A server that sends large responses to unauthenticated peers SHOULD mitigate amplification attacks such as described in Section 11.3 of RFC7252 (where an attacker would put a victim's <del> address in the source address of a CoAP request).  The RECOMMENDED way to do this is to ask a client to Echo its request to verify its source address.  This needs to be done only once per peer and limits the range of potential victims from the general Internet to endpoints that have been previously in contact with the server. For this application, the Echo option can be used in messages that are not integrity protected, for example during discovery. </del>  In the presence of a proxy, a server will not be able to distinguish different origin client endpoints.  Following from deployment with hop-by-hop security and proxies, the server can only verify aliveness of the closest proxy.  3. 3.1.

I think it make sense to make a subsection
This is only mentioned in Abstract and intro. I think it need there needs to be some text in the body as well. The other Update has it's own subsection. "4.2. Updated Token Processing Requirements for Clients"
I added text on server requirements in
updated with one more commit: Shorten amplification-mitigateion-recommendation paragraph, align text The "RECOMMENDED" wording is removed from the description of the mechanism (it was under-explained there, the new section does it right, and there's no need to make readers wonder about updating at this point) Reference updated simplified (we're already talking about server side in the paragraph) Comment about moving text here removed, and replaced with a more precise reference I've toyed with moved text, but it rips the use cases up to the point where we'd have to re-do all the items as subsections for consistency. ... and merging (comments still appreciated, but I need the branches consolidated for futher editing)
(... and that comment should have gone to ... anyway)
Some reformulations in febc426. I think this is ready to close.
Has long been ready, and recently gotten a more explicit cross-reference too.

A server that sends large responses to unauthenticated peers SHOULD mitigate amplification attacks such as described in Section 11.3 of RFC7252 (where an attacker would put a victim's  <ins> address in the source address of a CoAP request).  A new way to do this is to ask a client to Echo its request to verify its source address.  This needs to be done only once per peer and limits the range of potential victims from the general Internet to endpoints that have been previously in contact with the server.  For this application, the Echo option can be used in messages that are not integrity protected, for example during discovery. </ins> In the presence of a proxy, a server will not be able to distinguish different origin client endpoints.  Following from deployment with hop-by-hop security and proxies, the server can only verify aliveness of the closest proxy. <ins> 2.5. This section updates the amplification mitigation requirements for servers in RFC7252 to recommend use of the Echo option to mitigate amplification attacks.  The requirements for clients are not updated. Section 11.3 of RFC7252 is updated by adding the following text: A CoAP server SHOULD mitigate potential amplification attacks by responding to unauthenticated clients with 4.01 Unauthorized including an Echo option, as described in echo-app item 3 of [[this document]]. </ins> 3. 3.1.


secure CoAP operations.  This document specifies security enhancements to the Constrained Application Protocol (CoAP).  This document specifies two CoAP options, the Echo option and the Request-Tag option: The Echo option enables a CoAP server to verify the freshness of a request, synchronize state, or force a client to if the request was protected with a security protocol, such as DTLS. This makes CoAP requests vulnerable to certain delay attacks which are particularly perilous in the case of actuators (I-D.mattsson- <del> core-coap-actuators).  Some attacks can be mitigated by establishing </del>  fresh session keys, e.g. performing a DTLS handshake for each request, but in general this is not a solution suitable for constrained environments, for example, due to increased message to an attacker and causing overhead.  An amplification factor of 3 (i.e., don't send more than three times the number of bytes received until the peer's address is confirmed) is <del> considered acceptable for unconstrained applications I-D.ietf- quic-transport. </del>  When that limit is applied and no further context is available, a safe default is sending initial responses no larger than 136 different message bodies to the same resource having the same block number.  This remains true even when CoAP is used together with a security protocol such as DTLS or OSCORE, within the replay window <del> (I-D.mattsson-core-coap-actuators), which is a vulnerability of CoAP </del>  when using RFC7959. A straightforward mitigation of mixing up blocks from different payloads, even if the individual messages are integrity protected, it is still possible for an attacker to maliciously replace a later operation's blocks with an earlier operation's blocks (see <del> Section 2.5 of I-D.mattsson-core-coap-actuators).  Therefore, the </del>  integrity protection of each block does not extend to the operation's request body. That approach would have been difficult to roll out reliably on DTLS where many implementations do not expose sequence numbers, and would <del> still not prevent attacks like in I-D.mattsson-core-coap-actuators </del>  Section 2.5.2. 3.8. ensured, a client may erroneously associate the wrong response to a request.  The wrong response may be an old response for the same resource or a response for a completely different resource (see e.g. <del> Section 2.3 of I-D.mattsson-core-coap-actuators).  For example, a </del>  request for the alarm status "GET /status" may be associated to a prior response "on", instead of the correct response "off".

We've mentioned outdated draft names at times. Details in individual commits, point-to-point updated in-PR too. The DTLS change is not so much an update but a not to the editor that they may update the reference at their discretion when the publication sequence is clear; I don't want to pull another normative dependency into our cluster because we don't normatively need anything from 1.3.

secure CoAP operations.  This document specifies security enhancements to the Constrained Application Protocol (CoAP). <ins> [ Note to RFC editor: If C321 gets published before C280, then the RFC6347 references can be upgraded to draft-ietf-tls-dtls13-43 without the need for further changes; the reference is to 6347 here because that was the stable DTLS reference when the document was last touched by the authors. ] </ins> This document specifies two CoAP options, the Echo option and the Request-Tag option: The Echo option enables a CoAP server to verify the freshness of a request, synchronize state, or force a client to if the request was protected with a security protocol, such as DTLS. This makes CoAP requests vulnerable to certain delay attacks which are particularly perilous in the case of actuators (I-D.mattsson-  <ins> core-coap-attacks).  Some attacks can be mitigated by establishing </ins> fresh session keys, e.g. performing a DTLS handshake for each request, but in general this is not a solution suitable for constrained environments, for example, due to increased message to an attacker and causing overhead.  An amplification factor of 3 (i.e., don't send more than three times the number of bytes received until the peer's address is confirmed) is  <ins> considered acceptable for unconstrained applications in RFC9000 Section 8. </ins> When that limit is applied and no further context is available, a safe default is sending initial responses no larger than 136 different message bodies to the same resource having the same block number.  This remains true even when CoAP is used together with a security protocol such as DTLS or OSCORE, within the replay window  <ins> (I-D.mattsson-core-coap-attacks), which is a vulnerability of CoAP </ins> when using RFC7959. A straightforward mitigation of mixing up blocks from different payloads, even if the individual messages are integrity protected, it is still possible for an attacker to maliciously replace a later operation's blocks with an earlier operation's blocks (see  <ins> Section 2.5 of I-D.mattsson-core-coap-attacks).  Therefore, the </ins> integrity protection of each block does not extend to the operation's request body. That approach would have been difficult to roll out reliably on DTLS where many implementations do not expose sequence numbers, and would  <ins> still not prevent attacks like in I-D.mattsson-core-coap-attacks </ins> Section 2.5.2. 3.8. ensured, a client may erroneously associate the wrong response to a request.  The wrong response may be an old response for the same resource or a response for a completely different resource (see e.g.  <ins> Section 2.3 of I-D.mattsson-core-coap-attacks).  For example, a </ins> request for the alarm status "GET /status" may be associated to a prior response "on", instead of the correct response "off".


option includes the Echo value in a subsequent unicast request to the responding server. <del> A server that sends a large response to an unauthenticated peer SHOULD mitigate amplification attacks such as described in Section 11.3 of RFC7252 to address, for example, the case where an attacker puts a victim's address in the source address of a CoAP request.  One way to do this is that the server responds to the alleged source address of the request with an Echo option in short response message (e.g. 4.01 Unauthorized), thereby requesting the client to verify its source address.  This needs to be done only once per endpoint and limits the range of potential victims from the general Internet to endpoints that have been previously in contact with the server.  For this application, the Echo option can be used in messages that are not integrity protected, for example during discovery.  (This is formally recommended in ampl- mit). </del>  In the presence of a proxy, a server will not be able to distinguish different origin client endpoints.  Following from <del> the recommendation above, a proxy that sends large responses to unauthenticated peers SHOULD mitigate amplification attacks. The proxy SHOULD use Echo to verify origin reachability as described in echo-proc.  The proxy MAY forward safe requests immediately to have a cached result available when the client's repeated request arrives. </del>  Amplification mitigation is a trade-off between giving leverage to an attacker and causing overhead.  An amplification factor

Rewrote the text to talk about amplification factor instead of a single large packet. This also captures the cases where: A single request results in several responses from a single server. A single request results in several responses from a different servers. It also removes the case where both the request and the response are large (which is not an attack).
The current text only talks about large responses, not many responses. "A server that sends large responses to unauthenticated peers SHOULD mitigate amplification attacks"
Any document that allows multiple responses in the first place (Observe, Q-Block, groupcomm-proxy) emphasizes the dangers of unchecked operation -- but it doesn't hurt to do that here too. (We do already say that a single response needs to be piggy-backed or NON, for the same reason).
What should the consideration be - that the freshness of an Observe request MUST be verified with Echo, updating RFC7641? Why is Observe allowed without client authentication? And if so, should not the amplification factor be more precisely limited?
PR addresses this issue

option includes the Echo value in a subsequent unicast request to the responding server.  <ins> An attacker can perform a denial-of-service attack by putting a victim's address in the source address of a CoAP request and sending the request to a resource with a large amplification factor.  The amplification factor is the ratio between the size of the request and the total size of the reponse(s) to that request. A server that provides a large amplification factor to an unauthenticated peer SHOULD mitigate amplification attacks as described in Section 11.3 of RFC7252.  One way to mitigate such attacks is that the server responds to the alleged source address of the request with an Echo option in short response message (e.g. 4.01 Unauthorized), thereby requesting the client to verify its source address.  This needs to be done only once per endpoint and limits the range of potential victims from the general Internet to endpoints that have been previously in contact with the server. For this application, the Echo option can be used in messages that are not integrity protected, for example during discovery.  (This is formally recommended in ampl-mit). </ins> In the presence of a proxy, a server will not be able to distinguish different origin client endpoints.  Following from  <ins> the recommendation above, a proxy that provides a large amplification factor to unauthenticated peers SHOULD mitigate amplification attacks.  The proxy SHOULD use Echo to verify origin reachability as described in echo-proc.  The proxy MAY forward safe requests immediately to have a cached result available when the client's repeated request arrives. </ins> Amplification mitigation is a trade-off between giving leverage to an attacker and causing overhead.  An amplification factor


Choose a connection identifier C_R and store it for the length of the protocol. <del> Compute the transcript hash TH_2 = H(message_1, data_2) where H() is the hash function in the selected cipher suite.  The transcript hash TH_2 is a CBOR encoded bstr and the input to the hash function is a CBOR Sequence. </del>  Compute an inner COSE_Encrypt0 as defined in Section 5.3 of I- D.ietf-cose-rfc8152bis-struct, with the EDHOC AEAD algorithm in If corr (METHOD_CORR mod 4) equals 2 or 3, C_R is omitted, otherwise C_R is not omitted. <del> Compute the transcript hash TH_3 = H(TH_2 , CIPHERTEXT_2, data_3) where H() is the hash function in the selected cipher suite.  The transcript hash TH_3 is a CBOR encoded bstr and the input to the hash function is a CBOR Sequence. </del>  Compute an inner COSE_Encrypt0 as defined in Section 5.3 of I- D.ietf-cose-rfc8152bis-struct, with the EDHOC AEAD algorithm in

This addresses . I don't think we need to include names for the intermediary hashes.

