rfc9594v4.txt | rfc9594.txt | |||
---|---|---|---|---|
Internet Engineering Task Force (IETF) F. Palombini | Internet Engineering Task Force (IETF) F. Palombini | |||
Request for Comments: 9594 Ericsson AB | Request for Comments: 9594 Ericsson AB | |||
Category: Standards Track M. Tiloca | Category: Standards Track M. Tiloca | |||
ISSN: 2070-1721 RISE AB | ISSN: 2070-1721 RISE AB | |||
July 2024 | August 2024 | |||
Key Provisioning for Group Communication Using Authentication and | Key Provisioning for Group Communication Using Authentication and | |||
Authorization for Constrained Environments (ACE) | Authorization for Constrained Environments (ACE) | |||
Abstract | Abstract | |||
This document defines how to use the Authentication and Authorization | This document defines how to use the Authentication and Authorization | |||
for Constrained Environments (ACE) framework to distribute keying | for Constrained Environments (ACE) framework to distribute keying | |||
material and configuration parameters for secure group communication. | material and configuration parameters for secure group communication. | |||
Candidate group members that act as Clients and are authorized to | Candidate group members that act as Clients and are authorized to | |||
skipping to change at line 1318 ¶ | skipping to change at line 1318 ¶ | |||
Response: | Response: | |||
Header: Service Unavailable (Code=5.03) | Header: Service Unavailable (Code=5.03) | |||
Content-Format: application/concise-problem-details+cbor | Content-Format: application/concise-problem-details+cbor | |||
Payload: | Payload: | |||
{ | { | |||
/ title / -1: "No available node identifiers", | / title / -1: "No available node identifiers", | |||
/ detail / -2: "Things will change after a | / detail / -2: "Things will change after a | |||
group rekeying; try later", | group rekeying; try later", | |||
/ ace-groupcomm-error / 0: { | / ace-groupcomm-error / 0: { | |||
/ error-id / 0: 4 / "No available node identifiers" /, | / error-id / 0: 4 / "No available node identifiers" / | |||
} | } | |||
} | } | |||
Figure 6: Example of an Error Response with Problem Details | Figure 6: Example of an Error Response with Problem Details | |||
The problem-details format (in general) and the Custom Problem Detail | The problem-details format (in general) and the Custom Problem Detail | |||
entry 'ace-groupcomm-error' (in particular) are OPTIONAL for Clients | entry 'ace-groupcomm-error' (in particular) are OPTIONAL for Clients | |||
to support. A Client supporting the entry 'ace-groupcomm-error' and | to support. A Client supporting the entry 'ace-groupcomm-error' and | |||
that can understand the specified error may use that information to | that can understand the specified error may use that information to | |||
determine what actions to take next. | determine what actions to take next. | |||
skipping to change at line 1540 ¶ | skipping to change at line 1540 ¶ | |||
inclusion_flag = bool | inclusion_flag = bool | |||
role = tstr | role = tstr | |||
comb_role = [ 2*role ] | comb_role = [ 2*role ] | |||
role_filter = [ *(role / comb_role) ] | role_filter = [ *(role / comb_role) ] | |||
id = bstr | id = bstr | |||
id_filter = [ *id ] | id_filter = [ *id ] | |||
get_creds = null / [ inclusion_flag, role_filter, id_filter] | get_creds = null / [ inclusion_flag, role_filter, id_filter ] | |||
Figure 9: CDDL Definition of 'get_creds', Using an Example | Figure 9: CDDL Definition of 'get_creds', Using an Example | |||
