Coordinating the Use of Application Profiles for Ephemeral Diffie-Hellman Over COSE (EDHOC)

1.1. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

The reader is expected to be familiar with terms and concepts defined in EDHOC [RFC9528], and with the use of EDHOC with CoAP [RFC7252] and OSCORE [RFC8613] defined in [I-D.ietf-core-oscore-edhoc].¶

Concise Binary Object Representation (CBOR) [RFC8949] and Concise Data Definition Language (CDDL) [RFC8610] are used in this document. CDDL predefined type names, especially bstr for CBOR byte strings and tstr for CBOR text strings, are used extensively in this document.¶

CBOR data items are represented using the CBOR extended diagnostic notation as defined in Section 8 of [RFC8949] and Appendix G of [RFC8610] ("diagnostic notation"). Diagnostic notation comments are used to provide a textual representation of the parameters' keys and values.¶

In the CBOR diagnostic notation used in this document, constructs of the form e'SOME_NAME' are replaced by the value assigned to SOME_NAME in the CDDL model shown in Figure 2 of Appendix A. For example, {e'methods' : [0, 1, 2, 3], e'cipher_suites': 3} stands for {1 : [0, 1, 2, 3], 2 : 3}.¶

Note to RFC Editor: Please delete the paragraph immediately preceding this note. Also, in the CBOR diagnostic notation used in this document, please replace the constructs of the form e'SOME_NAME' with the value assigned to SOME_NAME in the CDDL model shown in Figure 2 of Appendix A. Finally, please delete this note.¶

2.1. Web Linking

Section 6 of [I-D.ietf-core-oscore-edhoc] defines a number of target attributes that can be used in a web link [RFC8288] with resource type "core.edhoc" (see Section 10.10 of [RFC9528]). This is the case, e.g., when using a link-format document [RFC6690] describing EDHOC resources at a server, when EDHOC is transferred over CoAP [RFC7252] as defined in Appendix A.2 of [RFC9528]. This allows a client to obtain relevant information about the EDHOC application profile(s) to be used with a certain EDHOC resource.¶

In the same spirit, this section defines the following additional parameter, which can be optionally specified as a target attribute with the same name in the link to the respective EDHOC resource, or among the filter criteria in a discovery request from a client.¶

• 'ed-prof', specifying an EDHOC application profile supported by the server. This parameter MUST specify a single value, which is taken from the 'Profile ID' column of the "EDHOC Application Profiles" registry defined in Section 11.5 of this document. This parameter MAY occur multiple times, with each occurrence specifying an EDHOC application profile.¶

When specifying the parameter 'ed-prof' in a link to an EDHOC resource, the target attribute rt="core.edhoc" MUST be included.¶

If a link to an EDHOC resource includes occurrences of the target attribute 'ed-prof', then the following applies.¶

• The link MUST NOT include other target attributes that provide information about an EDHOC application profile (see, e.g., Section 6 of [I-D.ietf-core-oscore-edhoc] and Section 3 of this document), with the exception of the target attribute 'ed-ead' that MAY be included.¶

  The recipient MUST ignore other target attributes that provide information about an EDHOC application profile, with the exception of the target attribute 'ed-ead'.¶

• If the link includes occurrences of the target attribute 'ed-ead', the link provides the following information: when using the target EDHOC resource as per the EDHOC application profile indicated by any occurrence of the target attribute 'ed-prof', the server supports the EAD items that are specified in the definition of that EDHOC application profile, as well as the EAD items indicated by the occurrences of the target attribute 'ed-ead'.¶

The example in Figure 1 shows how a CoAP client discovers two EDHOC resources at a CoAP server, and obtains information about the application profile corresponding to each of those resources. The Link Format notation from Section 5 of [RFC6690] is used.¶

The example assumes the existence of an EDHOC application profile identified by the integer Profile ID 500, which is supported by the EDHOC resource at /edhoc-alt and whose definition includes the support for the EAD items with EAD label 111 and 222.¶

Therefore, the link to the EDHOC resource at /edhoc-alt indicates that, when using that EDHOC resource as per the EDHOC application profile with Profile ID 500, the server supports the EAD items with EAD label 111, 222, and 333.¶