Choose a connection identifier C_R and store it for the length of the protocol.  <ins> Compute the transcript hash TH_2 = H( H(message_1), data_2 ) where H() is the hash function in the selected cipher suite.  The transcript hash TH_2 is a CBOR encoded bstr and the input to the hash function is a CBOR Sequence.  Note that H(message_1) can be computed and cached alredy in the processing of message_1. </ins> Compute an inner COSE_Encrypt0 as defined in Section 5.3 of I- D.ietf-cose-rfc8152bis-struct, with the EDHOC AEAD algorithm in If corr (METHOD_CORR mod 4) equals 2 or 3, C_R is omitted, otherwise C_R is not omitted.  <ins> Compute the transcript hash TH_3 = H( H(TH_2, CIPHERTEXT_2), data_3 ) where H() is the hash function in the selected cipher suite.  The transcript hash TH_3 is a CBOR encoded bstr and the input to the hash function is a CBOR Sequence.  Note that H(TH_2, CIPHERTEXT_2) can be computed and cached alredy in the processing of message_2. </ins> Compute an inner COSE_Encrypt0 as defined in Section 5.3 of I- D.ietf-cose-rfc8152bis-struct, with the EDHOC AEAD algorithm in


The MAC is implemented with an AEAD algorithm.  When using static Diffie-Hellman keys the Initiator's and Responder's private authentication keys are called I and R, respectively, and the public <del> authentication keys are called G_I and G_R, respectively. </del>  Only the Responder SHALL have access to the Responder's private authentication key. 3.4. <del> An EDHOC cipher suite consists of an ordered set of COSE code points from the "COSE Algorithms" and "COSE Elliptic Curves" registries: </del>  EDHOC AEAD algorithm EDHOC hash algorithm <del> EDHOC ECDH curve </del>  EDHOC signature algorithm <del> EDHOC signature algorithm curve </del> Application AEAD algorithm Application hash algorithm EDHOC can be used with all algorithms and curves defined for COSE. Implementation can either use one of the pre-defined cipher suites <del> (suites-registry) or use any combination of COSE algorithms to define their own private cipher suite.  Private cipher suites can be identified with any of the four values -24, -23, -22, -21. </del>  The following cipher suites are for constrained IoT where message overhead is a very important factor: CNSA suite CNSA. The different methods use the same cipher suites, but some algorithms <del> are not used in some methods.  The EDHOC signature algorithm and the EDHOC signature algorithm curve are not used in methods without signature authentication. </del>  The Initiator needs to have a list of cipher suites it supports in order of preference.  The Responder needs to have a list of cipher How message_1 is identified, in particular if the optional initial C_1 = "null" of message_1 is present; see <del> Authentication credentials (CRED_I, CRED_R; see auth-cred). </del>  Type used to identify authentication credentials (ID_CRED_I, ID_CRED_R; see id_cred).

Added clarification. Ready to merge?
EDHOC looks to me like it should be usable in situations where one party has no need (or intention) to authenticate, but still wants to authenticate the other party or just use opportunistic encryption. One use case might be a constrained device A obtaining the certificate indicated by device B in the A-B EDHOC exchange from the certificate URI at C indicated by B. A has no need to present credentials (C hosts the certs publicly), but doesn't want to reveal to passive evesdroppers that it's talking to B. It doesn't need to authenticate C, but that might still be a good idea to lock out active MITMs. My impression is that this is possible with EDHOC as it is and that EDHOC is suitable for the task (if not, stop reading and tell me). If it is suitable, would both of these work? Create (in COSE) a key ID type where a RPK that is CREDx can be transported in IDCREDx (useful where you want to come back w/o having any original claims on first use) Have a key where your IDCRED_x says "just what my ephemeral key is". That'd make exchanges just as compact as short-ID'd RPKs, and still be good-enough for unilateral authentication.
From just in the WG meeting: RPK-by-value sounds doable in COSE and would be good enough for a start. The extended case is probably exceeding the LAKE requirements and is to be postponed. (Personally I'd like to keep looking into it, if only to influence any left-over decisions that don't have any other influencing factors and one would rule this out -- but that can happen outside WG activity).
Covered by
The more I think about this, the more I think that specifying a new type in the C509 draft is the right way to go. COSE_Key was not meant to be sent over the wire. It does not have a order and it is not very optimized. When working on issue and PR I realized that the singature curve has nothing to do with the signature alg and is completely detemined by the public key. It would be messy to have to types of public key formation and algorithms. Only using X.509 / C509 seems simpler in my view. A new type in C509 naturally allows optional sending of parameters like key usage, subject name, and life time, which might be useful in a RPK setting as well. Below is an example using the example certificate in the C509 draft. The type is changed to 2, the signature is removed, and all parameters are set to there minimum size. This PRK has key usage digital signature. Could be discussed if fields should be removed or have a non-present value. The RPK has size 43 bytes: 2, h'', [], null, null, [], 1, h'02B1216AB96E5B3B3340F5BDF02E693F16213A04525ED44450 B1019C2DFD3838AB', 1 Below is another example where a serial number, expiery time, and subject name (EUI-64) is provided, size 55 bytes. 2, h'01f5', [], null, 1612224000, h'0123456789AB', 1, h'02B1216AB96E5B3B3340F5BDF02E693F16213A04525ED44450B1019C2DFD3838AB', 1
I think this is important to define, I will start to make some more concrete suggestion and analysis.
The use of UCCS for trust-on-first-use is now included in the master branch, see a1b25ba and commits in its vicinity. Can we close the issue?
I think this can be closed.
The specification that a cipher suite includes "EDHOC signature algorithm curve" make it seems like only ECC signature algorithms can be used. That is not the intension. PS256, HSS-LMS, and future PQC should be allowed.
I made a PR to begin to adress this problem . This was an old know issue that was not transfered from the old GitHub repository. In the PR is it explained that algorithms might have parameters and that parameters need to be included so hat the algorithm is determined. While making the PR, it struck me that the signature algorithm curve is not needed at all and in COSE and X.509 terms this is determined by the public key algorithm. I think this needs to be addresses. Either we remove the signature curve from the cipher suite completely or we specify it as a profiling of the public key. Profiling the public key is however problematic as it is not a COSE key and may be any PKIX algorithm that may not even be standardized for COSE at all. I do not think there is any reason to restrict PKIX. My suggestion is that we remove the public key parameters from the cipher suite.
PR is merged with master. Any further comments on this?
The PR has been discussed and merged. Closing

The MAC is implemented with an AEAD algorithm.  When using static Diffie-Hellman keys the Initiator's and Responder's private authentication keys are called I and R, respectively, and the public  <ins> authentication keys are called G_I and G_R, respectively.  The authentication key algorithm needs to specified with enough parameters to make it completely determined.  Note that for most signature algorithms, the signature is detemined by the signature algorithm and the authentication key algorithm together.  For example, the curve used in the signature is typically determined by the authentication key parameters. </ins> Only the Responder SHALL have access to the Responder's private authentication key. 3.4.  <ins> An EDHOC cipher suite consists of an ordered set of algorithms from the "COSE Algorithms" and "COSE Elliptic Curves" registries. Algorithms need to be specified with enough parameters to make them completely determined.  Currently, none of the algorithms require parameters.  EDHOC is only specified for use with key exchange algorithms of type ECDH curves.  Use with other types of key exchange algorithms would likely require a specification updating EDHOC.  Note that for most signature algorithms, the signature is detemined by the signature algorithm and the authentication key algorithm together, see auth-keys. </ins> EDHOC AEAD algorithm EDHOC hash algorithm  <ins> EDHOC key exchange algorithm (ECDH curve) </ins> EDHOC signature algorithm  Application AEAD algorithm Application hash algorithm EDHOC can be used with all algorithms and curves defined for COSE. Implementation can either use one of the pre-defined cipher suites  <ins> (suites-registry) or use any combination of COSE algorithms and parameters to define their own private cipher suite.  Private cipher suites can be identified with any of the four values -24, -23, -22, -21. </ins> The following cipher suites are for constrained IoT where message overhead is a very important factor: CNSA suite CNSA. The different methods use the same cipher suites, but some algorithms  <ins> are not used in some methods.  The EDHOC signature algorithm is not used in methods without signature authentication. </ins> The Initiator needs to have a list of cipher suites it supports in order of preference.  The Responder needs to have a list of cipher How message_1 is identified, in particular if the optional initial C_1 = "null" of message_1 is present; see  <ins> Profile for authentication credentials (CRED_I, CRED_R; see auth- cred), e.g., profile for certificate or COSE_key, including supported authentication key algorithms (subject public key algorithm in X.509 certificate). </ins> Type used to identify authentication credentials (ID_CRED_I, ID_CRED_R; see id_cred).


