The Group Object Security for Constrained RESTful Environments (Group OSCORE) Profile of the Authentication and Authorization for Constrained Environments (ACE) Framework

1.1. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

Readers are expected to be familiar with the terms and concepts related to CBOR [RFC8949], COSE [RFC9052][RFC9053], CoAP [RFC7252], OSCORE [RFC8613], and Group OSCORE [I-D.ietf-core-oscore-groupcomm]. These especially include:¶

• Group Manager, as the entity responsible for a set of groups where communications among members are secured with Group OSCORE.¶

• Authentication credential, as the set of information associated with an entity, including that entity's public key and parameters associated with the public key. Examples of authentication credentials are CBOR Web Tokens (CWTs) and CWT Claims Sets (CCSs) [RFC8392], X.509 certificates [RFC7925] and C509 certificates [I-D.ietf-cose-cbor-encoded-cert].¶

  Members of an OSCORE group have an associated authentication credential in the format used in the group. As per Section 2.4 of [I-D.ietf-core-oscore-groupcomm], an authentication credential provides the public key as well as the comprehensive set of information related to the public key algorithm, including, e.g., the used elliptic curve (when applicable).¶

Readers are expected to be familiar with the terms and concepts described in the ACE framework for authentication and authorization [RFC9200], as well as in the OSCORE profile of ACE [RFC9203]. The terminology for entities in the considered architecture is defined in OAuth 2.0 [RFC6749]. In particular, this includes Client (C), Resource Server (RS), and Authorization Server (AS).¶

Note that, unless otherwise indicated, the term "endpoint" is used here following its OAuth definition, aimed at denoting resources such as /token and /introspect at the AS, and /authz-info at the RS. This document does not use the CoAP definition of "endpoint", which is "An entity participating in the CoAP protocol".¶

Additionally, this document makes use of the following terminology.¶

• Pairwise-only group: an OSCORE group that uses only the pairwise mode of Group OSCORE (see Section 9 of [I-D.ietf-core-oscore-groupcomm]).¶

Examples throughout this document are expressed in CBOR diagnostic notation, without the tag and value abbreviations.¶

2.1. Pre-Conditions

Using Group OSCORE and this profile requires that both the Client and the Resource Servers have previously joined the same OSCORE group. This especially includes the derivation of the Group OSCORE Security Context and the assignment of unique Sender IDs to use in the group. Nodes can join the OSCORE group through the respective Group Manager by using the approach defined in [I-D.ietf-ace-key-groupcomm-oscore], which is also based on ACE.¶

After the Client and Resource Servers have joined the group, this profile provides access control for accessing resources on those Resource Servers, by securely communicating with Group OSCORE.¶

As a pre-requisite for this profile, the Client has to have successfully joined the OSCORE group where also the Resource Servers (RSs) are members. Depending on the limited information initially available, the Client may have to first discover the exact OSCORE group used by the RSs for the resources of interest, e.g., by using the approach defined in [I-D.tiloca-core-oscore-discovery].¶

2.2. Access Token Retrieval

This profile requires that the Client retrieves an Access Token from the AS for the resource(s) that it wants to access at the RS(s), by using the /token endpoint as specified in Section 5.8 of [RFC9200].¶

In general, different RSs can be associated with different ASs, even if the RSs are members of the same OSCORE group. However, assuming proper configurations and trust relations, it is possible for multiple RSs associated with the same AS to be part of a single audience (i.e., a group-audience, see Section 6.9 of [RFC9200]). In such a case, the Client can request a single Access Token intended to the group-audience, hence to all the RSs included therein. A particular group-audience might be defined as including all the RSs in the OSCORE group.¶

In the Access Token request to the AS, the Client MUST include the Group Identifier of the OSCORE group and its own Sender ID in that group. The AS MUST specify these pieces of information in the Access Token, included in the Access Token response to the Client.¶

Furthermore, in the Access Token request to the AS, the Client MUST also include: its own authentication credential used in the OSCORE group; and a proof-of-possession (PoP) evidence to prove possession of the corresponding private key. The PoP evidence is computed over a PoP input uniquely related to the secure communication association between the Client and the AS. The AS MUST include also the authentication credential indicated by the Client in the Access Token.¶