REQ: GET /.well-known/core

RES: 2.05 Content
    </sensors/temp>;osc,
    </sensors/light>;if=sensor,
    </.well-known/edhoc>;rt=core.edhoc;ed-csuite=0;ed-csuite=2;
        ed-method=0;ed-cred-t=1;ed-cred-t=3;ed-idcred-t=4;
        ed-i;ed-r;ed-comb-req,
    </edhoc-alt>;rt=core.edhoc;ed-prof=500;ed-ead=333

2.2. EDHOC_Information Object

Section 3.4 of [I-D.ietf-ace-edhoc-oscore-profile] defines the EDHOC_Information object, as including information that guides two peers towards executing the EDHOC protocol, and defines an initial set of its parameters.¶

This document defines the new parameter "app_prof" of the EDHOC_Information object, as summarized in Table 1 and described further below.¶

• app_prof: This parameter specifies a set of supported EDHOC application profiles, identified by their Profile ID. If the set is composed of a single EDHOC application profile, its Profile ID is encoded as an integer. Otherwise, the set is encoded as an array of integers, where each array element encodes one Profile ID. In JSON, the "app_prof" value is an integer or an array of integers. In CBOR, "app_prof" is an integer or an array of integers, and has label 18. The integer values are taken from the 'Profile ID' column of the "EDHOC Application Profiles" registry defined in Section 11.5 of this document.¶

6.1. Well-Known Application Profile WK-MINIMAL_CS_2

{
        e'methods' : 3, / EDHOC Method Type 3 /
  e'cipher_suites' : 2, / EDHOC Cipher Suite 2 /
     e'cred_types' : 1, / CWT Claims Set (CCS) /
  e'id_cred_types' : 4, / kid /
       e'app_prof' : e'APP-PROF-WK-MINIMAL-CS-2'
}

This application profile is aligned with the example trace of EDHOC compiled in Section 3 of [RFC9529].¶

6.2. Well-Known Application Profile WK-MINIMAL_CS_0

{
        e'methods' : 3, / EDHOC Method Type 3 /
  e'cipher_suites' : 0, / EDHOC Cipher Suite 0 /
     e'cred_types' : 1, / CWT Claims Set (CCS) /
  e'id_cred_types' : 4, / kid /
       e'app_prof' : e'APP-PROF-WK-MINIMAL-CS-0'
}

6.3. Well-Known Application Profile WK-BASIC_CS_2_X509

{
        e'methods' : [0, 3], / EDHOC Method Types 0 and 3 /
  e'cipher_suites' : 2, / EDHOC Cipher Suite 2 /
     e'cred_types' : [1, 2], / CWT Claims Set (CCS)
                               and X.509 certificate /
  e'id_cred_types' : [4, 34], / kid and x5t /
       e'app_prof' : e'APP-PROF-WK-BASIC-CS-2-X509'
}

This application profile is aligned with the example trace of EDHOC compiled in Section 3 of [RFC9529].¶

6.4. Well-Known Application Profile WK-BASIC_CS_0_X509

{
        e'methods' : [0, 3], / EDHOC Method Types 0 and 3 /
  e'cipher_suites' : 0, / EDHOC Cipher Suite 0 /
     e'cred_types' : [1, 2], / CWT Claims Set (CCS)
                               and X.509 certificate /
  e'id_cred_types' : [4, 34], / kid and x5t /
       e'app_prof' : e'APP-PROF-WK-BASIC-CS-0-X509'
}

This application profile is aligned with the example trace of EDHOC compiled in Section 2 of [RFC9529].¶

6.5. Well-Known Application Profile WK-BASIC_CS_2_C509

{
        e'methods' : [0, 3], / EDHOC Method Types 0 and 3 /
  e'cipher_suites' : 2, / EDHOC Cipher Suite 2 /
     e'cred_types' : [1, e'c509_cert'], / CWT Claims Set (CCS)
                                          and C509 certificate /
  e'id_cred_types' : [4, e'c5t'], / kid and c5t /
       e'app_prof' : e'APP-PROF-WK-BASIC-CS-2-C509'
}

6.6. Well-Known Application Profile WK-BASIC_CS_0_C509

{
        e'methods' : [0, 3], / EDHOC Method Types 0 and 3 /
  e'cipher_suites' : 0, / EDHOC Cipher Suite 0 /
     e'cred_types' : [1, e'c509_cert'], / CWT Claims Set (CCS)
                                          and C509 certificate /
  e'id_cred_types' : [4, e'c5t'], / kid and c5t /
       e'app_prof' : e'APP-PROF-WK-BASIC-CS-0-C509'
}