3.5. <del> The ECDH ephemeral public keys are formatted as a COSE_Key of type EC2 or OKP according to Sections 7.1 and 7.2 of I-D.ietf-cose- rfc8152bis-algs, but only the 'x' parameter is included G_X and G_Y. For Elliptic Curve Keys of type EC2, compact representation as per RFC6090 MAY be used also in the COSE_Key.  If the COSE implementation requires an 'y' parameter, any of the possible values of the y-coordinate can be used, see Appendix C of RFC6090.  COSE always use compact output for Elliptic Curve Keys of type EC2. </del>  3.6. most preferred cipher suite of those (note that error messages are not authenticated and may be forged). <del> Generate an ephemeral ECDH key pair as specified in Section 5 of SP-800-56A using the curve in the selected cipher suite and format it as a COSE_Key.  Let G_X be the 'x' parameter of the COSE_Key. </del>  Choose a connection identifier C_I and store it for the length of the protocol. If corr (METHOD_CORR mod 4) equals 1 or 3, C_I is omitted, otherwise C_I is not omitted. <del> Generate an ephemeral ECDH key pair as specified in Section 5 of SP-800-56A using the curve in the selected cipher suite and format it as a COSE_Key.  Let G_Y be the 'x' parameter of the COSE_Key. </del>  Choose a connection identifier C_R and store it for the length of the protocol. parties can derive application keys with other labels or run EDHOC again.  8.3. For many constrained IoT devices it is problematic to support more rfc8152bis-algs this can be addressed by combining randomness and determinism. <del> The referenced processing instructions in SP-800-56A must be complied with, including deleting the intermediate computed values along with any ephemeral ECDH secrets after the key derivation is completed. The ECDH shared secrets, keys, and IVs MUST be secret. </del>  Implementations should provide countermeasures to side-channel <del> attacks such as timing attacks.  Depending on the selected curve, the parties should perform various validations of each other's public keys, see e.g.  Section 5 of SP-800-56A. </del>  The Initiator and the Responder are responsible for verifying the integrity of certificates.  The selection of trusted CAs should be

This was suggested in CFRG during the discussion on HPKE Elliptic-Curve-Point-to-Octet-String Conversion. The compact representation used in EDHOC can be used whenever compact output is used in ECDH (which it almost always is). Important to differenctiate between the wire format, the validation done, and the algorithm for multiplication. EDHOC only touch the wire format, and do not loosen any validation requirements or recommend any particular algorithms form multiplication. Suggestion oflline that it might be better to specify that the "y-bit" is set to 0 instead of giving the implementor an option. Suggestion offline that the draft should refer to SECG in addition or instead of NIST.
I made a PR trying to capture the suggestion from CFRG. I think the PR is ready to merge.
on page 14 would it not be suitable to add that IDCREDx = { x5chain : certificate in DER }, for x = I or R,
Very timely comment. I just made an update to this effect, see b5346fb. I didn't want to include this kind of notation as it requires explanation. Is it good enough?
Suggest to give it a bullet as well. Göran Selander schreef op 2021-02-22 11:26: Links: [1] URL [2] URL [3] URL

3.5.  <ins> EDHOC always uses compact representation of elliptic curve points, see comrep.  In COSE compact representation is achieved by formatting the ECDH ephemeral public keys as COSE_Keys of type EC2 or OKP according to Sections 7.1 and 7.2 of I-D.ietf-cose-rfc8152bis-algs, but only including the 'x' parameter in G_X and G_Y.  For Elliptic Curve Keys of type EC2, compact representation MAY be used also in the COSE_Key.  If the COSE implementation requires an 'y' parameter, the value y = false SHALL be used.  COSE always use compact output for Elliptic Curve Keys of type EC2. </ins> 3.6. most preferred cipher suite of those (note that error messages are not authenticated and may be forged).  <ins> Generate an ephemeral ECDH key pair using the curve in the selected cipher suite and format it as a COSE_Key.  Let G_X be the 'x' parameter of the COSE_Key. </ins> Choose a connection identifier C_I and store it for the length of the protocol. If corr (METHOD_CORR mod 4) equals 1 or 3, C_I is omitted, otherwise C_I is not omitted.  <ins> Generate an ephemeral ECDH key pair using the curve in the selected cipher suite and format it as a COSE_Key.  Let G_Y be the 'x' parameter of the COSE_Key. </ins> Choose a connection identifier C_R and store it for the length of the protocol. parties can derive application keys with other labels or run EDHOC again. <ins> Requirement for how to securely generate, validate, and process the ephermeral public keys depend on the elliptic curve.  For X25519 and X448, the requirements are defined in RFC7748.  For secp256r1, secp384r1, and secp521r1, the requirements are defined in Section 5 of SP-800-56A.  For secp256r1, secp384r1, and secp521r1, at least partial public-key validation MUST be done. </ins> 8.3. For many constrained IoT devices it is problematic to support more rfc8152bis-algs this can be addressed by combining randomness and determinism.  <ins> All private keys, symmetric keys, and IVs MUST be secret. </ins> Implementations should provide countermeasures to side-channel  <ins> attacks such as timing attacks.  Intermediate computed values such as ephemeral ECDH keys and ECDH shared secrets MUST be deleted after key derivation is completed. </ins> The Initiator and the Responder are responsible for verifying the integrity of certificates.  The selection of trusted CAs should be


The Initiator MUST select its most preferred cipher suite, conditioned on what it can assume to be supported by the Responder.  If the Initiator previously received from the <del> Responder an error message with error code 1 (see wrong-selected) </del>  indicating cipher suites supported by the Responder which also are supported by the Initiator, then the Initiator SHOULD select the most preferred cipher suite of those (note that error messages are (METHOD_CORR mod 4) equals 0 or 1 then C_x is set to C_R, else C_x is omitted. <del> ERR_CODE - error code encoded as an integer. </del>  ERR_INFO - error information.  Content and encoding depend on error code. The remainder of this section specifies the currently defined error <del> codes, see fig-error-codes.  Error codes 1, 0 and -1 MUST be supported.  Additional error codes and corresponding error information may be specified. </del>  6.1. <del> TBD </del>  6.2. <del> Error code 0 is used for unspecified errors and contain a diagnostic message. For error messages with ERR_CODE == 0, ERR_INFO MUST be a text string containing a human-readable diagnostic message written in English. The diagnostic text message is mainly intended for software engineers that during debugging need to interpret it in the context of the EDHOC specification.  The diagnostic message SHOULD be provided to the calling application where it SHOULD be logged. </del>  6.3. <del> Error code 1 MUST only be used in a response to message_1 in case the </del>  cipher suite selected by the Initiator is not supported by the Responder, or if the Responder supports a cipher suite more preferred by the Initiator than the selected cipher suite, see resp-proc-msg1. ERR_INFO is of type SUITES_R: If the Responder does not support the selected cipher suite, then

This should address all open issues regarding errors. Align with very common standard that 0 means success and everything else means error Specify that success is for internal use in the application, it therefore makes sense to use any and let the application define what to store. No sense in forcign application to support 0, it is not needed for interoperability over the wire.
I kept error codes positive as proposed by IOTOPS, but changed the more general error "unspecified" comes before the more specific "wrong ciphersuite" because that allows for more specific errors to follow in a structured way in the table that aligned better with the subsubsections describing the cipher suite negotiation.
John and I are happy with this now. Unless there are any comments we will soon merge this.
Looks good.
At the last interim there was a suggestion to standardize classes of error messages and to ask the IoT groups in IETF about what classes of error messages that should be standardized. The error message should then be augmented with a error message class. int? array of int? Shoudl the optional text string remain. That cannot be used for any automation. But might be useful for loggging for later reading by a human. The initial classes or error message might not provide much info, e.g. "authentication error"
Mailthread in iotops: URL
Proposal after discussion in Hackathon: error = ( ? Cx : bstridentifier, DIAGMSG : tstr, ERRCODE : int / 2 int, ? SUITESR : [ supported : 2 suite ] / suite, ) Top-level ERRCODEs: (0. Success) Message field error (syntax error or incorrect protocol field of expected message) Selected cipher suite not supported (include SUITES_R in message) Credential/context error (error related to establish certificate/raw public key context for processing message, including certificate expired, revoked, unsupported, corrupt, unknown CA, or other issue in processing the credential) Decrypt error (a cryptographic operation failed, including being unable to correctly verify a signature or a MAC in the protocol message) Auxiliary data error (unsupported or missing auxiliary data) Access denied (credential valid but peer not allowed access) Internal error (error not related to the protocol or the peer) Selected comments during Hackathon: Relation to errors on other layer, e.g. CoAP errors or error in application. - EDHOC does not require CoAP so could have use for specified own errors. - Does "5. AD error" belong to EDHOC? Perhaps, auxiliary data provides means for security applications to reuse EDHOC and this would be a channel to send errors in those applications. [Not sure if this helps but, alternatively, errors could be encoded as auxiliary data, which may require an AD-field in the error message] - Does "6. Access denied" belong to EDHOC? Perhaps, it provides a suitable error to the requirement "Verify that the identity of the Responder is an allowed identity for this connection" Further comments are welcome. Happy to make the list shorter if possible.
Other thoughts: We can put some of these error classes into an "x. unspecified error" bucket if we don't think they are not meaningful to act upon individually. We can define a class of errors "y. general error" and allow implementations to use class y for any error, including those properly belonging to some class above. This would allow implementations to only support some of the specified errors above, potentially listed in the applicability statement. (That would render the list of classes above just a RECOMMENDATION.)
Many OSs, shells, and programming languages (e.g. C) use 0 for success and everthing non-zero (negative or positive) is considered an error. HTTP and Coap use postive numbers only where 2. or 2xx is considered success. I think we should probably follow one of these convensions instead of making a new one. The specification should also probably define that everything else than whatever we decide for success is considered an error.
I made a PR addressing all known issues regarding this.
This is ready to merge unless there are any objections.
The PR has been discussed and merged. Closing Hello IOTOPS, There is a discussion in the LAKE WG regarding the potential need to standardize error messages appearing in a security handshake protocol targeting IoT devices. Is this something IOTOPS could contribute to and/or review? Assuming this might be the case, here is a background and some draft error categories for discussion. Background: LAKE is specifying a lightweight authenticated Diffie-Hellman exchange called EDHOC [1] similar to the TLS 1.3 handshake but targeting constrained IoT. The protocol consists of 3 messages and an error message which may be sent in response to any non-error message. The error message essentially consists of a diagnostic message field containing a text string targeting the peer administrator. All errors are fatal and cause the protocol to discontinue. The intent with the error message is to provide a hint about the error to the peer application, to enable logging of errors and appropriate management operations. (Note that since the protocol failed to establish security the error message is unprotected and needs to be treated accordingly.) The question is what error messages need to be standardized, if any. Detailed information can be provided by using the diagnostic text string. But standardizing detailed error information adds complexity to the specification and implementation, which would contradict one of the design objectives. But perhaps we can we identify a small set of error categories (codes) that require to be singled out, for example because how they impact operations. Such categories could potentially be complemented with text providing additional details. Please find below a first sketch of error categories (inspired by error alerts from TLS 1.3 [2]). Two questions (going in opposite directions): Do we need to make more distinctions/are there missing error categories? Are these distinctions necessary, or can we remove/group together some of them? Draft error categories: A. message field error (syntax error or incorrect protocol field) B. integrity error (unable to correctly verify a signature or a MAC) C. credential error (error related to the attempt to use a certificate/raw public key as a basis for autentication, e.g., certificate expired, revoked, unsupported, corrupt, unknown CA etc.) D. access denied (credential valid but peer not allowed access) E. internal error (error not related to the protocol or the peer) F. auxiliary data error (unsupported or missing extension) G. cipher suite not supported (this particular error has already been specified with a special message field, see Section 6) Any comments are welcome. Thanks Göran [1] URL [2] URL