The Access Token request and response MUST be confidentiality-protected and ensure authenticity. In this profile, it is RECOMMENDED to use OSCORE [RFC8613] between the Client and the AS, to reduce the number of libraries the client has to support. Other protocols fulfilling the security requirements defined in Sections 5 and 6 of [RFC9200] MAY alternatively be used, such as TLS [RFC8446] or DTLS [RFC9147].¶

2.3. Access Token Posting

After having retrieved the Access Token from the AS, the Client posts the Access Token to the RS, using the /authz-info endpoint and the mechanisms specified in Section 5.10 of [RFC9200]. When using this profile, the communication with the /authz-info endpoint is not protected.¶

If the Access Token is valid, the RS replies to this POST request with a 2.01 (Created) response. Also, the RS associates the received Access Token with the Group OSCORE Security Context identified by the Group Identifier specified in the Access Token, following Section 3.2 of [RFC8613]. In practice, the RS maintains a collection of Security Contexts with associated authorization information, for all the clients that it is currently communicating with. The authorization information is a policy that is used as input when processing requests from those clients.¶

Finally, the RS stores the association between i) the authorization information from the Access Token; and ii) the Group Identifier of the OSCORE group together with the Sender ID and the authentication credential of the Client in that group. This binds the Access Token to the Group OSCORE Security Context of the OSCORE group.¶

Finally, when the Client communicates with the RS using the Group OSCORE Security Context, the RS verifies that the Client is a legitimate member of the OSCORE group and especially the exact group member with the same Sender ID associated with the Access Token. This occurs when verifying a request protected with Group OSCORE, since the request includes the Client's Sender ID and either it embeds a signature computed also over that Sender ID (if protected with the group mode), or it is protected by means of pairwise symmetric keying material derived from the asymmetric keys of the two peers (if protected with the pairwise mode).¶

The above has considered an Access Token intended to a single RS. However, as discussed in Section 2.2, an Access Token can be intended to a group-audience including multiple RSs in the OSCORE group. In such a case, the Client could efficiently post the Access Token to many or all of those RSs at once (e.g., over IP multicast), after which each RS individually performs the same steps described above.¶

2.4. Secure Communication

The Client can send a request protected with Group OSCORE [I-D.ietf-core-oscore-groupcomm] to the RS. This can be a unicast request addressed to the RS, or a one-to-many group request (e.g., over IP multicast) addressed to the OSCORE group where the RS is also a member. To this end, the Client uses the Group OSCORE Security Context already established upon joining the OSCORE group, e.g., by using the approach defined in [I-D.ietf-ace-key-groupcomm-oscore]. The RS may send a response back to the Client, protecting it by means of the same Group OSCORE Security Context.¶

3.1. C-to-AS: POST to Token Endpoint

The Client-to-AS request is specified in Section 5.8.1 of [RFC9200]. The Client MUST send this POST request to the /token endpoint over a secure channel that guarantees authentication, message integrity and confidentiality.¶

The POST request is formatted as the analogous Client-to-AS request in the OSCORE profile of ACE (see Section 3.1 of [RFC9203]), with the following additional parameters that MUST be included in the payload.¶

• 'context_id', defined in Section 3.1.1 of this document. This parameter specifies the Group Identifier (GID), i.e., the ID Context of an OSCORE group that includes as members both the Client and the RS(s) in the audience for which the Access Token is asked to be issued. In particular, the Client wishes to communicate with the RS(s) in that audience using the Group OSCORE Security Context associated with that OSCORE group.¶
• 'salt_input', defined in Section 3.1.2 of this document. This parameter includes the Sender ID that the Client has in the OSCORE group whose GID is specified in the 'context_id' parameter above.¶

• 'req_cnf', defined in Section 3.1 of [RFC9201]. This parameter follows the syntax from Section 3.1 of [RFC8747], and its inner confirmation value specifies the authentication credential that the Client uses in the OSCORE group. The public key included in the authentication credential will be used as the pop-key bound to the Access Token.¶

  At the time of writing this specification, acceptable formats of authentication credentials in Group OSCORE are CBOR Web Tokens (CWTs) and CWT Claims Sets (CCSs) [RFC8392], X.509 certificates [RFC7925], and C509 certificates [I-D.ietf-cose-cbor-encoded-cert].¶