6.7. Well-Known Application Profile WK-INTERMEDIATE_CS_2

{
        e'methods' : [0, 3], / EDHOC Method Types 0 and 3 /
  e'cipher_suites' : 2, / EDHOC Cipher Suite 2 /
     e'cred_types' : [1, 2, e'c509_cert'], / CWT Claims Set (CCS),
                                             X.509 certificate,
                                             and C509 certificate /
  e'id_cred_types' : [4, 14, 34, 33, e'c5t', e'c5c'], / kid, kccs,
                                                        x5t, x5chain,
                                                        c5t, and c5c /
       e'app_prof' : e'APP-PROF-WK-INTERMEDIATE-CS-2'
}

This application profile is aligned with the example trace of EDHOC compiled in Section 3 of [RFC9529].¶

6.8. Well-Known Application Profile WK-INTERMEDIATE_CS_0

{
        e'methods' : [0, 3], / EDHOC Method Types 0 and 3 /
  e'cipher_suites' : 0, / EDHOC Cipher Suite 0 /
     e'cred_types' : [1, 2, e'c509_cert'], / CWT Claims Set (CCS),
                                             X.509 certificate,
                                             and C509 certificate /
  e'id_cred_types' : [4, 14, 34, 33, e'c5t', e'c5c'], / kid, kccs,
                                                        x5t, x5chain,
                                                        c5t, and c5c /
       e'app_prof' : e'APP-PROF-WK-INTERMEDIATE-CS-0'
}

This application profile is aligned with the example trace of EDHOC compiled in Section 2 of [RFC9529].¶

6.9. Well-Known Application Profile WK-ADVANCED

{
        e'methods' : [0, 1, 2, 3], / EDHOC Method Types
                                     0, 1, 2, and 3 /
  e'cipher_suites' : [0, 1, 2, 3], / EDHOC Cipher Suites
                                     0, 1, 2, and 3 /
     e'cred_types' : [1, 0, 2, e'c509_cert'], / CWT Claims Set (CCS),
                                                CWT, X.509 certificate,
                                                and C509 certificate /
  e'id_cred_types' : [4, 14, 13, 34, 33, e'c5t', e'c5c'], / kid, kccs,
                                                            kcwt, x5t,
                                                            x5chain,
                                                            c5t, and
                                                            c5c /
       e'app_prof' : e'APP-PROF-WK-ADVANCED'
}

This application profile is aligned with the example traces of EDHOC compiled in Sections 2 and 3 of [RFC9529].¶

11.1. Media Type Registrations

IANA is asked to register the media type "application/edhoc-app-profile+cbor-seq". This registration follows the procedures specified in [RFC6838].¶

Type name: application¶

Subtype name: edhoc-app-profile+cbor-seq¶

Required parameters: N/A¶

Optional parameters: N/A¶

Encoding considerations: Must be encoded as a CBOR sequence [RFC8742] of CBOR maps [RFC8949]. Each element of each CBOR map is also defined as an element of the CBOR-encoded EDHOC_Information object from Section 3.4 of [I-D.ietf-ace-edhoc-oscore-profile].¶

Security considerations: See Section 10 of [RFC-XXXX].¶

Interoperability considerations: N/A¶

Published specification: [RFC-XXXX]¶

Applications that use this media type: Applications that need to describe, distribute, and store a representation of an EDHOC application profile (see Section 3.9 of [RFC9528]).¶

Fragment identifier considerations: N/A¶

Additional information: N/A¶

Person & email address to contact for further information: LAKE WG mailing list ([email protected]) or IETF Applications and Real-Time Area ([email protected])¶

Intended usage: COMMON¶

Restrictions on usage: None¶

Author/Change controller: IETF¶

Provisional registration: No¶

11.2. CoAP Content-Formats Registry

IANA is asked to add the following entry to the "CoAP Content-Formats" registry within the "Constrained RESTful Environments (CoRE) Parameters" registry group.¶

Content Type: application/edhoc-app-profile+cbor-seq¶

Content Coding: -¶

ID: TBD¶

Reference: [RFC-XXXX]¶

11.3. Target Attributes Registry

IANA is asked to register the following entries in the "Target Attributes" registry within the "Constrained RESTful Environments (CoRE) Parameters", as per [RFC9423].¶