The Initiator MUST select its most preferred cipher suite, conditioned on what it can assume to be supported by the Responder.  If the Initiator previously received from the  <ins> Responder an error message with error code 2 (see wrong-selected) </ins> indicating cipher suites supported by the Responder which also are supported by the Initiator, then the Initiator SHOULD select the most preferred cipher suite of those (note that error messages are (METHOD_CORR mod 4) equals 0 or 1 then C_x is set to C_R, else C_x is omitted.  <ins> ERR_CODE - error code encoded as an integer.  The value 0 is used for success, all other values (negative or positive) indicate errors. </ins> ERR_INFO - error information.  Content and encoding depend on error code. The remainder of this section specifies the currently defined error  <ins> codes, see fig-error-codes.  Error codes 1 and 2 MUST be supported. Additional error codes and corresponding error information may be specified. </ins> 6.1.  <ins> Error code 0 MAY be used internally in an application to indicate success, e.g. in log files.  ERR_INFO can contain any type of CBOR item.  Error code 0 MUST NOT be used as part of the EDHOC message exchange flow. </ins> 6.2.  <ins> Error code 1 is used for errors that do not have a specific error code defined.  ERR_INFO MUST be a text string containing a human- readable diagnostic message written in English.  The diagnostic text message is mainly intended for software engineers that during debugging need to interpret it in the context of the EDHOC specification.  The diagnostic message SHOULD be provided to the calling application where it SHOULD be logged. </ins> 6.3.  <ins> Error code 2 MUST only be used in a response to message_1 in case the </ins> cipher suite selected by the Initiator is not supported by the Responder, or if the Responder supports a cipher suite more preferred by the Initiator than the selected cipher suite, see resp-proc-msg1. ERR_INFO is of type SUITES_R: If the Responder does not support the selected cipher suite, then


9.5.  IANA has added the COSE header parameter 'kid2' to the COSE Header Parameters registry.  The kid2 parameter may point to a COSE key common parameter 'kid' or 'kid2'.  The kid2 parameter can be used to identity a key stored in a "raw" COSE_Key, in a CWT, or in a certificate. <del> 9.6. </del>  IANA has added the COSE key common parameter 'kid2' to the COSE Key Common Parameters registry. <del> 9.7. </del>  IANA has added the well-known URI 'edhoc' to the Well-Known URIs registry. Related information: None <del> 9.8. </del>  IANA has added the media type 'application/edhoc' to the Media Types registry. Change Controller: IESG <del> 9.9. </del>  IANA has added the media type 'application/edhoc' to the CoAP Content-Formats registry. Reference: [[this document]] <del> 9.10. </del>  IANA has created a new registry entitled "EDHOC External Authorization Data" under the new heading "EDHOC".  The registration Description, and Reference, where Value is an integer and the other columns are text strings. <del> 9.11. </del>  The IANA Registries established in this document is defined as "Expert Review".  This section gives some general guidelines for what

Discussion today in COSE on how to do RPK by value in EDHOC. Suggestions to send a COSE_Key or a C509. Additional suggestion from Carsten to use CWT. Several issues in the old GitHub on CWTs, that were not transfered to the new GitHub: URL URL URL Discussion to transfer CWT in kid, in Auxilery data, and as COSE header parameter. Transfering CWT is related to issues , , ,
I made a pull request for this URL I think it is essential that EDHOC supports CWT. CWTs are much more flexible than X.509 / C.509. I think both are needed. The need for CWT has been discussed since 2016. I think it was decided clear quite early that transporting CWT is needed but was a discussion on how to transfer them. In Aux Data, in COSE header parameter, or in the kid bstr. For some reason nothing was ever specified. TLS WG is discussing to add support for CWT. URL I think certificates and CWT needs to be included, I am not sure that we need a different format for RPK. Likely CWT or C509 can be used for this purpose.
I think it should be discussed if CWT is good enough for the . My initial understanding is that it is but this needs to be analyzed and discussed. My current thoughts. CWT needs to be supported in EDHOC. Most things in CWT is optional, it is likely an optimized enough format for the oportunistic / TOFU use case of "RPK". CWT is also very flexible. When CWT exist it would be strange to standardize a new format for transfereing a COSEKey unless it is really really needed to save bytes. CWT + Deterministic CBOR could maybe replace the discussion on how to integrity protect COSEKeys. We should at least remove the new subjectname from the COSEKey part in the EDHOC document. CWT and C509 can be used when subject name is needed. Does "Raw" COSE_Keys that are not CWT even need to be supported? Or would CWT / C509 / X.509 be enough
This change has now been done in the master branch, see a1b25ba and commits in its vicinity. Can we close the issue?
This has now been addressed.

9.5. <ins> This document registers the following entries in the "COSE Header Parameters" registry under the "CBOR Object Signing and Encryption (COSE)" heading.  The value of the 'cwt' header parameter is a CWT RFC8392 or an unprotected CWT Claims Set I-D.ietf-rats-uccs. 9.6. </ins> IANA has added the COSE header parameter 'kid2' to the COSE Header Parameters registry.  The kid2 parameter may point to a COSE key common parameter 'kid' or 'kid2'.  The kid2 parameter can be used to identity a key stored in a "raw" COSE_Key, in a CWT, or in a certificate.  <ins> 9.7. </ins> IANA has added the COSE key common parameter 'kid2' to the COSE Key Common Parameters registry.  <ins> 9.8. </ins> IANA has added the well-known URI 'edhoc' to the Well-Known URIs registry. Related information: None  <ins> 9.9. </ins> IANA has added the media type 'application/edhoc' to the Media Types registry. Change Controller: IESG  <ins> 9.10. </ins> IANA has added the media type 'application/edhoc' to the CoAP Content-Formats registry. Reference: [[this document]]  <ins> 9.11. </ins> IANA has created a new registry entitled "EDHOC External Authorization Data" under the new heading "EDHOC".  The registration Description, and Reference, where Value is an integer and the other columns are text strings.  <ins> 9.12. </ins> The IANA Registries established in this document is defined as "Expert Review".  This section gives some general guidelines for what


suites can be identified with any of the four values -24, -23, -22, -21. <del> The following cipher suites are for constrained IoT where message overhead is a very important factor: The following cipher suite is for general non-constrained applications.  It uses very high performance algorithms that also are widely supported: The following cipher suite is for high security application such as government use and financial applications.  It is compatible with the CNSA suite CNSA. </del>  The different methods use the same cipher suites, but some algorithms are not used in some methods.  The EDHOC signature algorithm is not

Looks good. One inconsistency is that there is no cipher suite with AES-GCM and NIST curves, like (A128GCM, SHA-256, P-256, ES256, A128GCM, SHA-256). This could be a new cipher suite 5. Then all non-CNSA suites would come in pairs.
That is very intentional. The GCM cipher suite uses X25519 for key exchange and ECDSA for authentication. This seems to be the dominant choice for HTTPS on the Web. Unless you are constrained you typically use X25519 for key exchange for speed and ECDSA for authentication as that is what the CAs support. For an IoT device you probably want to have a single curve implemented. Also it might be much easier to switch to EdDSA as you might not have to rely on Global CAs and all other HTTPS nodes to support EdDSA. You can just deploy you own CWT server and make sure the nodes in you new IoT deployment support EdDSA. I have not heard any IoT people very interested in GCM. People seems far more interested in ChaCha20.
Ready to merge?
Is it worth having 4 diiference CCM based ciphser suites. And are they the correct 4?EDHOC should probably have a ChaCha20-Poly1305 cipher suite from start. Probably with SHA-256. X25519 and EdDSA.The CNSA cipher suite does not really need a 1 byte value. Could live with 2 byte value.
-Agreement during interim is that the 4 different CCM are all needed and that they are the correct ones. -ChaCha20 should be combined with both P-256 and X25519 -CNSA suite can have two bytes.
I think we should specify a X448/SHAKE256 suite to complement the CNSA suite.
The GCM suite is chosen to match what is currently used on the web which is X25519 combined with P-256 ECDSA. Not sure we need to specify anything else here. IoT community seems more interested in ChaCha20 than GCM. ~~
URL
Resolved with .

suites can be identified with any of the four values -24, -23, -22, -21.  <ins> The following CCM cipher suites are for constrained IoT where message overhead is a very important factor.  Cipher suites 1 and 3 use a larger tag length (128-bit) in the EDHOC AEAD algorithm than the Application AEAD algorithm (64-bit): The following ChaCha20 cipher suites are for less constrained applications and only use 128-bit tag lengths. The following GCM cipher suite is for general non-constrained applications.  It uses high performance algorithms that are widely supported: The following two cipher suites are for high security application such as government use and financial applications.  The two cipher suites do not share any algorithms.  The first of the two cipher suites is compatible with the CNSA suite CNSA. </ins> The different methods use the same cipher suites, but some algorithms are not used in some methods.  The EDHOC signature algorithm is not


5.3.1. <del> message_2 and data_2 SHALL be CBOR Sequences (see CBOR) as defined below </del>  where: <del> G_Y - the ephemeral public key of the Responder </del>  C_R - variable length connection identifier Choose a connection identifier C_R and store it for the length of the protocol. <del> Compute the transcript hash TH_2 = H( H(message_1), data_2 ) where H() is the hash function in the selected cipher suite.  The </del>  transcript hash TH_2 is a CBOR encoded bstr and the input to the hash function is a CBOR Sequence.  Note that H(message_1) can be computed and cached already in the processing of message_1.

