]> RISE AB

Isafjordsgatan 22 Kista 164 40 Sweden marco.tiloca@ri.se

Hollandstr. 12/4 Vienna 1020 Austria christian@amsuess.com

stokcons@kpnmail.nl

Web and Internet Transport CoRE Working Group Internet-Draft Group communication over the Constrained Application Protocol (CoAP) can be secured by means of Group Object Security for Constrained RESTful Environments (Group OSCORE). At deployment time, devices might not know the exact security groups to join, the respective Group Managers responsible for those groups, or other information required to perform the joining process. This document defines how a CoAP endpoint can use descriptions and links of resources registered at the CoRE Resource Directory to discover security groups and to acquire information for joining them through the respective Group Managers. A given security group can be used to protect communications in multiple application groups, which are separately announced in the Resource Directory as sets of endpoints sharing a pool of resources. This approach is consistent with, but not limited to, the joining of security groups based on the Authentication and Authorization for Constrained Environments (ACE) framework. Discussion Venues Discussion of this document takes place on the Constrained RESTful Environments Working Group mailing list (core@ietf.org), which is archived at . Source for this draft and an issue tracker can be found at .

Introduction The Constrained Application Protocol (CoAP) supports group communication , e.g., over IP multicast, to improve efficiency and latency of communication and reduce bandwidth requirements. A set of CoAP endpoints constitutes an application group by sharing a common pool of resources that can be efficiently accessed through group communication. The members of an application group can be members of a security group, thus sharing a common set of keying material to secure group communication. The security protocol Group Object Security for Constrained RESTful Environments (Group OSCORE) builds on OSCORE and protects CoAP messages end-to-end in group communication scenarios through CBOR Object Signing and Encryption (COSE) . An application group can rely on one or more security groups. Also, a security group can be used by multiple application groups at the same time. A CoAP endpoint relies on a Group Manager (GM) to join a security group and obtain the corresponding group keying material. The joining process specified in is based on the Authentication and Authorization for Constrained Environments (ACE) framework , with the joining endpoint and the GM acting as ACE client and resource server, respectively. That is, the joining endpoint accesses the group-membership resource hosted at the GM and associated with the security group to join. Typically, devices store a static X.509 IDevID certificate installed at manufacturing time . This is used at deployment time during an enrollment process that provides the devices with an Operational Certificate, possibly updated during the device lifetime. Operational Certificates may specify information to join security groups, especially a reference to the group-membership resources to access at the respective GMs. However, it is usually impossible to provide such precise information to freshly deployed devices, as part of their (early) Operational Certificate. This can be due to a number of reasons:

• The security group(s) to join and the responsible GM(s) are generally unknown at manufacturing time.
• A security group of interest is created, or the responsible GM is deployed, only after the device is enrolled and fully operative in the network.
• Information related to existing security groups or to their GMs has changed.

This requires a method for CoAP endpoints to dynamically discover security groups and their GM and to retrieve relevant information about deployed groups. To this end, CoAP endpoints can use descriptions and links of group-membership resources at GMs, in order to discover security groups and retrieve the information required for joining them. With the discovery process of security groups expressed in terms of links to resources, the remaining problem is the discovery of those links. The CoRE Resource Directory (RD) makes it possible to perform such discovery in an efficient way and it is expected to be used in many setups that would benefit of security group discovery. This document builds on that approach and defines how CoAP endpoints can use the RD to perform the link discovery steps, in order to discover security groups and retrieve the information required to join them through their GM. In short, the GM registers as an endpoint with the RD. The resulting registration resource includes one link per security group under that GM, specifying the path to the related group-membership resource to access for joining that group. Additional descriptive information about the security group is stored with the registered link. In an RD based on the Constrained RESTful Environments (CoRE) Link Format as defined in , this information is specified as target attributes of the registered link and includes the identifiers of the application groups that use that security group. This enables a lookup of those application groups at the RD, where they are separately announced by a Commissioning Tool (see ). When querying the RD for security groups, a CoAP endpoint can use CoAP observation . This results in automatic notifications on the creation of new security groups or on the update of existing groups. Thus, it facilitates the early deployment of CoAP endpoints, i.e., even before the GM is deployed and security groups are created. Interaction examples are provided in the CoRE Link Format with reference to the RD defined in as well as in the Constrained RESTful Application Language CoRAL with reference to a CoRAL-based RD such as the one defined in . The examples in CoRAL are expressed in the Concise Binary Object Representation (CBOR) extended diagnostic notation as defined in and ("diagnostic notation"), and they refer to values from external dictionaries using Packed CBOR . Diagnostic notation comments are often used to provide a textual representation of the numeric parameter names and values. introduces the notation and assumptions used in the CoRAL examples. The approach defined in this document is consistent with, but not limited to, the joining of security groups defined in .

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. Readers are expected to be familiar with the terms and concepts from the following specifications.

• The CoRE Link Format and the CoRE Resource Directory .
• The Constrained RESTful Application Language (CoRAL) and Constrained Resource Identifiers (CRIs) .
• CBOR and Packed CBOR .
• CoAP , also in group communication scenarios .
• The security protocol Group Object Security for Constrained RESTful Environments (Group OSCORE) and the joining of security groups defined in .

Consistent with the definitions from , this document also refers to the following terminology.

• CoAP group: a set of CoAP endpoints that are all configured to receive CoAP multicast messages sent to the group's associated IP multicast address and UDP port number. An endpoint can be a member of multiple CoAP groups by subscribing to multiple IP multicast addresses.
• Security group: a set of CoAP endpoints that share the same security material and use it to protect and verify exchanged messages. A CoAP endpoint can be a member of multiple security groups. Between security groups and CoAP groups, there can be a many-to-many, one-to-many, many-to-one, or one-to-one relationship. This document especially considers a security group to be an OSCORE group, i.e., all members share one Group OSCORE Security Context to protect group communication with Group OSCORE . However, the approach defined in this document can be used to support the discovery of different security groups than OSCORE groups.
• Application group: a set of CoAP endpoints that share a common set of resources. An endpoint can be a member of multiple application groups. Between application groups and security groups, there can be a many-to-many, one-to-many, many-to-one, or one-to-one relationship. Application groups are announced in the RD by a Commissioning Tool, according to the RD-Groups usage pattern (see ).

Like , this document also uses the following term.

• Authentication credential: information associated with an entity, including that entity's public key and parameters associated with the public key. Examples of formats of authentication credentials are CBOR Web Tokens (CWTs) and CWT Claims Sets (CCSs) , X.509 certificates , and C509 certificates .