  Further formats may be available in the future, and would be acceptable to use as long as they comply with the criteria compiled in Section 2.3 of [I-D.ietf-core-oscore-groupcomm]. In particular, an authentication credential has to explicitly include the public key as well as the comprehensive set of information related to the public key algorithm, including, e.g., the used elliptic curve (when applicable).¶

  [ As to CWTs and CCSs, the CWT Confirmation Methods 'kcwt' and 'kccs' are under pending registration requested by draft-ietf-ace-edhoc-oscore-profile. ]¶

  [ As to X.509 certificates, the CWT Confirmation Methods 'x5bag' and '5chain' are under pending registration requested by draft-ietf-ace-edhoc-oscore-profile. ]¶

  [ As to C509 certificates, the CWT Confirmation Methods 'c5b'and 'c5c' are under pending registration requested by draft-ietf-ace-edhoc-oscore-profile. ]¶

In addition, the Client computes its proof-of-possession (PoP) evidence, in order to prove to the AS the possession of its own private key used in the OSCORE group. This allows the AS to verify that the Client indeed owns the private key associated with the public key of the authentication credential that the Client allegedly uses in the OSCORE group.¶

To this end, the Client MUST use as PoP input the byte representation of an information that uniquely represents the secure communication association between the Client and the AS. It is RECOMMENDED that the Client considers the following as PoP input.¶

• If the Client and the AS communicate over (D)TLS, the PoP input is an exporter value computed as defined in Section 7.5 of [RFC8446]. In particular, the exporter label MUST be 'EXPORTER-ACE-Sign-Challenge-Client-AS' defined in Section 10.5 of this document, together with an empty 'context_value', and 32 bytes as 'key_length'.¶

• If the Client and the AS communicate over OSCORE, the PoP input is the output PRK of a HKDF-Extract step [RFC5869], i.e., PRK = HMAC-Hash(salt, IKM). In particular, 'salt' takes (x1 | x2), where x1 is the ID Context of the OSCORE Security Context between the Client and the AS, x2 is the Sender ID of the Client in that Security Context, and | denotes byte string concatenation. Also, 'IKM' is the OSCORE Master Secret of the OSCORE Security Context between the Client and the AS.¶

  The HKDF MUST be one of the HMAC-based HKDF [RFC5869] algorithms defined for COSE [RFC9053]. The Client and AS may agree on the HKDF algorithm to use during the Client's registration at the AS. HKDF SHA-256 is mandatory to implement.¶

Then, the Client computes the PoP evidence as follows.¶

• If the OSCORE group is not a pairwise-only group, the PoP evidence MUST be a signature. The Client computes the signature by using the same private key and signature algorithm it uses for signing messages in the OSCORE group. The Client's private key is the one associated with the Client's authentication credential used in the OSCORE group and specified in the 'req_cnf' parameter above.¶

• If the OSCORE group is a pairwise-only group, the PoP evidence MUST be a MAC computed as follows, by using the HKDF Algorithm HKDF SHA-256, which consists of composing the HKDF-Extract and HKDF-Expand steps [RFC5869].¶

  MAC = HKDF(salt, IKM, info, L)¶

  The input parameters of HKDF are as follows.¶

  • salt takes as value the empty byte string.¶

  • IKM is computed as a cofactor Diffie-Hellman shared secret (see Section 5.7.1.2 of [NIST-800-56A]), using an ECDH algorithm pre-agreed between Client and AS. The Client uses its own Diffie-Hellman private key and the Diffie-Hellman public key of the AS. For X25519 and X448, the procedure is described in Section 5 of [RFC7748].¶

    The Client's private key is the one associated with the Client's authentication credential used in the OSCORE group and specified in the 'req_cnf' parameter above. The Client may obtain the Diffie-Hellman public key of the AS during its registration process at the AS.¶

    The Client and AS may agree on the ECDH algorithm to use during the Client's registration at the AS. The ECDH-SS + HKDF-256 algorithm specified in Section 6.3.1 of [RFC9053] is mandatory to implement.¶

  • info takes as value the PoP input.¶
  • L is equal to 8, i.e., the size of the MAC, in bytes.¶