message2 could be made 44 bytes by using the known length of SIGNATUREORMAC2
I suggest to have CR as the last element of the CBOR sequence (which shouldn't be a problem and still allows for a sequential sequence parsing), i.e.: When using CoAP (or other transports with the same correlation properties), this would preserve a current good pattern as useful for message recognition: if a response transporting an EDHOC message starts with a CBOR integer, then it's an EDHOC error message. It would be good to preserve this, hence why keeping CR at the end of the new message_2, since it can now be either a CBOR byte string or a CBOR integer.
Merging this now as there was no objection to: URL This provides a solution to the concrete issue raised in .
Mistake, I intended to merge, not close.
We need to nail down what optimizations to make in the final message format. Known lengths of byte strings can be used as discussed in the old issue tracker: URL
We should confirm the values from the rewuirement phase. If I remember correctly 45 bytes for message2 in 5-hop 6TiSCH was the strictest requirement. We can reasch that but before we optimize for that, we should confirm that the group wants to optimize for 5-hop 6TiSCH (or is 4-hop godd enough) and also double check and verify that 45 bytes is the correct number to optimize for. If I remember correctly Lorawan was a little bit less demanding than 5-hop 6TiSCH wih 48 bytes?. Every single byte can make a large difference if you suddenly have to fragment and send two frames instead of one. On the other hand there has been discusssions that is would be nice to mandate CR in message2 and to skip the bstridentifier optimization of IDCREDR.
John added a comment on an issue in the old repo which probably was intended to be on this issue: URL
Several things have been discussed regarding optimisations (or simplifications adding bytes). Message2 is the largest message and it is sent over downlink in 6TiSCH which is more constrained than uplink in 6TiSCH. Therefore only message2 is discussed below. Connection IDs - It has been discussed to make conection IDs mandatory (or default). Given the current connection id encoding this would add 1 byte to message2 when sent in CoAP response. Note that there has also been suggested to move connection ids to a shim layer. This would not affect the total overhead, just move bytes from EDHOC to lower layers. If connection ids are kept in EHOC I think EDHOC should adopt Christians suggestion for encoding.bstridentifier - Is has been pointed out that the bstridentifier is complicated and looks like overopimization, adding complexity to spec and implementations. Christian has some excellent suggestions on how to encode the connection identifiers. Then the bstridentifier is only use to encode IDCRED containing kid. This optimisations could maybe be skipped. This would add 1 byte to message2 when certain 1 byte KIDs are used. I think this should be done unless the byte saving is very much needed.Known lengths - There are several bstr whose length is known. E.g. GY and SignatureorMAC2. Concatenating GY and CIPHERTEXT2 would save 1-2 bytes. The known length of SignatureorMAC2 is harder to use as a change would mean that the plaintext is no longer a CBOR sequance. Changing plaintext to be a CBOR SEQUENCE concatenated with the value of SignatureorMAC2 would save an additional 1-2 bytes. I don't think any of these optimizations should be done unless the byte savings are essential. The above addition/removal of optimizations needs to be discussed together with a renewed discussion of the limits in 6TiSCH. In the end it is a tradeoff between complexity and how many deployments should be supported with unfragmented message_2.
As discussed during the design team meeting, the new "6TiSCH Overhead Estimator" is available at: URL This estimator obsoletes the old Google document by updating the overhead numbers to the latest RFCs that are used in 6TiSCH, fixes an erratum present in the old doc, and adds new features such as short addressing support and UDP overhead compression.
As discussed in the recent interim meeting, we postpone the resolution of this issue until the draft is ready for WGLC.
I think this can be closed now. We have discussed and done the agreed optimizations. Hi, Following some after-meeting feedback, we think it may be wise to make the optimization mentioned in already in -09 instead of, potentially, after WGLC. This is 180 degrees compared to the proposal yesterday. Some reasoning about the change of view below. Since this optimization breaks the format of message_2, there needs to be new test vectors, updated implementations and additional interop tests. This causes further delay, also waiting for implementation feedback before we can consider the protocol stable again. By addressing this now we can absorb that time in the plan we set out for specifying and testing -09. So even if we may agree that the optimization is not necessary, considering that this is a small change it seems worth to be proactive here. Here is a PR: URL If possible, please comment by August 8. We would like merge this and submit -09 soon after that. Thanks Göran From: Lake on behalf of Mališa Vučinić Date: Friday, 30 July 2021 at 09:40 To: "EMAIL" Subject: [Lake] LAKE @ IETF 111: Follow up and minutes All, Thank you for the productive meeting yesterday. We have just posted the minutes [1] and the recording will be published shortly. Many, many thanks to Marco Tiloca and Robert Wilton for taking notes during the meeting. As agreed, we will schedule a virtual interim meeting for the end of September, beginning of October. A doodle will follow shortly. In the meantime, enjoy the summer period! Mališa [1] URL

5.3.1.  <ins> message_2 SHALL be a CBOR Sequence (see CBOR) as defined below </ins> where:  <ins> G_Y_CIPHERTEXT_2 - the concatenation of G_Y, the ephemeral public key of the Responder, and CIPHERTEXT_2 </ins> C_R - variable length connection identifier Choose a connection identifier C_R and store it for the length of the protocol.  <ins> Compute the transcript hash TH_2 = H( H(message_1), G_Y, C_R ) where H() is the hash function in the selected cipher suite.  The </ins> transcript hash TH_2 is a CBOR encoded bstr and the input to the hash function is a CBOR Sequence.  Note that H(message_1) can be computed and cached already in the processing of message_1.


in deployments where no protected application data is sent from R to I. <del> A key material exporter and a key update function enabling frequent forward secrecy. </del>  Verification of a common preferred cipher suite: The EDHOC-KeyUpdate takes a nonce as input to guarantee that there are no short cycles.  The Initiator and the Responder need to agree <del> on the nonce, which can e.g., be a counter or a random number. </del>  5. the Initiator and the Responder. As required by RFC7258, IETF protocols need to mitigate pervasive <del> monitoring when possible.  One way to mitigate pervasive monitoring is to use a key exchange that provides forward secrecy.  EDHOC therefore only supports methods with forward secrecy.  To limit the effect of breaches, it is important to limit the use of symmetrical group keys for bootstrapping.  EDHOC therefore strives to make the additional cost of using raw public keys and self-signed certificates as small as possible.  Raw public keys and self-signed certificates are not a replacement for a public key infrastructure but SHOULD be used instead of symmetrical group keys for bootstrapping. </del>  Compromise of the long-term keys (private signature or static DH keys) does not compromise the security of completed EDHOC exchanges. integrity is provided by the inner MAC (and signature depending on method). <del> The data rates in many IoT deployments are very limited.  Given that the application keys are protected as well as the long-term authentication keys they can often be used for years or even decades before the cryptographic limits are reached.  If the application keys established through EDHOC need to be renewed, the communicating parties can derive application keys with other labels or run EDHOC again. </del> Requirement for how to securely generate, validate, and process the ephemeral public keys depend on the elliptic curve.  For X25519 and X448, the requirements are defined in RFC7748.  For secp256r1,

Comment by Robert Moskowitz
I think the forward secrecy could use some more text. Right know we are using the definition according to the IETF security dictionary, but as the security dictionary states, a lot of different definitions is used. The draft that the KeyUpdate gives much better security than using a single key, but that the KeyUpdate method gives a lower security level than frequently running ephemeral diffie-hellman

in deployments where no protected application data is sent from R to I.  <ins> A key material exporter and a key update function enabling forward secrecy. </ins> Verification of a common preferred cipher suite: The EDHOC-KeyUpdate takes a nonce as input to guarantee that there are no short cycles.  The Initiator and the Responder need to agree  <ins> on the nonce, which can e.g., be a counter or a random number.  While the KeyUpdate method provides forward secrecy it does not give as strong security properties as re-running EDHOC, see security. </ins> 5. the Initiator and the Responder. As required by RFC7258, IETF protocols need to mitigate pervasive  <ins> monitoring when possible.  EDHOC therefore only supports methods with ephemeral Diffie-Hellman and provides a KeyUpdate function for lightweight application protocol rekeying with forward secrecy.  As discussed in RFC4949 the term "forward secrecy" is a muddled area. EDHOC provides forward secrecy in the sense that compromise of the private authentication keys does not compromise past session keys, and compromise of a session key does not compromise past session keys. While the KeyUpdate method can be used to meet cryptographic limits and provide partial protection against key leakage, it provides significantly weaker security properties than re-running EDHOC with ephemeral Diffie-Hellman.  Even with frequent use of KeyUpdate, compromise of one session key compromises all future session keys, and an attacker therefore only needs to perform static key exfiltration RFC7624.  Frequently re-running EDHOC with ephemeral Diffie-Hellman forces attackers to perform dynamic key exfiltration instead of static key exfiltration RFC7624.  In the dynamic case, the attacker must have continuous interactions with the collaborator, which is more complicated and has a higher risk profile than the static case. To limit the effect of breaches, it is important to limit the use of symmetrical group keys for bootstrapping.  EDHOC therefore strives to make the additional cost of using raw public keys and self-signed certificates as small as possible.  Raw public keys and self-signed certificates are not a replacement for a public key infrastructure but SHOULD be used instead of symmetrical group keys for bootstrapping. </ins> Compromise of the long-term keys (private signature or static DH keys) does not compromise the security of completed EDHOC exchanges. integrity is provided by the inner MAC (and signature depending on method).  Requirement for how to securely generate, validate, and process the ephemeral public keys depend on the elliptic curve.  For X25519 and X448, the requirements are defined in RFC7748.  For secp256r1,


