search

anima-wg / constrained-voucher

This is a repo for the IETF Internet Draft about constrained vouchers in CBOR
2 stars 4 forks source link

State if/how x5bag can be used in Pledge's Voucher Request #142

Closed EskoDijk closed 3 years ago

EskoDijk commented 3 years ago

Similar to how a certificate chain can be added into a CMS signing structure, an x5bag with certs can be added into a COSE structure by the Pledge.

This was discussed during the interop/hackathon.

Pro: makes the COSE-signed VR more similar to CMS-signed VR; conceptually the same. And the COSE signed object becomes verifiable as a single unit without needing external data. Con: increases the size of the VR by a lot and is not strictly necessary because the IDevID certs can be obtained by Registrar from observation of the DTLS handshake and these need to be checked anyhow against the VR signing.

One possible resolution is to make this OPTIONAL for Pledge. If present, the Registrar MUST check the x5bag certs against the handshake certs (=same identity) and use that identity to verify the signing of VR.

Another resolution is to NOT include x5bag because it has little added value (if it has, it needs to be made clear here what!) Potential added value:

mcr commented 3 years ago

The value in having the x5bag (could be a chain) in the voucher-request, when it's sitting on disk, is that it makes it clearly self-contained. That seems to have a really high value for unit testing of voucher-request validation libraries.

The text in #150 does forbid the pledge from including it, but as you say, it's wasted bytes. It does tell the Registrar to ignore it that.

I don't buy the MASA and database argument for two reasons. 1) using the public key of pledge (not the certificate itself, but the public key) as the primary index is probably a good idea. (I did it). 2) it's not that many bytes for a non-constrained database to store.

EskoDijk commented 3 years ago

I'm ok with the Registrar ignoring any x5bag contents in the Pledge's voucher request. The Pledge can still be allowed to include something in x5bag because that data will go directly to the MASA and the MASA might use it in some vendor-specific way. That is the same for other non-standard fields in the voucher request that a Pledge may include! The MASA can parse those even though a Registrar would just ignore these.

So the requirement for a Pledge is that it SHOULD NOT include x5bag (exception: if the MASA really needs it and voucher request size is of no concern). The Registrar MUST ignore the x5bag contents.

We need input from @siethower on this because his Pledge was including x5bag I believe?

EskoDijk commented 3 years ago

Text is already included by PR #150 , closing.