Node Identifier Encoded as bstr and Role as tstr | Node Identifier Encoded as bstr and Role as tstr | |||
* 'client_cred': encoded as a CBOR byte string, whose value is the | * 'client_cred': encoded as a CBOR byte string, whose value is the | |||
original binary representation of the Client's authentication | original binary representation of the Client's authentication | |||
credential. This parameter MUST be present if the KDC is managing | credential. This parameter MUST be present if the KDC is managing | |||
(collecting from and distributing to Clients) the authentication | (collecting from and distributing to Clients) the authentication | |||
credentials of the group members and the Client's role in the | credentials of the group members and the Client's role in the | |||
group will require the Client to send messages to one or more | group will require the Client to send messages to one or more | |||
skipping to change at line 2216 ¶ | skipping to change at line 2216 ¶ | |||
/ client_cred_verify / 24: h'66e6d9b0db009f3e105a673f88556117 | / client_cred_verify / 24: h'66e6d9b0db009f3e105a673f88556117 | |||
26caed57f530f8cae9d0b168513ab949 | 26caed57f530f8cae9d0b168513ab949 | |||
fedc3e80a96ebe94ba08d3f8d3bf8348 | fedc3e80a96ebe94ba08d3f8d3bf8348 | |||
7458e2ab4c2f936ff78b50e33c885e35' | 7458e2ab4c2f936ff78b50e33c885e35' | |||
} | } | |||
Response: | Response: | |||
Header: Created (Code=2.01) | Header: Created (Code=2.01) | |||
Content-Format: application/ace-groupcomm+cbor | Content-Format: application/ace-groupcomm+cbor | |||
Location-Path: "ace-group" | ||||
Location-Path: "g1" | Location-Path: "g1" | |||
Location-Path: "nodes" | Location-Path: "nodes" | |||
Location-Path: "c101" | Location-Path: "c101" | |||
Payload (in CBOR diagnostic notation): | Payload (in CBOR diagnostic notation): | |||
{ | { | |||
/ gkty / 7: 65600, | / gkty / 7: 65600, | |||
/ key / 8: h'73657373696f6e6b6579', | / key / 8: h'73657373696f6e6b6579', | |||
/ num / 9: 12, | / num / 9: 12, | |||
/ exp / 11: 1924992000, | / exp / 11: 1924992000, | |||
/ exi / 12: 2592000, | / exi / 12: 2592000, | |||
skipping to change at line 2546 ¶ | skipping to change at line 2547 ¶ | |||
405c47bf16df96660a41298cb4307f7e | 405c47bf16df96660a41298cb4307f7e | |||
b62258206e5de611388a4b8a8211334a | b62258206e5de611388a4b8a8211334a | |||
c7d37ecb52a387d257e6db3c2a93df21 | c7d37ecb52a387d257e6db3c2a93df21 | |||
ff3affc8', | ff3affc8', | |||
h'a2026008a101a5010202410920012158 | h'a2026008a101a5010202410920012158 | |||
206f9702a66602d78f5e81bac1e0af01 | 206f9702a66602d78f5e81bac1e0af01 | |||
f8b52810c502e87ebb7c926c07426fd0 | f8b52810c502e87ebb7c926c07426fd0 | |||
2f225820c8d33274c71c9b3ee57d842b | 2f225820c8d33274c71c9b3ee57d842b | |||
bf2238b8283cb410eca216fb72a78ea7 | bf2238b8283cb410eca216fb72a78ea7 | |||
a870f800'], | a870f800'], | |||
/ peer_roles / 14: [ ["sender", "receiver"], "receiver" ], | / peer_roles / 14: [["sender", "receiver"], "receiver"], | |||
/ peer_identifiers / 15: [h'02', h'03'] | / peer_identifiers / 15: [h'02', h'03'] | |||
} | } | |||
Figure 17: Example of Authentication Credential Request-Response | Figure 17: Example of Authentication Credential Request-Response | |||
to Obtain the Authentication Credentials of Specific Group | to Obtain the Authentication Credentials of Specific Group | |||
Members | Members | |||
4.4.2. GET Handler | 4.4.2. GET Handler | |||
The handler expects a GET request. | The handler expects a GET request. | |||
End of changes. 5 change blocks. | ||||
4 lines changed or deleted | 5 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. |