est-oscore

Other
0 stars 0 forks source link

Clarify that EDHOC may need to be re-run for re-enrollment #64

Open malishav opened 2 months ago

malishav commented 2 months ago

Based on @EskoDijk 's review in https://mailarchive.ietf.org/arch/msg/ace/I70MHcCzSfPIy28lDqxEOcllgJw/:

  1. Authentication

During initial enrollment … payloads.

Is EDHOC only run during the initial / first enrollment – and then never again? Or does it in some cases need to be “refreshed” before doing a re-enrollment?

malishav commented 2 weeks ago

OLD:

During initial enrollment, the EST-oscore client and server run EDHOC [RFC9528] to authenticate and establish the OSCORE Security Context used to protect the messages carrying EST payloads.

NEW:

The enrollment using EST-oscore is based on the existence of an OSCORE Security Context protecting the EST payloads. This Security Context is typically established through an EDHOC session preceding the initial enrollment. Re-enrollment does not require a new EDHOC session.