Finally, the Client MUST include one of the two following parameters in the payload of the POST request to the AS.¶

• 'client_cred_verify', defined in Section 3.1.3 of this document, specifying the Client's PoP evidence as a signature, which is computed as defined above. This parameter MUST be included if and only if the OSCORE group is not a pairwise-only group.¶
• 'client_cred_verify_mac', defined in Section 3.1.4 of this document, specifying the Client's PoP evidence as a MAC, which is computed as defined above. This parameter MUST be included if and only if the OSCORE group is a pairwise-only group.¶

An example of such a request is shown in Figure 2.¶

Header: POST (Code=0.02)
Uri-Host: "as.example.com"
Uri-Path: "token"
Content-Format: "application/ace+cbor"
Payload:
{
  "audience" : "tempSensor4711",
  "scope" : "read",
  "context_id" : h'abcd0000',
  "salt_input" : h'00',
  "req_cnf" : {
    "kccs" : {
      "sub" : "42-50-31-FF-EF-37-32-39",
      "cnf" : {
        "COSE_Key" : {
          "kty" : 2,
          "crv" : 1,
          "x" : h'd7cc072de2205bdc1537a543d53c60a6
                  acb62eccd890c7fa27c9e354089bbe13',
          "y" : h'f95e1d4b851a2cc80fff87d8e23f22af
                  b725d535e515d020731e79a3b4e47120'
        }
      }
    }
  },
  "client_cred_verify" : h'...'
   (signature content omitted for brevity)
}

In the example above, the Client specifies that its authentication credential in the OSCORE group is the CCS shown in Figure 3.¶

{
  "sub" : "42-50-31-FF-EF-37-32-39",
  "cnf" : {
    "COSE_Key" : {
      "kty" : 2,
      "crv" : 1,
      "x" : h'd7cc072de2205bdc1537a543d53c60a6
              acb62eccd890c7fa27c9e354089bbe13',
      "y" : h'f95e1d4b851a2cc80fff87d8e23f22af
              b725d535e515d020731e79a3b4e47120'
    }
  }
}

3.2. AS-to-C: Access Token

After having verified the POST request to the /token endpoint and that the Client is authorized to obtain an Access Token corresponding to its Access Token request, the AS MUST verify the proof-of-possession (PoP) evidence. In particular, the AS proceeds as follows.¶

• As PoP input, the AS uses the same value considered by the Client in Section 3.1.¶
• As public key of the Client, the AS uses the one included in the authentication credential specified in the 'req_cnf' parameter of the Access Token request.¶
• If the Access Token request includes the 'client_cred_verify' parameter, this specifies the PoP evidence as a signature. Then, the AS verifies the signature by using the public key of the Client.¶

• If the Access Token request includes the 'client_cred_verify_mac' parameter, this specifies the PoP evidence as a Message Authentication Code (MAC).¶

  Then, the AS recomputes the MAC through the same process taken by the Client when preparing the value of the 'client_cred_verify_mac' parameter for the Access Token (see Section 3.1), with the difference that the AS uses its own Diffie-Hellman private key and the Diffie-Hellman public key of the Client. The verification succeeds if and only if the recomputed MAC is equal to the MAC conveyed as PoP evidence in the Access Token request.¶

If both the 'client_cred_verify' and 'client_cred_verify_mac' parameters are present, or if the verification of the PoP evidence fails, the AS considers the Client request invalid.¶

If the Client request was invalid, or not authorized, the AS returns an error response as described in Section 5.8.3 of [RFC9200].¶

If all verifications are successful, the AS responds as defined in Section 5.8.2 of [RFC9200]. In particular:¶

• The AS can signal that the use of Group OSCORE is REQUIRED for a specific Access Token by including the 'ace_profile' parameter with the value "coap_group_oscore" in the Access Token response. The Client MUST use Group OSCORE towards all the Resource Servers for which this Access Token is valid. Usually, it is assumed that constrained devices will be pre-configured with the necessary profile, so that this kind of profile signaling can be omitted.¶
• The AS MUST NOT include the 'rs_cnf' parameter defined in [RFC9201]. In general, the AS may not be aware of the authentication credentials (and public keys included thereof) that the RSs use in the OSCORE group. Also, the Client is able to retrieve the authentication credentials of other group members from the responsible Group Manager, both upon joining the group or later on as a group member, as defined in [I-D.ietf-ace-key-groupcomm-oscore].¶