• Attribute Name: ed-max-msgsize¶

• Brief Description: The admitted maximum size of EDHOC messages in bytes¶

• Change Controller: IETF¶

• Reference: [RFC-XXXX]¶

• Attribute Name: ed-coap-cf¶

• Brief Description: Requested use of the CoAP Content-Format Option in CoAP messages whose payload includes exclusively an EDHOC message, possibly prepended by an EDHOC connection identifier¶

• Change Controller: IETF¶

• Reference: [RFC-XXXX]¶

• Attribute Name: ed-idep-t¶

• Brief Description: A supported type of endpoint identity for EDHOC¶

• Change Controller: IETF¶

• Reference: [RFC-XXXX]¶

• Attribute Name: ed-tp¶

• Brief Description: A supported means for transporting EDHOC messages¶

• Change Controller: IETF¶

• Reference: [RFC-XXXX]¶

• Attribute Name: ed-prof¶

• Brief Description: A supported EDHOC application profile¶

• Change Controller: IETF¶

• Reference: [RFC-XXXX]¶

11.4. EDHOC Information Registry

IANA is asked to register the following entries in the "EDHOC Information" registry defined in [I-D.ietf-ace-edhoc-oscore-profile].¶

• Name: max_msgsize¶

• CBOR label: 14¶

• CBOR type: uint¶

• Registry:¶

• Description: The admitted maximum size of EDHOC messages in bytes¶

• Specification: [RFC-XXXX][RFC9528]¶

• Name: coap_cf¶

• CBOR label: 15¶

• CBOR type: True or False¶

• Registry:¶

• Description: Requested use of the CoAP Content-Format Option in CoAP messages whose payload includes exclusively an EDHOC message, possibly prepended by an EDHOC connection identifier¶

• Specification: [RFC-XXXX][RFC9528]¶

• Name: id_ep_types¶

• CBOR label: 16¶

• CBOR type: int or array¶

• Registry: EDHOC Endpoint Identity Types¶

• Description: Set of supported types of endpoint identities for EDHOC¶

• Specification: [RFC-XXXX]¶

• Name: transports¶

• CBOR label: 17¶

• CBOR type: int or array¶

• Registry: EDHOC Transports Registry¶

• Description: Set of supported means for transporting EDHOC messages¶

• Specification: [RFC-XXXX]¶

• Name: app_prof¶

• CBOR label: 18¶

• CBOR type: int or array¶

• Registry: EDHOC Application Profiles Registry¶

• Description: Set of supported EDHOC Application Profiles¶

• Specification: [RFC-XXXX][RFC9528]¶

11.5. EDHOC Application Profiles Registry

IANA is requested to create a new "EDHOC Application Profiles" registry within the "Ephemeral Diffie-Hellman Over COSE (EDHOC)" registry group defined in [RFC9528].¶

The registration policy is either "Private Use", "Standards Action with Expert Review", or "Specification Required" per Section 4.6 of [RFC8126]. "Expert Review" guidelines are provided in Section 11.8.¶

All assignments according to "Standards Action with Expert Review" are made on a "Standards Action" basis per Section 4.9 of [RFC8126], with Expert Review additionally required per Section 4.5 of [RFC8126]. The procedure for early IANA allocation of Standards Track code points defined in [RFC7120] also applies. When such a procedure is used, IANA will ask the designated expert(s) to approve the early allocation before registration. In addition, WG chairs are encouraged to consult the expert(s) early during the process outlined in Section 3.1 of [RFC7120].¶

The columns of this registry are:¶

• Profile ID: This field contains the value used to identify the EDHOC application profile. These values MUST be unique. The value can be a positive integer or a negative integer. Different ranges of values use different registration policies [RFC8126]. Integer values from -24 to 23 are designated as "Standards Action With Expert Review". Integer values from -65536 to -25 and from 24 to 65535 are designated as "Specification Required". Integer values smaller than -65536 and greater than 65535 are marked as "Private Use".¶

• Name: This field contains the name of the EDHOC application profile.¶

• Description: This field contains a short description of the EDHOC application profile.¶

• Reference: This field contains a pointer to the public specification for the EDHOC application profile.¶

This registry has been initially populated with the values in Table 3.¶

11.6. EDHOC Endpoint Identity Types Registry

IANA is requested to create a new "EDHOC Endpoint Identity Types" registry within the "Ephemeral Diffie-Hellman Over COSE (EDHOC)" registry group defined in [RFC9528].¶

The registration policy is either "Private Use", "Standards Action with Expert Review", or "Specification Required" per Section 4.6 of [RFC8126]. "Expert Review" guidelines are provided in Section 11.8.¶