Terminology for constrained environments is defined in .

Notation and Assumptions in the CoRAL Examples As per , CoRAL expresses Uniform Resource Identifiers (URIs) as Constrained Resource Identifier (CRI) references . Throughout this document, the examples in CoRAL use the following notation. When using the CURIE syntax , the following applies:

• 'linkformat' stands for http://www.iana.org/assignments/linkformat/ This URI is to be defined with IANA, together with other URIs that build on it through further path segments, e.g., http://www.iana.org/assignments/linkformat/rt
• 'rel' stands for http://www.iana.org/assignments/relation/ This URI is to be defined with IANA, together with other URIs that build on it through further path segments, e.g., http://www.iana.org/assignments/relation/hosts
• 'reef' stands for http://coreapps.org/reef

When using a URI http://www.iana.org/assignments/linkformat/SEG1/SEG2

• The path segment SEG1 is the name of a web link target attribute. Names of target attributes used in the CoRE Link Format are expected to be coordinated through the "Target Attributes" registry defined in .
• The path segment SEG2 is the value of the target attribute indicated by the path segment SEG1.

When using a URI http://www.iana.org/assignments/relation/SEG , the path segment SEG denotes a Web Linking relation type . The application-extension identifier "cri" defined in is used to notate a Concise Diagnostic Notation (CDN) literal for a CRI or CRI reference. This format is not expected to be sent over the network. Packed CBOR is also used, thus reducing representation size. The examples especially refer to the values from the three shared item tables in . Finally, the examples use the CoAP Content-Format ID 65087 for the media type "application/coral+cbor" defined in .

Registration of Group Manager Endpoints During deployment, a Group Manager (GM) can find the CoRE Resource Directory (RD) as described in . Afterwards, the GM registers as an endpoint with the RD, as described in . The GM SHOULD NOT use the Simple Registration approach described in . When registering with the RD, the GM also registers the links to all the group-membership resources that it has at that point in time, i.e., one for each of its security groups. In the registration request, each link to a group-membership resource has as target the URI of that resource at the GM. Also, it specifies a number of descriptive parameters as defined in . Furthermore, the GM MAY additionally register the link to its resource implementing the ACE authorization information endpoint (see ). A joining node can provide the GM with its own access token by sending it in a request targeting that resource, thus proving to be authorized to join certain security groups (see ). In such a case, the link MUST include the parameter 'rt', with value "ace.ai" (see ).

Parameters For each registered link to a group-membership resource at a GM, the following parameters are specified together with the link. In the RD defined in and based on the CoRE Link Format, each parameter is specified in a target attribute with the same name. In an RD based on CoRAL, such as the one defined in , each parameter is specified in a nested element with the same name.

• 'ct', specifying 261 as the ID of the CoAP Content-Format used for interactions with the group-membership resource at the Group Manager. This is associated with the media type "application/ace-groupcomm+cbor" and is registered in .
• 'rt', specifying the resource type of the group-membership resource at the Group Manager, with value "core.osc.gm" registered in .
• 'if', specifying the interface description for accessing the group-membership resource at the Group Manager, with value "ace.group" registered in .
• 'sec-gp', specifying the name of the security group of interest as a stable and invariant identifier, such as the group name used in . This parameter MUST specify a single value.
• 'app-gp', specifying the name of an application group associated with the security group of interest indicated by 'sec-gp'. This parameter MUST occur once for each application group associated with the security group, and each occurrence MUST specify only a single application group. When a security group is created at the GM, the names of the application groups using it are also specified as part of the security group configuration (see and ). Thus, when registering the links to its group-membership resource, the GM is aware of those application groups and their names. If a different entity than the GM registers the security groups to the RD (e.g., a Commissioning Tool), this entity has to also be aware of the application groups and their names to specify. To this end, it can obtain them from the GM or from the Administrator that created the security groups at the GM (see and ).

Optionally, the following parameters can also be specified. If the CoRE Link Format is used, the value of each of these parameters is encoded as a text string.

• 'hkdf', specifying the HKDF algorithm used in the security group, e.g., aligned with the parameter HKDF Algorithm in the Group OSCORE Security Context (see ). If present, this parameter MUST specify a single value. The HKDF Algorithm is specified by the HMAC Algorithm value, which is taken from the 'Value' column of the "COSE Algorithms" registry . For example, the HKDF Algorithm HKDF SHA-256 is specified as the HMAC Algorithm HMAC 256/256.
• 'cred-fmt', specifying the format of the authentication credentials used in the security group, e.g., aligned with the parameter Authentication Credential Format in the Group OSCORE Security Context (see ). If present, this parameter MUST specify a single value, which is taken from the 'Label' column of the "COSE Header Parameters" registry . Acceptable values denote a format that MUST explicitly provide the public key as well as the comprehensive set of information related to the public key algorithm, including, e.g., the used elliptic curve (when applicable). At the time of writing this specification, acceptable formats of authentication credentials are CBOR Web Tokens (CWTs) and CWT Claim Sets (CCSs) , X.509 certificates , and C509 certificates . Further formats may be available in the future and would be acceptable to use as long as they comply with the criteria defined above.
• 'gp-enc-alg', specifying the encryption algorithm used to encrypt messages in the security group when these are also signed, e.g., aligned with the parameter Group Encryption Algorithm in the Group OSCORE Security Context (see ) to be used with the group mode of Group OSCORE (see ). If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Algorithms" registry .
• 'sign-alg', specifying the algorithm used to sign messages in the security group, e.g., aligned with the parameter Signature Algorithm in the Group OSCORE Security Context (see ) to be used with the group mode of Group OSCORE (see ). If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Algorithms" Registry .
• 'sign-key-kty', specifying the key type of signing keys used to sign messages in the security group. If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Key Types" registry .
• 'sign-key-crv', specifying the elliptic curve (if applicable) of signing keys used to sign messages in the security group. If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Elliptic Curves" registry .
• 'alg', specifying the encryption algorithm used to encrypt messages in the security group when these are encrypted with pairwise encryption keys, e.g., aligned with the parameter AEAD Algorithm in the Group OSCORE Security Context (see ) to be used with the pairwise mode of Group OSCORE (see ). If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Algorithms" registry .
• 'ecdh-alg', specifying the ECDH algorithm used to derive pairwise encryption keys in the security group, e.g., aligned with the parameter Pairwise Key Agreement Algorithm in the Group OSCORE Security Context (see ) to be used with the pairwise mode of Group OSCORE (see ). If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Algorithms" registry .
• 'ecdh-alg-crv', specifying the elliptic curve for the ECDH algorithm used to derive pairwise encryption keys in the security group. If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Elliptic Curves" registry .
• 'ecdh-key-kty', specifying the key type of keys used with an ECDH algorithm to derive pairwise encryption keys in the security group. If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Key Types" registry .
• 'ecdh-key-crv', specifying the elliptic curve of keys used with an ECDH algorithm to derive pairwise encryption keys in the security group. If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Elliptic Curves" registry .
• 'det-hash-alg', specifying the hash algorithm used in the security group when producing deterministic requests, e.g., as defined in . If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "COSE Algorithms" registry . This parameter MUST NOT be present if the security group does not use deterministic requests.
• 'rekeying-scheme', specifying the rekeying scheme used in the security group for distributing new group keying material to the group members. If present, this parameter MUST specify a single value, which is taken from the 'Value' column of the "ACE Groupcomm Rekeying Schemes" registry defined in .

