Subject: [dtn] BPSec ASB structure

From: Brian Sipos <[email-masked]>
Date: Thu, 3 Dec 2020 01:25:14 +0000

Ed,
I started into implementing a very simple abstract security block (ASB) dissector and have come across two separate observations about the ASB security results:

  1.  The array-of-target-block-numbers is separate from the array-of-result-sets, which allows a well-formed CBOR structure to be invalid ASB and it's not something which can be enforced by current CDDL (in the example below, the "targets" array must be equal sized to the "target-results" array).
Is there a reason why the array-of-result-sets doesn't embed the target block number along with each target's result set? I could provide an updated CDDL-type example of what I mean.
The one benefit of the current split is that a security acceptor can see the targets without caring about the results, but that can be mitigated by #2 below.
  2.  Because each of the results is a direct CBOR item, a result with a complex structure cannot be easily skipped. A security acceptor for one result may need to do additional data handling to skip over unwanted results. The same way that the canonical block structure uses cbor-within-bstr encoding to allow skipping over chunks of structure without decoding them, the ASB could have each result value be a bstr but require that it contain encoded CBOR. Then an acceptor could skip over individual result value without decoding.

Untested CDDL for an ASB, with "TBD" block type code, based on the BPbis CDDL:

$extension-block-structure /= extension-block-use<TBD, embedded-cbor<ext-data-asb>>

ext-data-asb = [
  targets: [1* target-block-num],
  context-id: int,
  flags: uint .bits asb-flag-bits,
  ? source: eid,
  ? parameters: asb-id-val-pair,
  target-results: [1* asb-id-val-pair]
]
target-block-num = uint
asb-flag-bits = &(
  sec-params-present: 1,
  sec-source-present: 2
)
asb-id-val-pair = [
  id: uint,
  val: any
]

---

From: "Birrane, Edward J." <[email-masked]>
Date: Sun, 13 Dec 2020 20:33:55 +0000

Brian,

  Yes, the initial listing of targets allows a verifier or acceptor to quick determine if it should pay attention to any of the target blocks for the security block.

  However, I agree that by not encapsulating target results in a binary string it makes it harder to "skip" to the set of target results of interest.

WG,

  Is there agreement that the proposed change is beneficial enough that it should be considered at this time?

-Ed

---
Edward J. Birrane, III, Ph.D.
Embedded Applications Group Supervisor
Space Exploration Sector
Johns Hopkins Applied Physics Laboratory
(W) 443-778-7423 / (F) 443-228-3839

From: Brian Sipos <[email-masked]>
Sent: Wednesday, December 02, 2020 8:25 PM
To: Birrane, Edward J. <[email-masked]>; [email-masked]
Subject: [EXT] BPSec ASB structure

APL external email warning: Verify sender [email-masked]<mailto:[email-masked]> before clicking links or attachments

Ed,

ext-data-asb = [

---

From: Rick Taylor <[email-masked]>
Date: Tue, 15 Dec 2020 15:45:32 +0000

Ed,

That change sounds sensible to me.

Rick

From: dtn [mailto:[email-masked]] On Behalf Of Birrane, Edward J.
Sent: 13 December 2020 20:34
To: Brian Sipos; [email-masked]
Subject: Re: [dtn] BPSec ASB structure

Brian,

WG,

-Ed

---

APL external email warning: Verify sender [email-masked] before clicking links or attachments
 
Ed,

ext-data-asb = [

---

From: Brian Sipos <[email-masked]>
Date: Fri, 18 Dec 2020 21:13:30 +0000

Ed,
After thinking on this a bit, it maybe best left structurally as-is (where the result type is "any") with some text indicating to context writers that using a "CBOR-in-bstr" result value is recommended for large or complex result values. Then it's left up to the context writers to decide when a skippable bstr value is warranted.
________________________________
From: Rick Taylor <[email-masked]>
Sent: Tuesday, December 15, 2020 10:45
To: Birrane, Edward J. <[email-masked]>; Brian Sipos <[email-masked]>; [email-masked] <[email-masked]>
Subject: RE: BPSec ASB structure

Ed,

Rick

Brian,

WG,

-Ed

---

Ed,

ext-data-asb = [