]> RISE AB

Isafjordsgatan 22 Kista 164 40 Sweden marco.tiloca@ri.se

Security LAKE Working Group Internet-Draft This document adds Private Use ranges to IANA registries that pertain to the Lightweight Authenticated Key Exchange (LAKE) protocol. Discussion Venues Discussion of this document takes place on the Lightweight Authenticated Key Exchange Working Group mailing list (lake@ietf.org), which is archived at . Source for this draft and an issue tracker can be found at .

Introduction The Lightweight Authenticated Key Exchange (LAKE) protocol provides points of extensibility, for which related IANA registries exist. When they were created, some of those registries did not include ranges with registration procedure "Private Use" (see ). Later on, it was brought to attention that having such ranges available would be convenient for private deployments. This document rectifies this situation by adding Private Use ranges to three IANA registries missing those, as specified in .

Terminology This document uses the acronym "LAKE", expanded to "Lightweight Authenticated Key Exchange", to denote the protocol specified as "EDHOC" in . Identifiers defined literally in or in IANA registries (e.g., the names of the EDHOC registries themselves) are unchanged.

Security Considerations This document and the Private Use ranges defined in do not impact the security of the LAKE protocol. When using values from such Private Use ranges, the security considerations compiled in still apply.

IANA Considerations This document has the following actions for IANA.

EDHOC Method Types Registry IANA is asked to add the following two ranges to the "EDHOC Method Types" registry within the "Ephemeral Diffie-Hellman Over COSE (EDHOC)" registry group:

• -4294967296 to -65537
• 65536 to 4294967295

For both ranges, the registration procedure is "Private Use" per .

EDHOC Error Codes Registry IANA is asked to add the following two ranges to the "EDHOC Error Codes" registry within the "Ephemeral Diffie-Hellman Over COSE (EDHOC)" registry group.

• -4294967296 to -65537
• 65536 to 4294967295

For both ranges, the registration procedure is "Private Use" per .

EDHOC External Authorization Data Registry IANA is asked to add the following range to the "EDHOC External Authorization Data" registry within the "Ephemeral Diffie-Hellman Over COSE (EDHOC)" registry group:

• 65536 to 4294967295

For this range, the registration procedure is "Private Use" per .

Normative References Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA). To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry. This is the third edition of this document; it obsoletes RFC 5226. This document specifies Ephemeral Diffie-Hellman Over COSE (EDHOC), a very compact and lightweight authenticated Diffie-Hellman key exchange with ephemeral keys. EDHOC provides mutual authentication, forward secrecy, and identity protection. EDHOC is intended for usage in constrained scenarios, and a main use case is to establish an Object Security for Constrained RESTful Environments (OSCORE) security context. By reusing CBOR Object Signing and Encryption (COSE) for cryptography, Concise Binary Object Representation (CBOR) for encoding, and Constrained Application Protocol (CoAP) for transport, the additional code size can be kept very low. IANA IANA IANA

Acknowledgments pointed out the usefulness of a Private Use range for External Authorization Data (EAD) labels, which triggered the development of this document. The author thanks and for their early feedback during the preparation of this document.