Verification of a common preferred cipher suite: The Initiator lists supported cipher suites in order of <del> preference </del>  The Responder verifies that the selected cipher suite is the first supported cipher suite (or else rejects and states The Initiator needs to have a list of cipher suites it supports in order of preference.  The Responder needs to have a list of cipher <del> suites it supports.  SUITES_I is a CBOR array containing cipher suites that the Initiator supports.  SUITES_I is formatted and processed as detailed in asym-msg1-form to secure the cipher suite negotiation.  Examples of cipher suite negotiation are given in ex- neg. </del>  3.7. The applicability statement may also contain information about supported cipher suites.  The procedure for selecting and verifying <del> cipher suite is still performed as specified by the protocol, but it may become simplified by this knowledge. </del>  An example of an applicability statement is shown in appl-temp. METHOD = 0, 1, 2, or 3 (see fig-method-types). <del> SUITES_I - cipher suites which the Initiator supports in order of (decreasing) preference.  The list of supported cipher suites can be truncated at the end, as is detailed in the processing steps below and wrong-selected.  One of the supported cipher suites is selected.  The selected suite is the first suite in the SUITES_I CBOR array.  If a single supported cipher suite is conveyed, then that cipher suite is selected and SUITES_I is encoded as an int instead of an array. </del>  G_X - the ephemeral public key of the Initiator The Initiator SHALL compose message_1 as follows: The supported cipher suites and the order of preference MUST NOT <del> be changed based on previous error messages.  However, the list SUITES_I sent to the Responder MAY be truncated such that cipher suites which are the least preferred are omitted.  The amount of truncation MAY be changed between sessions, e.g., based on previous error messages (see next bullet), but all cipher suites which are more preferred than the least preferred cipher suite in the list MUST be included in the list. </del>  The Initiator MUST select its most preferred cipher suite, conditioned on what it can assume to be supported by the Responder.  If the Initiator previously received from the Responder an error message with error code 2 (see wrong-selected) <del> indicating cipher suites supported by the Responder which also are supported by the Initiator, then the Initiator SHOULD select the most preferred cipher suite of those (note that error messages are not authenticated and may be forged). </del>  Generate an ephemeral ECDH key pair using the curve in the selected cipher suite and format it as a COSE_Key.  Let G_X be the cipher suite selected by the Initiator is not supported by the Responder, or if the Responder supports a cipher suite more preferred by the Initiator than the selected cipher suite, see resp-proc-msg1. <del> ERR_INFO is of type SUITES_R: If the Responder does not support the selected cipher suite, then SUITES_R MUST include one or more supported cipher suites.  If the Responder does not support the selected cipher suite, but supports another cipher suite in SUITES_I, then SUITES_R MUST include the first supported cipher suite in SUITES_I. </del>  6.3.1. After receiving SUITES_R, the Initiator can determine which cipher <del> suite to select for the next EDHOC session with the Responder. </del>  If the Initiator intends to contact the Responder in the future, the Initiator SHOULD remember which selected cipher suite to use until the next message_1 has been sent, otherwise the Initiator and <del> Responder will likely run into an infinite loop.  After a successful run of EDHOC, the Initiator MAY remember the selected cipher suite to use in future EDHOC sessions.  Note that if the Initiator or Responder is updated with new cipher suite policies, any cached information may be outdated. </del>  6.3.2. Assume that the Initiator supports the five cipher suites 5, 6, 7, 8, and 9 in decreasing order of preference.  Figures fig-error1 and fig- <del> error2 show examples of how the Initiator can truncate SUITES_I and how SUITES_R is used by Responders to give the Initiator information </del>  about the cipher suites that the Responder supports. In the first example (fig-error1), the Responder supports cipher suites 5, 6 or 7.  To illustrate the negotiation mechanics we let the Initiator first make a guess that the Responder supports suite 6 but not suite 5.  Since the Responder supports neither 5 nor 6, it <del> responds with an error and SUITES_R, after which the Initiator selects its most preferred supported suite.  The order of cipher suites in SUITES_R does not matter.  (If the Responder had supported suite 5, it would include it in SUITES_R of the response, and it would in that case have become the selected suite in the second message_1.) </del>  Note that the Initiator's list of supported cipher suites and order of preference is fixed (see asym-msg1-form and init-proc-msg1).

Addressing
NAME Please check if your comments are addressed.
Yes, especially in [1]. Thanks! [1] URL
-08 contained a definition of CREDx including an example when kid is used. -09 removed that example and replaces it with a RPK by value example. Now it seems like the most important use case is not well specified. This is the use case that leads to message2 being 45 bytes.
In addition the TOFU use case should likely also have a kid. Otherwise the UCCS has to be sent by value every time.
This is solved by just adding a 'kid' in the COSE_Key map
The document should say someting more about COSEKey. If IDCREDx = { 4 : keyidx } identifies a raw COSEKey, is that an error or is CREDx then the COSEKey wrapped in a UCCS without any parameters like sub?
SUITES_R is a name. The type needs to be defined and the table changed. This can be done in PR
The current definition of SUITESI is that the Initiator can chose any truncation of the list of supported cipher suites as long as the selected cipher suite is included. This works and allows the Initiator to give the Responder information about the full list. This is however a bit complex and has led to misunderstandings of the test vectors where several people thought the test vectors were wrong. i.e. the following are all valid I think we should simplify SUITESI by mandating that the last suite in the list is the selected. This makes SUITESI much easier to understand and lowers message size when an array is used. Giving the Responder info is not so important. CDDL
Maybe a recommendation that SUITES_R SHOULD contain all cipher suites that R supports.
Currently SUITESR : [ supported : 2 suite ] / suite We may keep that, or remove "supported" SUITESR : [ 2 suite ] / suite Alternatively, we may define SUITES_I : [ supported : 2* suite ] / suite Any preference?
They should be the same: or And then
This needs to be defined as a CDDL type. suites = [ 2* suite ] / suite See

Verification of a common preferred cipher suite: The Initiator lists supported cipher suites in order of  <ins> preference, ending with the selected cipher suite for the session. </ins> The Responder verifies that the selected cipher suite is the first supported cipher suite (or else rejects and states The Initiator needs to have a list of cipher suites it supports in order of preference.  The Responder needs to have a list of cipher  <ins> suites it supports.  SUITES_I contains cipher suites supported by the Initiator, formatted and processed as detailed in asym-msg1-form to secure the cipher suite negotiation.  Examples of cipher suite negotiation are given in ex-neg. </ins> 3.7. The applicability statement may also contain information about supported cipher suites.  The procedure for selecting and verifying  <ins> cipher suite is still performed as described in asym-msg1-form and wrong-selected, but it may become simplified by this knowledge. </ins> An example of an applicability statement is shown in appl-temp. METHOD = 0, 1, 2, or 3 (see fig-method-types).  <ins> SUITES_I - array of cipher suites which the Initiator supports in order of preference, starting with the most preferred and ending with the cipher suite selected for this session.  If the most preferred cipher suite is selected then SUITES_I is encoded as that cipher suite, i.e. as an int.  The processing steps are detailed below and in wrong-selected. </ins> G_X - the ephemeral public key of the Initiator The Initiator SHALL compose message_1 as follows: The supported cipher suites and the order of preference MUST NOT  <ins> be changed based on previous error messages.  SUITES_I contains the ordered list of supported cipher suites, truncated after the cipher suite selected for this session.  The selected cipher suite MAY be changed between sessions, e.g., based on previous error messages (see next bullet), but all cipher suites which are more preferred than the selected cipher suite in the list MUST be included in SUITES_I. </ins> The Initiator MUST select its most preferred cipher suite, conditioned on what it can assume to be supported by the Responder.  If the Initiator previously received from the Responder an error message with error code 2 (see wrong-selected)  <ins> indicating cipher suites supported by the Responder, then the Initiator SHOULD select the most preferred supported cipher suite among those (note that error messages are not authenticated and may be forged). </ins> Generate an ephemeral ECDH key pair using the curve in the selected cipher suite and format it as a COSE_Key.  Let G_X be the cipher suite selected by the Initiator is not supported by the Responder, or if the Responder supports a cipher suite more preferred by the Initiator than the selected cipher suite, see resp-proc-msg1.  <ins> ERR_INFO is in this case denoted SUITES_R and is of type suites, see asym-msg1-form).  If the Responder does not support the selected cipher suite, then SUITES_R MUST include one or more supported cipher suites.  If the Responder supports a cipher suite in SUITES_I other than the selected cipher suite (independently of if the selected cipher suite is supported or not) then SUITES_R MUST include the supported cipher suite in SUITES_I which is most preferred by the Initiator.  SUITES_R MAY include a single cipher suite, i.e. be encoded as an int.  If the Responder does not support any cipher suite in SUITES_I, then it SHOULD include all its supported cipher suites in SUITES_R in any order. </ins> 6.3.1. After receiving SUITES_R, the Initiator can determine which cipher  <ins> suite to select (if any) for the next EDHOC run with the Responder. </ins> If the Initiator intends to contact the Responder in the future, the Initiator SHOULD remember which selected cipher suite to use until the next message_1 has been sent, otherwise the Initiator and  <ins> Responder will likely run into an infinite loop where the Initiator selects its most preferred and the Responder sends an error with supported cipher suites.  After a successful run of EDHOC, the Initiator MAY remember the selected cipher suite to use in future EDHOC sessions.  Note that if the Initiator or Responder is updated with new cipher suite policies, any cached information may be outdated. </ins> 6.3.2. Assume that the Initiator supports the five cipher suites 5, 6, 7, 8, and 9 in decreasing order of preference.  Figures fig-error1 and fig-  <ins> error2 show examples of how the Initiator can format SUITES_I and how SUITES_R is used by Responders to give the Initiator information </ins> about the cipher suites that the Responder supports. In the first example (fig-error1), the Responder supports cipher suites 5, 6 or 7.  To illustrate the negotiation mechanics we let the Initiator first make a guess that the Responder supports suite 6 but not suite 5.  Since the Responder supports neither 5 nor 6, it  <ins> responds with SUITES_R containing the supported suites, after which the Initiator selects its most preferred supported suite.  The order of cipher suites in SUITES_R does not matter.  (If the Responder had supported suite 5, it would have included it in SUITES_R of the response, and it would in that case have become the selected suite in the second message_1.) </ins> Note that the Initiator's list of supported cipher suites and order of preference is fixed (see asym-msg1-form and init-proc-msg1).