If the security group does not recur to message signing, then the parameters 'gp-enc-alg', 'sign-alg', 'sign-key-kty', and 'sign-key-crv' MUST NOT be present. For instance, this is the case for a security group that uses Group OSCORE and uses only the pairwise mode (see ). If the security group does not recur to message encryption through pairwise encryption keys, then the parameters 'alg', 'ecdh-alg', 'ecdh-alg-crv', 'ecdh-key-kty', and 'ecdh-key-crv' MUST NOT be present. For instance, this is the case for a security group that uses Group OSCORE and uses only the group mode see ). Note that the values registered in the registries are strongly typed. On the contrary, the CoRE Link Format is weakly typed and thus does not distinguish between, for instance, the string value "-10" and the integer value -10. Thus, in RDs that return responses in the CoRE Link Format, string values which look like an integer are not supported. Therefore, within responses in the CoRE Link Format, such values MUST NOT be advertised through the corresponding parameters above. A CoAP endpoint that queries the RD to discover security groups and their group-membership resource to access (see ) can benefit from the information above as follows:

• The values of 'cred-fmt', 'sign-alg', 'sign-key-kty', 'sign-key-crv', 'ecdh-alg', 'ecdh-alg-crv', 'ecdh-key-kty', and 'ecdh-key-crv' related to a group-membership resource provide an early knowledge of the format of authentication credentials as well as of the type of public keys used in the security group. Thus, the CoAP endpoint does not need to ask the GM for this information as a preliminary step before the joining process, or to perform a trial-and-error joining exchange with the GM. Hence, at the very first step of the joining process, the CoAP endpoint is able to provide the GM with its own authentication credential in the correct expected format and including a public key of the correct expected type.
• The values of 'hkdf', 'gp-enc-alg', 'sign-alg', 'alg', and 'ecdh-alg' related to a group-membership resource provide an early knowledge of the algorithms used in the security group. Thus, the CoAP endpoint is able to decide whether to actually proceed with the joining process, depending on its support for the indicated algorithms.

Relation Link to Authorization Server For each registered link to a group-membership resource, the GM MAY additionally specify the link to the ACE authorization server (AS) associated with the GM and that issues authorization credentials to join the security group as defined in . The link to the AS has as target the URI of the resource where to send an authorization request to. In the RD defined in and based on the CoRE Link Format, the link to the AS is separately registered with the RD and includes the following parameters as target attributes:

• 'rel', with value "authorization_server".
• 'anchor', with value the target of the link to the group-membership resource at the GM.

In an RD based on CoRAL, such as the one defined in , this is mapped (as describe there) to a link from the registration resource to the AS, using the <http://www.iana.org/assignments/relation/authorization_server> link relation type.

Registration Example The example below shows a GM with endpoint name "gm1" and address [2001:db8::ab] that registers with the RD. The GM specifies the value of the 'sec-gp' parameter for accessing the security group with name "feedca570000". The security group is used by the application group with name "group1" specified with the value of the 'app-gp' parameter. The signature algorithm used in the security group is Ed25519 (-19), i.e., the EdDSA algorithm used with the elliptic curve Ed25519 (see ). Authentication credentials used in the security group are X.509 certificates , which is indicated through the COSE Header Parameter "x5chain" (33). The ECDH algorithm used in the security group is ECDH-SS + HKDF-256 (-27), with elliptic curve X25519 (4). In addition, the GM specifies the link to the ACE authorization server associated with the GM, to which a CoAP endpoint can send an authorization request for obtaining an authorization credential to use for joining the corresponding security group (see ).

Example in Link Format Request: GM -> RD ;ct=261;rt="core.osc.gm";if="ace.group"; sec-gp="feedca570000";app-gp="group1"; cred-fmt="33";gp-enc-alg="10"; sign-alg="-19";alg="10"; ecdh-alg="-27";ecdh-alg-crv="4", ;rel="authorization-server"; anchor="coap://[2001:db8::ab]/ace-group/feedca570000" ]]> Response: RD -> GM

Example in CoRAL Request: GM -> RD Response: RD -> GM

Addition and Update of Security Groups The GM is responsible to refresh the registration of all its group-membership resources in the RD. This means that the GM has to update the registration within its lifetime as per and that it has to change the content of the registration when a group-membership resource is added/removed, or if its parameters have to be changed such as in the following cases:

• The GM creates a new security group and starts hosting the related group-membership resource.
• The GM dismisses a security group and stops hosting the related group-membership resource.
• Information related to an existing security group changes, e.g., the list of associated application groups.

To perform an update of its registrations, the GM can re-register with the RD and fully specify all links to its group-membership resources. Alternatively, the GM can perform a PATCH/iPATCH request to the RD, as per . This requires new media types to be defined in future standards, to apply a new document as a patch to an existing stored document.

Addition Example The example below shows how the GM from re-registers with the RD. When doing so, it specifies:

• The same previous group-membership resource associated with the security group with name "feedca570000".
• An additional group-membership resource associated with the security group with name "ech0ech00000". The security group is used by the application group with name "group2".
• A third group-membership resource associated with the security group with name "abcdef120000". The security group is used by two application groups with name "group3" and "group4".

Furthermore, the GM relates the same authorization server also to the security groups "ech0ech00000" and "abcdef120000".