All assignments according to "Standards Action with Expert Review" are made on a "Standards Action" basis per Section 4.9 of [RFC8126], with Expert Review additionally required per Section 4.5 of [RFC8126]. The procedure for early IANA allocation of Standards Track code points defined in [RFC7120] also applies. When such a procedure is used, IANA will ask the designated expert(s) to approve the early allocation before registration. In addition, WG chairs are encouraged to consult the expert(s) early during the process outlined in Section 3.1 of [RFC7120].¶

The columns of this registry are:¶

• Name: This field contains the name of the EDHOC endpoint identity type.¶

• CBOR Label: The value to be used to identify this EDHOC endpoint identity type. These values MUST be unique. The value can be a positive integer or a negative integer. Different ranges of values use different registration policies [RFC8126]. Integer values from -24 to 23 are designated as "Standards Action With Expert Review". Integer values from -65536 to -25 and from 24 to 65535 are designated as "Specification Required". Integer values smaller than -65536 and greater than 65535 are marked as "Private Use".¶

• Description: This field contains a short description of the EDHOC endpoint identity type.¶

• Reference: This field contains a pointer to the public specification for the EDHOC endpoint identity type.¶

This registry has been initially populated with the values in Table 4.¶

11.7. EDHOC Transport Registry

IANA is requested to create a new "EDHOC Transport" registry within the "Ephemeral Diffie-Hellman Over COSE (EDHOC)" registry group defined in [RFC9528].¶

The registration policy is either "Private Use", "Standards Action with Expert Review", or "Specification Required" per Section 4.6 of [RFC8126]. "Expert Review" guidelines are provided in Section 11.8.¶

All assignments according to "Standards Action with Expert Review" are made on a "Standards Action" basis per Section 4.9 of [RFC8126], with Expert Review additionally required per Section 4.5 of [RFC8126]. The procedure for early IANA allocation of Standards Track code points defined in [RFC7120] also applies. When such a procedure is used, IANA will ask the designated expert(s) to approve the early allocation before registration. In addition, WG chairs are encouraged to consult the expert(s) early during the process outlined in Section 3.1 of [RFC7120].¶

The columns of this registry are:¶

• Transport ID: The value to be used to identify this means for transporting EDHOC messages. These values MUST be unique. The value can be a positive integer or a negative integer. Different ranges of values use different registration policies [RFC8126]. Integer values from -24 to 23 are designated as "Standards Action With Expert Review". Integer values from -65536 to -25 and from 24 to 65535 are designated as "Specification Required". Integer values smaller than -65536 and greater than 65535 are marked as "Private Use".¶

• Name: This field contains the name of the means for transporting EDHOC messages.¶

• Description: This field contains a short description of the means used for transporting EDHOC messages.¶

• Reference: This field contains a pointer to the public specification for the means used for transporting EDHOC messages.¶

This registry has been initially populated with the values in Table 5.¶

11.8. Expert Review Instructions

"Standards Action with Expert Review" and "Specification Required" are two of the registration policies defined for the IANA registries established in this document. This section gives some general guidelines for what the experts should be looking for, but they are being designated as experts for a reason so they should be given substantial latitude.¶

Expert reviewers should take into consideration the following points:¶

• Clarity and correctness of registrations. Experts are expected to check the clarity of purpose and use of the requested entries. Experts need to make sure that the object of registration (i.e., an EDHOC application profile, an EDHOC endpoint identity type, or a means for transporting EDHOC messages) is clearly defined in the corresponding specification. Entries that do not meet these objective of clarity and completeness must not be registered.¶

• Point squatting should be discouraged. Reviewers are encouraged to get sufficient information for registration requests to ensure that the usage is not going to duplicate one that is already registered and that the point is likely to be used in deployments. The zones tagged as "Private Use" are intended for testing purposes and closed environments. Code points in other ranges should not be assigned for testing.¶

• Specifications are required for the "Standards Action With Expert Review" range of point assignment. Specifications should exist for "Specification Required" ranges, but early assignment before a specification is available is considered to be permissible. When specifications are not provided, the description provided needs to have sufficient information to identify what the point is being used for.¶

• Experts should take into account the expected usage of fields when approving point assignment. Documents published via Standards Action can also register points outside the Standards Action range. The length of the encoded value should be weighed against how many code points of that length are left, the size of device it will be used on, and the number of code points left that encode to that size.¶