The AS MUST include the following information as metadata of the issued Access Token. The use of CBOR web tokens (CWT) as specified in [RFC8392] is RECOMMENDED.¶

• The profile "coap_group_oscore". If the Access Token is a CWT, this is placed in the 'ace_profile' claim of the Access Token, as per Section 5.10 of [RFC9200].¶
• The salt input specified in the 'salt_input' parameter of the Token Request. If the Access Token is a CWT, the content of the 'salt_input' parameter MUST be placed in the 'salt_input' claim of the Access Token, defined in Section 3.2.1 of this document.¶
• The Context Id input specified in the 'context_id' parameter of the Token Request. If the Access Token is a CWT, the content of the 'context_id' parameter MUST be placed in the 'contextId_input' claim of the Access Token, defined in Section 3.2.2 of this document.¶

• The authentication credential that the client uses in the OSCORE group and specified in the 'req_cnf' parameter of the Token request.¶

  If the Access Token is a CWT, the Client's authentication credential MUST be specified in the 'cnf' claim, which follows the syntax from Section 3.1 of [RFC8747]. In particular, the 'cnf' claim includes the same authentication credential specified in the 'req_cnf' parameter of the Token Request (see Section 3.1).¶

Figure 4 shows an example of such an AS response. The access token has been truncated for readability.¶

Header: Created (Code=2.01)
Content-Type: "application/ace+cbor"
Payload:
{
  "access_token" : h'8343a1010aa2044c53 ...'
   (remainder of CWT omitted for brevity),
  "ace_profile" : "coap_group_oscore",
  "expires_in" : 3600
}

Figure 5 shows an example CWT Claims Set, containing the Client's public key in the group (as pop-key), as specified by the inner confirmation value in the 'cnf' claim.¶

{
  "aud" : "tempSensorInLivingRoom",
  "iat" : "1360189224",
  "exp" : "1360289224",
  "scope" :  "temperature_g firmware_p",
  "cnf" : {
    "kccs" : {
      "sub" : "42-50-31-FF-EF-37-32-39",
      "cnf" : {
        "COSE_Key" : {
          "kty" : 2,
          "crv" : 1,
          "x" : h'd7cc072de2205bdc1537a543d53c60a6
                  acb62eccd890c7fa27c9e354089bbe13',
          "y" : h'f95e1d4b851a2cc80fff87d8e23f22af
                  b725d535e515d020731e79a3b4e47120'
        }
      }
    }
  "salt_input" : h'00',
  "contextId_input" : h'abcd0000'
}

The same CWT Claims Set as in Figure 5 and encoded in CBOR is shown in Figure 6, using the value abbreviations defined in [RFC9200] and [RFC8747]. The bytes in hexadecimal are reported in the first column, while their corresponding CBOR meaning is reported after the "#" sign on the second column, for easiness of readability.¶

Editor's note: it should be checked (and in case fixed) that the values used below (which are not yet registered) are the final values registered by IANA.¶

A7                                      # map(7)
   03                                   # unsigned(3)
   76                                   # text(22)
      74656D7053656E736F72496E4C6976696E67526F6F6D
      # "tempSensorInLivingRoom"
   06                                   # unsigned(6)
   1A 5112D728                          # unsigned(1360189224)
   04                                   # unsigned(4)
   1A 51145DC8                          # unsigned(1360289224)
   09                                   # unsigned(9)
   78 18                                # text(24)
      74656D70657261747572655F67206669726D776172655F70
      # "temperature_g firmware_p"
   08                                   # unsigned(8)
   A1                                   # map(1)
      05                                # unsigned(5)
      A2                                # map(2)
         02                             # unsigned(2)
         77                             # text(23)
            34322D35302D33312D46462D45462D33372D33322D3339
            # "42-50-31-FF-EF-37-32-39"
         08                             # unsigned(8)
         A1                             # map(1)
            01                          # unsigned(1)
            A4                          # map(4)
               01                       # unsigned(1)
               02                       # unsigned(2)
               20                       # negative(0)
               01                       # unsigned(1)
               21                       # negative(1)
               58 20                    # bytes(32)
                  D7CC072DE2205BDC1537A543D53C60A6
                  ACB62ECCD890C7FA27C9E354089BBE13
               22                       # negative(2)
               58 20                    # bytes(32)
                  F95E1D4B851A2CC80FFF87D8E23F22AF
                  B725D535E515D020731E79A3B4E47120
   18 3C                                # unsigned(60)
   41                                   # bytes(1)
      00
   18 3D                                # unsigned(61)
   44                                   # bytes(4)
      ABCD0000