Example in Link Format Request: GM -> RD ;ct=261;rt="core.osc.gm";if="ace.group"; sec-gp="feedca570000";app-gp="group1"; cred-fmt="33";gp-enc-alg="10"; sign-alg="-19";alg="10"; ecdh-alg="-27";ecdh-alg-crv="4", ;ct=261;rt="core.osc.gm";if="ace.group"; sec-gp="ech0ech00000";app-gp="group2"; cred-fmt="33";gp-enc-alg="10"; sign-alg="-19";alg="10"; ecdh-alg="-27";ecdh-alg-crv="4", ;ct=261;rt="core.osc.gm";if="ace.group"; sec-gp="abcdef120000";app-gp="group3"; app-gp="group4";cred-fmt="33"; gp-enc-alg="10";sign-alg="-19";alg="10"; ecdh-alg="-27";ecdh-alg-crv="4", ;rel="authorization-server"; anchor="coap://[2001:db8::ab]/ace-group/feedca570000", ;rel="authorization-server"; anchor="coap://[2001:db8::ab]/ace-group/ech0ech00000", ;rel="authorization-server"; anchor="coap://[2001:db8::ab]/ace-group/abcdef120000" ]]> Response: RD -> GM

Example in CoRAL Request: GM -> RD Response: RD -> GM

Discovery of Security Groups A CoAP endpoint that wants to join a security group, hereafter denoted as joining node, might not have all the necessary information at deployment time. Also, it might want to know about possible new security groups created afterwards by the respective Group Managers. To this end, the joining node can perform a resource lookup at the RD as per , in order to retrieve the missing pieces of information that are needed to join the security group(s) of interest. The joining node can find the RD as described in . The joining node uses the following parameter value for the lookup filtering.

• 'rt' = "core.osc.gm", specifying the resource type of the group-membership resource at the Group Manager, with value "core.osc.gm" registered in .

The joining node MAY additionally use the following parameters for the lookup filtering, depending on the information that it already has.

• 'sec-gp', specifying the name of the security group of interest. If this parameter is used, it MUST specify a single value.
• 'ep', specifying the registered endpoint of the GM.
• 'app-gp', specifying the name of an application group associated with the security group of interest. This parameter MAY be included multiple times and each occurrence MUST specify the name of one application group.
• 'if', specifying the interface description for accessing the group-membership resource at the Group Manager, with value "ace.group" registered in .

The response from the RD can include a link to a group-membership resource specifying multiple application groups, all of which use the same security group. In this case, the joining node is already expected to know the exact application group of interest. Furthermore, the response from the RD can include links to different group-membership resources that all specify the same application group of interest for the joining node, if the corresponding security groups are all used by that application group. In this case, application policies on the joining node ought to define how to determine the exact security group to join (see ). For example, different security groups can reflect different security algorithms to use. Hence, a client application can take into account what the joining node supports and prefers when selecting one particular security group among the indicated ones, while a server application would need to join all of them. Later on, the joining node will anyway be able to join only security groups of which it is actually authorized to be a member (see ). Note that, with RD-based discovery, including the 'app-gp' parameter multiple times would result in finding only a group-membership resource that serves all the specified application groups, i.e., not any group-membership resource that serves either of those. Therefore, a joining node generally needs to perform separate queries with different values for 'app-gp', in order to discover different group-membership resources serving different application groups. The discovery of security groups as defined in this document is applicable and useful to other CoAP endpoints than the actual joining nodes. In particular, other entities can be interested in discovering and interacting with the group-membership resource at the Group Manager. These include entities acting as signature checkers, e.g., intermediary gateways, that do not join a security group but can retrieve authentication credentials of group members from the Group Manager, in order to verify counter signatures of group messages (see ).

Discovery Example #1 Consistent with the examples in and , the examples below consider a joining node that wants to join the security group associated with the application group "group1", but that does not know the name of the security group, the responsible GM, and the group-membership resource to access.

Example in Link Format Request: Joining node -> RD Response: RD -> Joining node ;ct=261; rt="core.osc.gm";if="ace.group";sec-gp="feedca570000"; app-gp="group1";cred-fmt="33";gp-enc-alg="10"; sign-alg="-19";alg="10";ecdh-alg="-27";ecdh-alg-crv="4" ]]> By performing the separate resource lookup below, the joining node can retrieve the link to the ACE authorization server associated with the GM, where to send an authorization request for obtaining an authorization credential to use for joining the corresponding security group (see ). Request: Joining node -> RD Response: RD -> Joining node ;rel=authorization-server; anchor="coap://[2001:db8::ab]/ace-group/feedca570000" ]]> In order to retrieve the IP multicast address of the CoAP group used by the application group "group1", the joining node performs an endpoint lookup as shown below. The following assumes that the application group "group1" has been previously registered as per , with ff05::db8:0:1 as the IP multicast address of the associated CoAP group. Request: Joining node -> RD Response: RD -> Joining node ;ep="group1";et="core.rd-group"; base="coap://[ff05::db8:0:1]";rt="core.rd-ep" ]]>

Example in CoRAL Request: Joining node -> RD Response: RD -> Joining node In order to retrieve the IP multicast address of the CoAP group used by the application group "group1", the joining node performs an endpoint lookup as shown below. The following assumes that the application group "group1" has been previously registered, with ff05::db8:0:1 as the IP multicast address of the associated CoAP group. Request: Joining node -> RD Response: RD -> Joining node

Discovery Example #2 Consistent with the examples in and , the examples below consider a joining node that wants to join the security group with name "feedca570000", but that does not know the responsible GM, the group-membership resource to access, and the associated application groups. The examples also show how the joining node uses CoAP observation , in order to be notified of possible changes to the parameters related to the group-membership resource. This is also useful to handle the case where the security group of interest has not been created yet, so that the joining node can receive the requested information when it becomes available at a later point in time.

Example in Link Format Request: Joining node -> RD Response: RD -> Joining node ;ct=261; rt="core.osc.gm";if="ace.group";sec-gp="feedca570000"; app-gp="group1";cred-fmt="33";gp-enc-alg="10"; sign-alg="-19";alg="10";ecdh-alg="-27";ecdh-alg-crv="4" ]]> Depending on the search criteria, the joining node performing the resource lookup can get large responses. This can happen, for instance, when the lookup request targets all the group-membership resources at a specified GM, or all the group-membership resources of all the registered GMs, as in the example below. Request: Joining node -> RD Response: RD -> Joining node ;ct=261; rt="core.osc.gm";if="ace.group";sec-gp="feedca570000"; app-gp="group1";cred-fmt="33";gp-enc-alg="10"; sign-alg="-19";alg="10";ecdh-alg="-27";ecdh-alg-crv="4", ;ct=261; rt="core.osc.gm";if="ace.group";sec-gp="ech0ech00000"; app-gp="group2";cred-fmt="33";gp-enc-alg="10"; sign-alg="-19";alg="10";ecdh-alg="-27";ecdh-alg-crv="4", ;ct=261; rt="core.osc.gm";if="ace.group";sec-gp="abcdef120000"; app-gp="group3";app-gp="group4";cred-fmt="33"; gp-enc-alg="10";sign-alg="-19";alg="10";ecdh-alg="-27"; ecdh-alg-crv="4" ]]> Therefore, it is RECOMMENDED that a joining node which performs a resource lookup with the CoAP Observe option specifies the value of the parameter 'sec-gp' in its GET request sent to the RD.