Expand, and instantiated with the EDHOC AEAD algorithm in the selected cipher suite. <del> where info is the CBOR encoding of </del>  where label is a tstr set to the name of the derived key, IV or MAC; i.e., "KEYSTREAM_2", "MAC_2", "K_3ae", "IV_3ae", or "MAC_3". <del> context is a CBOR sequence, i.e., zero or more encoded CBOR data items </del>  length is the length of output keying material (OKM) in bytes using the EDHOC-Exporter interface defined as: where label is a registered tstr from the EDHOC Exporter Label <del> registry (exporter-label), context is a CBOR sequence defined by the </del>  application, and length is a uint defined by the application.  The (label, context) pair must be unique, i.e., a (label, context) MUST NOT be used for two different purposes.  However an application can hash function is a CBOR Sequence.  Note that H(message_1) can be computed and cached already in the processing of message_1. <del> Compute MAC_2 = EDHOC-KDF( PRK_3e2m, TH_2, "MAC_2", ( ID_CRED_R, CRED_R, ? EAD_2 ), mac_length ).  If the Responder authenticates with a static Diffie-Hellman key (method equals 1 or 3), then mac_length is the EDHOC MAC length given by the selected cipher suite.  If the Responder authenticates with a signature key (method equals 0 or 2), then mac_length is equal to the output size of the EDHOC hash algorithm given by the selected cipher suite. </del>  ID_CRED_R - identifier to facilitate retrieval of CRED_R, see function is a CBOR Sequence.  Note that H(TH_2, CIPHERTEXT_2) can be computed and cached already in the processing of message_2. <del> Compute MAC_3 = EDHOC-KDF( PRK_4x3m, TH_3, "MAC_3", ( ID_CRED_I, CRED_I, ? EAD_3 ), mac_length ).  If the Initiator authenticates with a static Diffie-Hellman key (method equals 2 or 3), then mac_length is the EDHOC MAC length given by the selected cipher suite.  If the Initiator authenticates with a signature key (method equals 0 or 1), then mac_length is equal to the output size of the EDHOC hash algorithm given by the selected cipher suite. </del>  ID_CRED_I - identifier to facilitate retrieval of CRED_I, see COSE constructs the input to the AEAD RFC5116 as follows: <del> Key K = EDHOC-KDF( PRK_3e2m, TH_3, "K_3ae", length ) </del>  <del> Nonce N = EDHOC-KDF( PRK_3e2m, TH_3, "IV_3ae", length ) </del>  Plaintext P = ( ID_CRED_I / bstr / int, Signature_or_MAC_3, ? EAD_3 ) where EAD_4 is protected external authorization data, see AD. COSE constructs the input to the AEAD RFC5116 as follows: <del> Key K = EDHOC-Exporter( "EDHOC_message_4_Key", , length ) </del>  <del> Nonce N = EDHOC-Exporter( "EDHOC_message_4_Nonce", , length ) </del>  Plaintext P = ( ? EAD_4 )

The new definition of info in th ecurrent specification is. I noticed two problems with this while implementing. To create the array you need to parse context to see how many items it contains. Unless context is validated, length is not strictly defined (an attacker could create collisions) I suggest that info is changed to:
In the exporter, the application using EDHOC could input a context (a encoded CBOR sequence) that is not valid CBOR. That is not a big problem, but might lead to security issues in the future, if is assumed that info is valid CBOR. URL prefered sequence to array. I don't think bstr wrapping the sequence has the same problems as array wrapping the sequence. Array wrapping the info sequence seems like an unesasary step. I suggest.
We have also gotten comments disliking the use of any
Current specification could give the impression that there is a single maclength. But the mac length in message2 and message_3 may be different.
One fix is to update to

Expand, and instantiated with the EDHOC AEAD algorithm in the selected cipher suite.  <ins> where info is encoded as the CBOR sequence </ins> where label is a tstr set to the name of the derived key, IV or MAC; i.e., "KEYSTREAM_2", "MAC_2", "K_3ae", "IV_3ae", or "MAC_3".  <ins> context is a bstr </ins> length is the length of output keying material (OKM) in bytes using the EDHOC-Exporter interface defined as: where label is a registered tstr from the EDHOC Exporter Label  <ins> registry (exporter-label), context is a bstr defined by the </ins> application, and length is a uint defined by the application.  The (label, context) pair must be unique, i.e., a (label, context) MUST NOT be used for two different purposes.  However an application can hash function is a CBOR Sequence.  Note that H(message_1) can be computed and cached already in the processing of message_1.  <ins> Compute MAC_2 = EDHOC-KDF( PRK_3e2m, TH_2, "MAC_2", << ID_CRED_R, CRED_R, ? EAD_2 >>, mac_length_2 ).  If the Responder authenticates with a static Diffie-Hellman key (method equals 1 or 3), then mac_length_2 is the EDHOC MAC length given by the selected cipher suite.  If the Responder authenticates with a signature key (method equals 0 or 2), then mac_length_2 is equal to the output size of the EDHOC hash algorithm given by the selected cipher suite. </ins> ID_CRED_R - identifier to facilitate retrieval of CRED_R, see function is a CBOR Sequence.  Note that H(TH_2, CIPHERTEXT_2) can be computed and cached already in the processing of message_2.  <ins> Compute MAC_3 = EDHOC-KDF( PRK_4x3m, TH_3, "MAC_3", << ID_CRED_I, CRED_I, ? EAD_3 >>, mac_length_3 ).  If the Initiator authenticates with a static Diffie-Hellman key (method equals 2 or 3), then mac_length_3 is the EDHOC MAC length given by the selected cipher suite.  If the Initiator authenticates with a signature key (method equals 0 or 1), then mac_length_3 is equal to the output size of the EDHOC hash algorithm given by the selected cipher suite. </ins> ID_CRED_I - identifier to facilitate retrieval of CRED_I, see COSE constructs the input to the AEAD RFC5116 as follows:  <ins> Key K = EDHOC-KDF( PRK_3e2m, TH_3, "K_3ae", h'', length ) </ins>  <ins> Nonce N = EDHOC-KDF( PRK_3e2m, TH_3, "IV_3ae", h'', length ) </ins> Plaintext P = ( ID_CRED_I / bstr / int, Signature_or_MAC_3, ? EAD_3 ) where EAD_4 is protected external authorization data, see AD. COSE constructs the input to the AEAD RFC5116 as follows:  <ins> Key K = EDHOC-Exporter( "EDHOC_message_4_Key", h'', length ) </ins>  <ins> Nonce N = EDHOC-Exporter( "EDHOC_message_4_Nonce", h'', length ) </ins> Plaintext P = ( ? EAD_4 )


8.1. IANA has created a new registry titled "EDHOC Exporter Label" under <del> the new heading "EDHOC".  The registration procedure is "Expert Review".  The columns of the registry are Label, Description, and Reference.  All columns are text strings.  The initial contents of the registry are: </del>  8.2. IANA has created a new registry titled "EDHOC Cipher Suites" under <del> the new heading "EDHOC".  The registration procedure is "Expert Review".  The columns of the registry are Value, Array, Description, and Reference, where Value is an integer and the other columns are text strings.  The initial contents of the registry are: </del>  8.3. IANA has created a new registry entitled "EDHOC Method Type" under <del> the new heading "EDHOC".  The registration procedure is "Expert Review".  The columns of the registry are Value, Description, and Reference, where Value is an integer and the other columns are text strings.  The initial contents of the registry are shown in fig- method-types. </del>  8.4. IANA has created a new registry entitled "EDHOC Error Codes" under <del> the new heading "EDHOC".  The registration procedure is "Specification Required".  The columns of the registry are ERR_CODE, ERR_INFO Type and Description, where ERR_CODE is an integer, ERR_INFO is a CDDL defined type, and Description is a text string.  The initial contents of the registry are shown in fig-error-codes. </del>  8.5. IANA has created a new registry entitled "EDHOC External <del> Authorization Data" under the new heading "EDHOC".  The registration procedure is "Expert Review".  The columns of the registry are Value, Description, and Reference, where Value is an integer and the other columns are text strings. </del>  8.6. <del> This document registers the following entries in the "COSE Header Parameters" registry under the "CBOR Object Signing and Encryption (COSE)" heading.  The value of the 'cwt' header parameter is a COSE Web Token (CWT) RFC8392 and the value of the 'uccs' header parameter is an Unprotected CWT Claims Set (UCCS), see term. </del>  8.7. <del> IANA has extended the Value Type of the COSE Header Parameter 'kid' to also allow the Value Type int.  The resulting Value Type is bstr / int.  The 'kid' parameter can be used to identify a key stored in a UCCS, in a CWT, or in a public key certificate.  (The Value Registry for this item is empty and omitted from the table below.) </del>  8.8. <del> IANA has extended the Value Type of the COSE Key Common Parameter 'kid' to the COSE Key Value Type int.  The resulting Value Type is bstr / int.  (The Value Registry for this item is empty and omitted from the table below.) </del>  8.9. <del> IANA has extended the Value Type of the WT Confirmation Methods 'kid' to the COSE Key Value Type int.  The incorrect term binary string has been corrected to bstr.  The resulting Value Type is bstr / int.  The new updated content for the 'kid' method is shown in the list below. </del>  Confirmation Method Name: kid 8.10. <del> IANA has added the well-known URI "edhoc" to the Well-Known URIs registry. </del>  URI suffix: edhoc 8.11. <del> IANA has added the media type "application/edhoc" to the Media Types registry. </del>  Type name: application 8.12. <del> IANA has added the media type "application/edhoc" to the CoAP Content-Formats registry. </del>  Media Type: application/edhoc 8.13.  The IANA Registries established in this document is defined as "Expert Review".  This section gives some general guidelines for what the experts should be looking for, but they are being designated as

A new Resource Type (rt=) Link Target attribute like "URL" may be registered in the "Resource Type (rt=) Link Target Attribute Values" subregistry under the "Constrained RESTful Environments (CoRE) Parameters" registry.
That seems like a good idea.
Marco, do you want to provide a PR? Then we could merge that for -11
Done, see URL Note that the first commit is just about removing trailing whitespace to avoid compiling errors. The content you need is in the commit URL
Looks good. I tried to align the whole IANA section with RFC 8126. Then I merged.

