COMMENT:

Internet AD comments for draft-ietf-lake-edhoc-20

CC @ekline

comment syntax:
- https://github.com/mnot/ietf-comments/blob/main/format.md
"Handling Ballot Positions":
- https://ietf.org/about/groups/iesg/statements/handling-ballot-positions/

Comments

S6.2

I'm not sure about "MUST be ... written in English". Does it not suffice to say "MUST be a human-readable string" and "SHOULD be English", since the exact written language is not protocol-critical?

Appendix B

Do any of the Certicom patents as notified to SECG:

https://www.secg.org/certicom_patent_letter_SECG.pdf

apply the text in this section? If so, has the working group been made aware and collectively agreed to proceed?

I just found this linked off the https://www.secg.org/ site and it seemed to mention "point compression", but I'm not really qualified to make any reasonable assessment about whether readers of this I-D should be made aware of this stuff or not.

Nits

S3.3.2

Figure 5 could make it more clear that the CBOR encoding values are in hex (right?)

S3.9

"because of wrong credential"

Either "because of wrong credentials" or maybe "because of a wrong credential" might read better.

S5.2.2, S5.3.2, S5.4.2, S5.5.2

I found the use of "Processing" in the section heading to somewhat misleading. I don't think of the sender as "processing" a message that it's going to send. Perhaps, "Preparation" or "Composition" might be more natural?

Appendix D.5

You might be asked by the Editor about alternative language for "man-in-the-middle" (e.g., "on-path attacker" or something).

emanjon commented 1 year ago

Regarding ECC IPR. We are not not aware of any IPR that apply to the draft. This topic has been discussed several times in the working group. EDHOC does not use "point compression", EDHOC just throws away the y-coordinate which is known as "compact representation" and works for ECDH but not for ECDSA. The remaining x-coordinate is no longer a point. All the patents on point compression has expired, the last one in 2018 [1]. We are not aware of any patents (expired or not) on "compact representation".

[1] https://en.wikipedia.org/wiki/ECC_patents

gselander commented 1 year ago

Do any of the Certicom patents as notified to SECG:

https://www.secg.org/certicom_patent_letter_SECG.pdf

apply the text in this section? If so, has the working group been made aware and collectively agreed to proceed?

I just found this linked off the https://www.secg.org/ site and it seemed to mention "point compression", but I'm not really qualified to make any reasonable assessment about whether readers of this I-D should be made aware of this stuff or not.

EDHOC does not use "point compression", EDHOC just throws away the y-coordinate, which is called "compact representation" and works for ECDHE but not for ECDSA. What remains is no longer a point but an x-coordinate. Furthermore, to our knowledge, all patents on point compression has expired, the last one in 2018 [1]. This topic has been discussed several times in the working group, and there has not been anyone declaring awareness of IPR (expired or not) on "compact representation" or other techniques used.