Example in CoRAL Request: Joining node -> RD Response: RD -> Joining node

Use Case Example With Full Discovery This section describes the discovery of security groups to support the process of a lighting installation in an office building. The described process is a simplified version of one of many processes. The process described in this section is intended as an example and does not have any particular ambition to serve as a recommendation or best practice to adopt. That is, it shows a possible workflow involving a Commissioning Tool (CT) used in a certain way, while it is not meant to prescribe how the workflow should necessarily be. The following considers four luminaires that are members of two application groups. In the first application group, the four luminaires receive presence messages and light intensity messages from sensors or their proxy. In the second application group, the four luminaires and several other pieces of equipment receive building state schedules. Each of the two application groups is associated with a different security group and with a different CoAP group that has its own dedicated IP multicast address. The Fairhair Alliance describes how a new device is accepted and commissioned in the network , by means of its certificate stored during the manufacturing process. When commissioning the new device in the installation network, the new device gets a new identity defined by a newly allocated certificate, following the BRSKI specification . Then, consistent with , the CT assigns an endpoint name based on the CN field (CN=ACME) and the serial number of the certificate (serial number = 123x, with 3 < x < 8). Corresponding ep-names ACME-1234, ACME-1235, ACME-1236, and ACME-1237 are also assumed. It is common practice that locations in the building are specified according to a coordinate system. After the acceptance of the luminaires into the installation network, the coordinate of each device is communicated to the CT. This can be done manually or automatically. The mapping between location and ep-name is calculated by the CT. For instance, on the basis of grouping criteria, the CT assigns the application group "grp_R2-4-015" to the four luminaires and the application group "grp_schedule" to all schedule requiring devices. Also, the device with ep name ACME-123x has been assigned the IP address [2001:db8:4::x]. The RD is assigned the IP address [2001:db8:4:ff]. The IP multicast addresses used are [ff05::db8:5:1] and [ff05::db8:5:2]. The following assumes that each device is pre-configured with the name of the two application groups it belongs to. Additional mechanisms can be defined in the RD for supporting devices to discover the application groups they belong to. provides this same use case example using CoRAL. *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** The CT defines the application group "grp_R2-4-015", with resource /light and base address [ff05::db8:5:1], as follows. Request: CT -> RD ;rt="oic.d.light" ]]> Response: RD -> CT Also, the CT defines a second application group "grp_schedule", with resource /schedule and base address [ff05::db8:5:2], as follows. Request: CT -> RD ;rt="oic.r.time.period" ]]> Response: RD -> CT *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** Finally, the CT defines the corresponding security groups. In particular, assuming a Group Manager responsible for both security groups and with address [2001:db8::ab], the CT specifies: Request: CT -> RD ;ct=261;rt="core.osc.gm";if="ace.group"; sec-gp="feedca570000"; app-gp="grp_R2-4-015", ;ct=261;rt="core.osc.gm";if="ace.group"; sec-gp="feedsc590000"; app-gp="grp_schedule" ]]> Response: RD -> CT *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** The device with IP address [2001:db8:4::x] can retrieve the IP multicast address of the CoAP group used by the application group "grp_R2-4-015", by performing an endpoint lookup as shown below. Request: Joining node -> RD Response: RD -> Joining node ;ep="grp_R2-4-015";et="core.rd-group"; base="coap://[ff05::db8:5:1]";rt="core.rd-ep" ]]> Similarly, to retrieve the IP multicast address of the CoAP group used by the application group "grp_schedule", the device performs an endpoint lookup as shown below. Request: Joining node -> RD Response: RD -> Joining node ;ep="grp_schedule";et="core.rd-group"; base="coap://[ff05::db8:5:2]";rt="core.rd-ep" ]]> *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** Consequently, the device learns the security groups that it has to join. In particular, it does the following for app-gp="grp_R2-4-015". Request: Joining node -> RD Response: RD -> Joining Node ;ct=261; rt="core.osc.gm";if="ace.group";sec-gp="feedca570000"; app-gp="grp_R2-4-015" ]]> Similarly, the device does the following for app-gp="grp_schedule". Response: RD -> Joining Node ;ct=261; rt="core.osc.gm";if="ace.group";sec-gp="feedsc590000"; app-gp="grp_schedule" ]]> *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** After this last discovery step, the device can ask for permission to join the security groups and can effectively join them through the Group Manager, e.g., according to .

Security Considerations The security considerations in apply to this document as well.

IANA Considerations This document has the following actions for IANA. Note to RFC Editor: Please replace all occurrences of "[RFC-XXXX]" with the RFC number of this specification and delete this paragraph.

Link Relation Types Registry IANA is asked to register the following entry in the "Link Relation Types" registry within the "Link Relations" registry group, as per .

• Relation Name: authorization-server
• Description: Refers to a resource at an authorization server for requesting an authorization credential to access the link's context
• Reference: [RFC-XXXX]
• Notes:

Target Attributes Registry IANA is asked to register the following entries in the "Target Attributes" registry within the "Constrained RESTful Environments (CoRE) Parameters" registry group, as per . For all entries, the Change Controller is IETF and the reference is [RFC-XXXX]. Registrations in the "Target Attributes" Registry

Attribute Name	Brief Description
sec-gp	Name of the security group that can be joined through this resource
app-gp	Name of an application group associated with a security group
hkdf	The HKDF algorithm to use
cred-fmt	The format of authentication credential to use
gp-enc-alg	The encryption algorithm to use for encrypting signed messages
sign-alg	The signature algorithm to use
sign-key-kty	The key type of the used signing keys
sign-key-crv	The curve of the used signing keys
alg	The encryption algorithm to use for encrypting non-signed messages
ecdh-alg	The ECDH algorithm to use
ecdh-alg-crv	The elliptic curve of the used ECDH algorithm
ecdh-key-kty	The key type of the used ECDH keys
ecdh-key-crv	The curve of the used ECDH keys
det-hash-alg	The hash algorithm to use for computing deterministic requests
rekeying-scheme	The rekeying scheme used to distribute new keying material