8.1. IANA has created a new registry titled "EDHOC Exporter Label" under  <ins> the new group name "Ephemeral Diffie-Hellman Over COSE (EDHOC)".  The registration procedure is "Expert Review".  The columns of the registry are Label, Description, and Reference.  All columns are text strings.  The initial contents of the registry are: </ins> 8.2. IANA has created a new registry titled "EDHOC Cipher Suites" under  <ins> the new group name "Ephemeral Diffie-Hellman Over COSE (EDHOC)".  The registration procedure is "Expert Review".  The columns of the registry are Value, Array, Description, and Reference, where Value is an integer and the other columns are text strings.  The initial contents of the registry are: </ins> 8.3. IANA has created a new registry entitled "EDHOC Method Type" under  <ins> the new group name "Ephemeral Diffie-Hellman Over COSE (EDHOC)".  The registration procedure is "Expert Review".  The columns of the registry are Value, Description, and Reference, where Value is an integer and the other columns are text strings.  The initial contents of the registry are shown in fig-method-types. </ins> 8.4. IANA has created a new registry entitled "EDHOC Error Codes" under  <ins> the new group name "Ephemeral Diffie-Hellman Over COSE (EDHOC)".  The registration procedure is "Specification Required".  The columns of the registry are ERR_CODE, ERR_INFO Type and Description, where ERR_CODE is an integer, ERR_INFO is a CDDL defined type, and Description is a text string.  The initial contents of the registry are shown in fig-error-codes. </ins> 8.5. IANA has created a new registry entitled "EDHOC External  <ins> Authorization Data" under the new group name "Ephemeral Diffie- Hellman Over COSE (EDHOC)".  The registration procedure is "Expert Review".  The columns of the registry are Value, Description, and Reference, where Value is an integer and the other columns are text strings. </ins> 8.6.  <ins> IANA has registered the following entries in the "COSE Header Parameters" registry under the group name "CBOR Object Signing and Encryption (COSE)".  The value of the 'cwt' header parameter is a COSE Web Token (CWT) RFC8392 and the value of the 'uccs' header parameter is an Unprotected CWT Claims Set (UCCS), see term.  The Value Registry for this item is empty and omitted from the table below. </ins> 8.7.  <ins> IANA has extended the Value Type of 'kid' in the "COSE Header Parameters" registry under the group name "CBOR Object Signing and Encryption (COSE)" to also allow the Value Type int.  The resulting Value Type is bstr / int.  The Value Registry for this item is empty and omitted from the table below. </ins> 8.8.  <ins> IANA has extended the Value Type of 'kid' in the "COSE Key Common Parameters" registry under the group name "CBOR Object Signing and Encryption (COSE)" to also allow the Value Type int.  The resulting Value Type is bstr / int.  The Value Registry for this item is empty and omitted from the table below. </ins> 8.9.  <ins> IANA has extended the Value Type of 'kid' in the "CWT Confirmation Methods" registry under the group name "CBOR Web Token (CWT) Claims" to also allow the Value Type int.  The incorrect term binary string has been corrected to bstr.  The resulting Value Type is bstr / int. The new updated content for the 'kid' method is shown in the list below. </ins> Confirmation Method Name: kid 8.10.  <ins> IANA has added the well-known URI "edhoc" to the "Well-Known URIs" registry under the group name "Well-Known URIs". </ins> URI suffix: edhoc 8.11.  <ins> IANA has added the media type "application/edhoc" to the "Media Types" registry. </ins> Type name: application 8.12.  <ins> IANA has added the media type "application/edhoc" to the "CoAP Content-Formats" registry under the group name "Constrained RESTful Environments (CoRE) Parameters". </ins> Media Type: application/edhoc 8.13. <ins> IANA has added the resource type "core.edhoc" to the "Resource Type (rt=) Link Target Attribute Values" registry under the group name "Constrained RESTful Environments (CoRE) Parameters". Value: "core.edhoc" Description: EDHOC resource. Reference: [[this document]] Client applications can use this resource type to discover a server's resource for EDHOC, where to send a request for executing the EDHOC protocol. 8.14. </ins> The IANA Registries established in this document is defined as "Expert Review".  This section gives some general guidelines for what the experts should be looking for, but they are being designated as


3.3. EDHOC includes the selection of connection identifiers (C_I, C_R) <del> identifying a connection for which keys are agreed.  Connection identifiers may be used in the ongoing EDHOC protocol (see ci-edhoc) or in a subsequent application protocol, e.g., OSCORE (see ci- oscore).  The connection identifiers do not have any cryptographic purpose in EDHOC. </del>  Connection identifiers in EDHOC are byte strings or integers, encoded in CBOR.  One byte connection identifiers (the integers -24 to 23 and 3.3.2. <del> Connection identifiers may be used to correlate EDHOC messages and facilitate the retrieval of protocol state during EDHOC protocol execution.  EDHOC transports that do not inherently provide correlation across all messages of an exchange can send connection identifiers along with EDHOC messages to gain that required capability, see transport.  For an example of using connection identifiers when CoAP is used as transport, see coap. 3.3.3. </del> For OSCORE, the choice of a connection identifier results in the endpoint selecting its Recipient ID, see Section 3.1 of RFC8613, for which certain uniqueness requirements apply, see Section 3.3 of fragmentation, <del> demultiplex EDHOC messages from other types of messages, and </del>  <del> denial-of-service protection. </del>  <del> Besides these common transport-oriented properties, EDHOC transport additionally needs to support the correlation between EDHOC messages, including an indication of a message being message_1.  The </del>  correlation may reuse existing mechanisms in the transport protocol. For example, the CoAP Token may be used to correlate EDHOC messages <del> in a CoAP response and an associated CoAP request.  In the absence of correlation between a message received and a message previously sent inherent to the transport, the EDHOC connection identifiers may be added, e.g., by prepending the appropriate connection identifier </del>  (when available from the EDHOC protocol) to the EDHOC message. Transport of EDHOC in CoAP payloads is described in coap, which also shows how to use connection identifiers and message_1 indication with CoAP. <del> The Initiator and the Responder need to have agreed on a transport to be used for EDHOC, see applicability. </del> 3.5. EDHOC enables public-key based authentication and supports various

There was quite a lot of overlap between 3.3.2 and 3.4. Tried to integrate 3.3.2 in 3.4 to avoid that.

3.3. EDHOC includes the selection of connection identifiers (C_I, C_R)  <ins> identifying a connection for which keys are agreed. Connection identifiers may be used to correlate EDHOC messages and facilitate the retrieval of protocol state during EDHOC protocol execution (see transport) or in a subsequent application protocol, e.g., OSCORE (see ci-oscore).  The connection identifiers do not have any cryptographic purpose in EDHOC. </ins> Connection identifiers in EDHOC are byte strings or integers, encoded in CBOR.  One byte connection identifiers (the integers -24 to 23 and 3.3.2.  For OSCORE, the choice of a connection identifier results in the endpoint selecting its Recipient ID, see Section 3.1 of RFC8613, for which certain uniqueness requirements apply, see Section 3.3 of fragmentation,  <ins> demultiplex EDHOC messages from other types of messages, denial-of-service protection, </ins>  <ins> message correlation. </ins>  <ins> The Initiator and the Responder need to have agreed on a transport to be used for EDHOC, see applicability. 3.4.1. The transport needs to support the correlation between EDHOC messages and facilitate the retrieval of protocol state during EDHOC protocol execution, including an indication of a message being message_1.  The </ins> correlation may reuse existing mechanisms in the transport protocol. For example, the CoAP Token may be used to correlate EDHOC messages  <ins> in a CoAP response and an associated CoAP request. Connection identifiers may be used to correlate EDHOC messages and facilitate the retrieval of protocol state during EDHOC protocol execution.  EDHOC transports that do not inherently provide correlation across all messages of an exchange can send connection identifiers along with EDHOC messages to gain that required capability, e.g., by prepending the appropriate connection identifier </ins> (when available from the EDHOC protocol) to the EDHOC message. Transport of EDHOC in CoAP payloads is described in coap, which also shows how to use connection identifiers and message_1 indication with CoAP.  3.5. EDHOC enables public-key based authentication and supports various


where <del> edhoc_aead_id is an int or tstr containing the algorithm identifier of the EDHOC AEAD algorithm in the selected cipher suite encoded as defined in I-D.ietf-cose-rfc8152bis-algs.  Note that a single fixed edhoc_aead_id is used in all invocations of EDHOC-KDF, including the derivation of KEYSTREAM_2 and invocations of the EDHOC-Exporter (see exporter). </del>  transcript_hash is a bstr set to one of the transcript hashes TH_2, TH_3, or TH_4 as defined in Sections asym-msg2-form, asym-

This simplify things. The selected cipher suite also covers more than just the aead algorithm. I think the "suite = int" definition can be removed. It does not add much in the current version. In older versions suite was a more advances construction.
The selected cipher suite covers the aead and more.
selectedsuite is always included in transcripthash and could be removed. I.e. an equally secure info would be info = ( transcript_hash : bstr, label : tstr, context : bstr, length : uint, )
Agree, we can close this.
This has been merged to master.

where  <ins> selected_suite is an int containing the selected cipher suite. </ins> transcript_hash is a bstr set to one of the transcript hashes TH_2, TH_3, or TH_4 as defined in Sections asym-msg2-form, asym-


An implementation may support only a single method.  None of the methods are mandatory-to-implement.  Implementations MUST support the EDHOC-Exporter.  Implementations SHOULD support EDHOC-KeyUpdate. <del> Implementaions MAY support message_4.  Error codes 1 and 2 MUST be </del>  supported. <del> Implementations MUST support 'kid' parameters of type int. Editor's note: Is any COSE header parameters (kid, kcwt, kccs, x5t, c5c, etc. ) MTI? Editor's note: Is any credential type (CCS, CWT, X.509, C509) MTI? Editor's note: Is support of EAD MTI? </del>  For many constrained IoT devices it is problematic to support more than one cipher suite.  Existing devices can be expected to support

Suggestion base the discussion during the October interim. There was no strong opinions. This PR updates the MTI for header parameters and credential types to align with the choices made for method (none is MTI). EAD is explicitly optional to support. It is used in specific cases and requires additional mechanics for each use case.
The things that are Mandatory or optional to support or now spread out in various places.
This does not need to be a new section (like the MTI section in TLS 1.3) but it definitly needs to be clear what in the draft is mandatory to implement or not. Could be as simple as stating. Everything is mandatory Nothing is mandatory Something in between Currently is is undefined which is not good I think
I started making an MTI section inspired by RFC 8446. I think this makes things clearer. I added some editorial notes in the section that needs to be discussed.
MTI section now in place and no editor's notes left.

An implementation may support only a single method.  None of the methods are mandatory-to-implement. <ins> Implementations MUST support 'kid' parameters of type int.  None of the other COSE header parameters are mandatory-to-implement. An implementation may support only a single credential type (CCS, CWT, X.509, C509).  None of the credential types are mandatory-to- implement. </ins> Implementations MUST support the EDHOC-Exporter.  Implementations SHOULD support EDHOC-KeyUpdate.  <ins> Implementations MAY support message_4.  Error codes 1 and 2 MUST be </ins> supported.  <ins> Implementations MAY support EAD. </ins> For many constrained IoT devices it is problematic to support more than one cipher suite.  Existing devices can be expected to support