References Normative References RISE AB Ericsson AB Ericsson AB Ericsson AB RISE AB This document defines the security protocol Group Object Security for Constrained RESTful Environments (Group OSCORE), providing end-to-end security of messages exchanged with the Constrained Application Protocol (CoAP) between members of a group, e.g., sent over IP multicast. In particular, the described protocol defines how OSCORE is used in a group communication setting to provide source authentication for CoAP group requests, sent by a client to multiple servers, and for protection of the corresponding CoAP responses. Group OSCORE also defines a pairwise mode where each member of the group can efficiently derive a symmetric pairwise key with each other member of the group for pairwise OSCORE communication. Group OSCORE can be used between endpoints communicating with CoAP or CoAP- mappable HTTP. ARM The Constrained RESTful Application Language (CoRAL) defines a data model and interaction model as well as a compact serialization formats for the description of typed connections between resources on the Web ("links"), possible operations on such resources ("forms"), and simple resource metadata. IoTconsultancy.nl RISE AB The Constrained Application Protocol (CoAP) is a web transfer protocol for constrained devices and constrained networks. In a number of use cases, constrained devices often naturally operate in groups (e.g., in a building automation scenario, all lights in a given room may need to be switched on/off as a group). This document specifies the use of CoAP for group communication, including the use of UDP/IP multicast as the default underlying data transport. Both unsecured and secured CoAP group communication are specified. Security is achieved by use of the Group Object Security for Constrained RESTful Environments (Group OSCORE) protocol. The target application area of this specification is any group communication use cases that involve resource-constrained devices or networks that support CoAP. This document replaces and obsoletes RFC 7390, while it updates RFC 7252 and RFC 7641. Universität Bremen TZI TUD Dresden University of Technology The Concise Binary Object Representation (CBOR, RFC 8949 == STD 94) is a data format whose design goals include the possibility of extremely small code size, fairly small message size, and extensibility without the need for version negotiation. CBOR does not provide any forms of data compression. CBOR data items, in particular when generated from legacy data models, often allow considerable gains in compactness when applying data compression. While traditional data compression techniques such as DEFLATE (RFC 1951) can work well for CBOR encoded data items, their disadvantage is that the recipient needs to decompress the compressed form before it can make use of the data. This specification describes Packed CBOR, a set of CBOR tags and simple values that enable a simple transformation of an original CBOR data item into a Packed CBOR data item that is almost as easy to consume as the original CBOR data item. A separate decompression step is therefore often not required at the recipient. // (This cref will be removed by the RFC editor:) The present // revision -19 is a work-in-progress release in preparation for // another cbor-packed side meeting. This revision resolves the use // of the tunables A/B/C by setting A=16, B=8, and C=8, and choosing // requested simple values and tag numbers, in preparation for // continuing the early allocation process. Universität Bremen TZI Fraunhofer SIT The Constrained Resource Identifier (CRI) is a complement to the Uniform Resource Identifier (URI) that represents the URI components in Concise Binary Object Representation (CBOR) rather than as a sequence of characters. This approach simplifies parsing, comparison, and reference resolution in environments with severe limitations on processing power, code size, and memory size. This RFC updates RFC 7595 by adding a column on the "URI Schemes" registry. // (This "cref" paragraph will be removed by the RFC editor:) After // approval of -28 and nit fixes in -29, the present revision -30 // contains two more small fixes for nits that were uncovered in the // RPC intake process. Universität Bremen TZI This document formalizes and consolidates the definition of the Concise Diagnostic Notation (CDN) of the Concise Binary Object Representation (CBOR), addressing implementer experience. Replacing CDN's previous informal descriptions, it updates RFC 8949, obsoleting its Section 8, and RFC 8610, obsoleting its Appendix G. It also specifies registry-based extension points and uses them to support text representations such as of epoch-based dates/times and of IP addresses and prefixes. // (This cref will be removed by the RFC editor:) This is the // editorial round focusing on editorial cleanup, specifically where // that causes moving text around. It does not have WG input yet on // any renaming decisions (CDN name, b1/t1 name), ABNF cleanup, or // Rohan's suggestion to fix the questionable figure in 3.8. RISE AB Ericsson AB This document defines an application profile of the Authentication and Authorization for Constrained Environments (ACE) framework, to request and provision keying material in group communication scenarios that are based on the Constrained Application Protocol (CoAP) and are secured with Group Object Security for Constrained RESTful Environments (Group OSCORE). This application profile delegates the authentication and authorization of Clients, which join an OSCORE group through a Resource Server acting as Group Manager for that group. This application profile leverages protocol-specific transport profiles of ACE to achieve communication security, server authentication, and proof of possession of a key owned by the Client and bound to an OAuth 2.0 access token. A Uniform Resource Identifier (URI) is a compact sequence of characters that identifies an abstract or physical resource. This specification defines the generic URI syntax and a process for resolving URI references that might be in relative form, along with guidelines and security considerations for the use of URIs on the Internet. The URI syntax defines a grammar that is a superset of all valid URIs, allowing an implementation to parse the common components of a URI reference without knowing the scheme-specific requirements of every possible identifier. This specification does not define a generative grammar for URIs; that task is performed by the individual specifications of each URI scheme. [STANDARDS-TRACK] This specification defines Web Linking using a link format for use by constrained web servers to describe hosted resources, their attributes, and other relationships between links. Based on the HTTP Link Header field defined in RFC 5988, the Constrained RESTful Environments (CoRE) Link Format is carried as a payload and is assigned an Internet media type. "RESTful" refers to the Representational State Transfer (REST) architecture. A well-known URI is defined as a default entry point for requesting the links hosted by a server. [STANDARDS-TRACK] The Constrained Application Protocol (CoAP) is a specialized web transfer protocol for use with constrained nodes and constrained (e.g., low-power, lossy) networks. The nodes often have 8-bit microcontrollers with small amounts of ROM and RAM, while constrained networks such as IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs) often have high packet error rates and a typical throughput of 10s of kbit/s. The protocol is designed for machine- to-machine (M2M) applications such as smart energy and building automation. CoAP provides a request/response interaction model between application endpoints, supports built-in discovery of services and resources, and includes key concepts of the Web such as URIs and Internet media types. CoAP is designed to easily interface with HTTP for integration with the Web while meeting specialized requirements such as multicast support, very low overhead, and simplicity for constrained environments. The Constrained Application Protocol (CoAP) is a RESTful application protocol for constrained nodes and networks. The state of a resource on a CoAP server can change over time. This document specifies a simple protocol extension for CoAP that enables CoAP clients to "observe" resources, i.e., to retrieve a representation of a resource and keep this representation updated by the server over a period of time. The protocol follows a best-effort approach for sending new representations to clients and provides eventual consistency between the state observed by each client and the actual resource state at the server. This specification defines a model for the relationships between resources on the Web ("links") and the type of those relationships ("link relation types"). It also defines the serialisation of such links in HTTP headers with the Link header field. This document proposes a notational convention to express Concise Binary Object Representation (CBOR) data structures (RFC 7049). Its main goal is to provide an easy and unambiguous way to express structures for protocol messages and data formats that use CBOR or JSON. The Concise Binary Object Representation (CBOR) is a data format whose design goals include the possibility of extremely small code size, fairly small message size, and extensibility without the need for version negotiation. These design goals make it different from earlier binary serializations such as ASN.1 and MessagePack. This document obsoletes RFC 7049, providing editorial improvements, new details, and errata fixes while keeping full compatibility with the interchange format of RFC 7049. It does not create a new version of the format. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR. This document, along with RFC 9053, obsoletes RFC 8152. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines a set of algorithms that can be used with the CBOR Object Signing and Encryption (COSE) protocol (RFC 9052). This document, along with RFC 9052, obsoletes RFC 8152. In many Internet of Things (IoT) applications, direct discovery of resources is not practical due to sleeping nodes or networks where multicast traffic is inefficient. These problems can be solved by employing an entity called a Resource Directory (RD), which contains information about resources held on other servers, allowing lookups to be performed for those resources. The input to an RD is composed of links, and the output is composed of links constructed from the information stored in the RD. This document specifies the web interfaces that an RD supports for web servers to discover the RD and to register, maintain, look up, and remove information on resources. Furthermore, new target attributes useful in conjunction with an RD are defined. This specification defines a framework for authentication and authorization in Internet of Things (IoT) environments called ACE-OAuth. The framework is based on a set of building blocks including OAuth 2.0 and the Constrained Application Protocol (CoAP), thus transforming a well-known and widely used authorization solution into a form suitable for IoT devices. Existing specifications are used where possible, but extensions are added and profiles are defined to better serve the IoT use cases. This specification refers to cryptographic algorithm identifiers that fully specify the cryptographic operations to be performed, including any curve, key derivation function (KDF), and hash functions, as being "fully specified". It refers to cryptographic algorithm identifiers that require additional information beyond the algorithm identifier to determine the cryptographic operations to be performed as being "polymorphic". This specification creates fully-specified algorithm identifiers for registered JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) polymorphic algorithm identifiers, enabling applications to use only fully-specified algorithm identifiers. It deprecates those polymorphic algorithm identifiers. This specification updates RFCs 7518, 8037, and 9053. It deprecates polymorphic algorithms defined by RFCs 8037 and 9053 and provides fully-specified replacements for them. It adds to the instructions to designated experts in RFCs 7518 and 9053. IANA IANA IANA IANA IANA IANA In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. Informative References RISE AB RISE AB Ericsson AB Group communication for the Constrained Application Protocol (CoAP) can be secured using Group Object Security for Constrained RESTful Environments (Group OSCORE). A Group Manager is responsible for handling the joining of new group members, as well as for managing and distributing the group keying material. This document defines a RESTful admin interface at the Group Manager that allows an Administrator entity to create and delete OSCORE groups, as well as to retrieve and update their configuration. The Authentication and Authorization for Constrained Environments (ACE) framework is used to enforce authentication and authorization of the Administrator at the Group Manager. Protocol-specific transport profiles of ACE are used to achieve communication security, proof of possession, and server authentication. RISE AB RISE AB Group communication for the Constrained Application Protocol (CoAP) can be secured using Group Object Security for Constrained RESTful Environments (Group OSCORE). A Group Manager is responsible to handle the joining of new group members, as well as to manage and distribute the group keying material. The Group Manager can provide a RESTful admin interface that allows an Administrator entity to create and delete OSCORE groups, as well as to retrieve and update their configuration. This document specifies how an Administrator interacts with the admin interface at the Group Manager by using the Constrained RESTful Application Language (CoRAL). The ACE framework for Authentication and Authorization is used to enforce authentication and authorization of the Administrator at the Group Manager. Protocol-specific transport profiles of ACE are used to achieve communication security, proof of possession, and server authentication. Ericsson This document explores how the Constrained RESTful Application Language (CoRAL) might be used for two use cases in Constrained RESTful Environments (CoRE): CoRE Resource Discovery, which allows a client to discover the resources of a server given a host name or IP address, and CoRE Resource Directory, which provides a directory of resources on many servers. Ericsson AB Ericsson AB University of Glasgow RISE AB IN Groupe NIO This document specifies a CBOR encoding of X.509 certificates. The resulting certificates are called C509 certificates. The CBOR encoding supports a large subset of RFC 5280 and common certificate profiles, and it is extensible. Two types of C509 certificates are defined. One type is an invertible CBOR re-encoding of DER-encoded X.509 certificates with the signature field copied from the DER encoding. The other type is identical except that the signature is computed over the CBOR encoding instead of the DER encoding, thereby avoiding the use of ASN.1. Both types of certificates have the same semantics as X.509 while providing comparable size reduction. This document also specifies CBOR-encoded data structures for certification requests and certification request templates, new COSE headers, as well as a TLS certificate type and a file format for C509. This document updates RFC 6698 by extending the TLSA selectors registry to include C509 certificates. RISE AB When using the Constrained Application Protocol (CoAP), exchanged messages can be protected end-to-end also across untrusted intermediary proxies. This can be achieved with Object Security for Constrained RESTful Environments (OSCORE) or, in the case of group communication, with Group Object Security for Constrained RESTful Environments (Group OSCORE). However, this sidesteps the proxies' abilities to cache responses from the origin server(s). This document restores cacheability of end-to-end protected responses at proxies, by using Group OSCORE and introducing consensus requests, which any client in an OSCORE group can send to one server or multiple servers in the same group. Universität Bremen TZI Ericsson Universitat Politecnica de Catalunya The Internet Protocol Suite is increasingly used on small devices with severe constraints on power, memory, and processing resources, creating constrained-node networks. This document provides a number of basic terms that have been useful in research and standardization work for constrained-node networks. This document obsoletes RFC 7228. This memo profiles the X.509 v3 certificate and X.509 v2 certificate revocation list (CRL) for use in the Internet. An overview of this approach and model is provided as an introduction. The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms. Standard certificate extensions are described and two Internet-specific extensions are defined. A set of required certificate extensions is specified. The X.509 v2 CRL format is described in detail along with standard and Internet-specific extensions. An algorithm for X.509 certification path validation is described. An ASN.1 module and examples are provided in the appendices. [STANDARDS-TRACK] The methods defined in RFC 7252 for the Constrained Application Protocol (CoAP) only allow access to a complete resource, not to parts of a resource. In case of resources with larger or complex data, or in situations where resource continuity is required, replacing or requesting the whole resource is undesirable. Several applications using CoAP need to access parts of the resources. This specification defines the new CoAP methods, FETCH, PATCH, and iPATCH, which are used to access and update parts of a resource. CBOR Web Token (CWT) is a compact means of representing claims to be transferred between two parties. The claims in a CWT are encoded in the Concise Binary Object Representation (CBOR), and CBOR Object Signing and Encryption (COSE) is used for added application-layer security protection. A claim is a piece of information asserted about a subject and is represented as a name/value pair consisting of a claim name and a claim value. CWT is derived from JSON Web Token (JWT) but uses CBOR rather than JSON. This document defines Object Security for Constrained RESTful Environments (OSCORE), a method for application-layer protection of the Constrained Application Protocol (CoAP), using CBOR Object Signing and Encryption (COSE). OSCORE provides end-to-end protection between endpoints communicating using CoAP or CoAP-mappable HTTP. OSCORE is designed for constrained nodes and networks supporting a range of proxy operations, including translation between different transport protocols. Although an optional functionality of CoAP, OSCORE alters CoAP options processing and IANA registration. Therefore, this document updates RFC 7252. This document specifies automated bootstrapping of an Autonomic Control Plane. To do this, a Secure Key Infrastructure is bootstrapped. This is done using manufacturer-installed X.509 certificates, in combination with a manufacturer's authorizing service, both online and offline. We call this process the Bootstrapping Remote Secure Key Infrastructure (BRSKI) protocol. Bootstrapping a new device can occur when using a routable address and a cloud service, only link-local connectivity, or limited/disconnected networks. Support for deployment models with less stringent security requirements is included. Bootstrapping is complete when the cryptographic identity of the new key infrastructure is successfully deployed to the device. The established secure connection can be used to deploy a locally issued certificate to the device as well. The Constrained RESTful Environments (CoRE) specifications apply web technologies to constrained environments. One such important technology is Web Linking (RFC 8288), which CoRE specifications use as the basis for a number of discovery protocols, such as the Link Format (RFC 6690) in the Constrained Application Protocol's (CoAP's) resource discovery process (Section 7.2 of RFC 7252) and the Resource Directory (RD) (RFC 9176). Web Links can have target attributes, the names of which are not generally coordinated by the Web Linking specification (Section 2.2 of RFC 8288). This document introduces an IANA registry for coordinating names of target attributes when used in CoRE. It updates the "RD Parameters" IANA registry created by RFC 9176 to coordinate with this registry. This document defines how to use the Authentication and Authorization for Constrained Environments (ACE) framework to distribute keying material and configuration parameters for secure group communication. Candidate group members that act as Clients and are authorized to join a group can do so by interacting with a Key Distribution Center (KDC) acting as the Resource Server, from which they obtain the keying material to communicate with other group members. While defining general message formats as well as the interface and operations available at the KDC, this document supports different approaches and protocols for secure group communication. Therefore, details are delegated to separate application profiles of this document as specialized instances that target a particular group communication approach and define how communications in the group are protected. Compliance requirements for such application profiles are also specified. FairHair Alliance

Use Case Example With Full Discovery (CoRAL) This section provides the same use case example of but using CoRAL . *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** The CT defines the application group "grp_R2-4-015", with resource /light and base address [ff05::db8:5:1], as follows. Request: CT -> RD Response: RD -> CT Also, the CT defines a second application group "grp_schedule", with resource /schedule and base address [ff05::db8:5:2], as follows. Request: CT -> RD Response: RD -> CT *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** Finally, the CT defines the corresponding security groups. In particular, assuming a Group Manager responsible for both security groups and with address [2001:db8::ab], the CT specifies: Request: CT -> RD Response: RD -> CT *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** The device with IP address [2001:db8:4::x] can retrieve the IP multicast address of the CoAP group used by the application group "grp_R2-4-015", by performing an endpoint lookup as shown below. Request: Joining node -> RD Response: RD -> Joining node Similarly, to retrieve the IP multicast address of the CoAP group used by the application group "grp_schedule", the device performs an endpoint lookup as shown below. Request: Joining node -> RD Response: RD -> Joining node *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** Consequently, the device learns the security groups that it has to join. In particular, it does the following for app-gp="grp_R2-4-015". Request: Joining node -> RD Response: RD -> Joining Node Similarly, the device does the following for app-gp="grp_schedule". Response: RD -> Joining Node *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** After this last discovery step, the device can ask for permission to join the security groups and can effectively join them through the Group Manager, e.g., according to .

Shared Item Tables for Packed CBOR This appendix defines the three shared item tables that the examples in this document refer to when using Packed CBOR . The application-extension identifier "cri" defined in is used to notate a Concise Diagnostic Notation (CDN) literal for a CRI.

Compacting CoRAL Predicates with Packed CBOR The following shared item table is used for compacting CoRAL predicates, as per .

Shared Item Table for Compacting CoRAL Predicates.

Compacting Values of the rt= Target Attribute with Packed CBOR The following shared item table is used for compacting values of the rt= target attribute, as per .

Shared Item Table for Compacting Values of the rt= Target Attribute.

Compacting Values of the if= Target Attribute with Packed CBOR The following shared item table is used for compacting values of the if= target attribute, as per .

Shared Item Table for Compacting Values of the if= Target Attribute.

Acknowledgments The authors sincerely thank , , , , , and for their comments and feedback. The work on this document has been partly supported by the Sweden's Innovation Agency VINNOVA and the Celtic-Next projects CRITISEC and CYPRESS; by the H2020 project SIFIS-Home (Grant agreement 952652); and by the EIT-Digital High Impact Initiative ACTIVE.