4.1. C-to-RS POST to authz-info Endpoint

The Client posts the Access Token to the /authz-info endpoint of the RS, as defined in Section 5.10.1 of [RFC9200].¶

4.2. RS-to-C: 2.01 (Created)

The RS MUST verify the validity of the Access Token as defined in Section 5.10.1 of [RFC9200], with the following additions.¶

• The RS MUST check that the claims 'salt_input', 'contextId_input', and 'cnf' are included in the Access Token.¶

• The RS considers: the content of the 'contextId_input' claim as the GID of the OSCORE group; the content of the 'salt_input' claim as the Sender ID that the Client has in the group; and the inner confirmation value of 'cnf' claim as the authentication credential that the Client uses in the group.¶

  The RS MUST check whether it already stores the authentication credential specified in the inner confirmation value of the 'cnf' claim as associated with the pair (GID, Sender ID) above.¶

  If this is not the case, the RS MUST request the Client's authentication credential to the Group Manager of the OSCORE group as described in Section 9.3 of [I-D.ietf-ace-key-groupcomm-oscore], specifying the Client's Sender ID in the OSCORE group, i.e., the value of the 'salt_input' claim. Then, the RS performs the following actions.¶

  • The RS MUST check whether the Client's authentication credential retrieved from the Group Manager matches the one retrieved from the inner confirmation value of the 'cnf' claim of the Access Token.¶
  • The RS MUST check whether the Client's Sender ID provided by the Group Manager together with the Client's authentication credential matches the one retrieved from the 'salt_input' claim of the Access Token.¶

If any of the checks above fails, the RS MUST consider the Access Token non valid, and MUST respond to the Client with an error response code equivalent to the CoAP code 4.00 (Bad Request).¶

If the Access Token is valid and further checks on its content are successful, the RS associates the authorization information from the Access Token with the Group OSCORE Security Context.¶

In particular, the RS associates the authorization information from the Access Token with the triple (GID, SaltInput, AuthCred), where GID is the Group Identifier of the OSCORE group, while SaltInput and AuthCred are the Sender ID and the authentication credential that the Client uses in that OSCORE group, respectively.¶

The RS MUST keep this association up-to-date over time, as the triple (GID, SaltInput, AuthCred) associated with the Access Token might change. In particular:¶

• If the OSCORE group is rekeyed (see Section 3.2 of [I-D.ietf-core-oscore-groupcomm] and Section 11 of [I-D.ietf-ace-key-groupcomm-oscore]), the Group Identifier also changes in the group, and the new one replaces the current 'GID' value in the triple (GID, SaltInput, AuthCred).¶
• If the Client requests and obtains a new OSCORE Sender ID from the Group Manager (see Section 2.6.3.1 of [I-D.ietf-core-oscore-groupcomm] and Section 9.2 of [I-D.ietf-ace-key-groupcomm-oscore]), the new Sender ID replaces the current 'SaltInput' value in the triple (GID, SaltInput, AuthCred).¶

Finally, the RS MUST send a 2.01 (Created) response to the Client, as defined in Section 5.10.1 of [RFC9200].¶

4.3. Client-RS Secure Communication

When previously joining the OSCORE group, both the Client and RS have already established the related Group OSCORE Security Context to communicate as group members. Therefore, they can simply start to securely communicate using Group OSCORE, without deriving any additional keying material or security association.¶

4.4. Access Rights Verification

The RS MUST follow the procedures defined in Section 5.10.2 of [RFC9200]. If an RS receives a request protected with Group OSCORE from a Client, the RS processes the request according to [I-D.ietf-core-oscore-groupcomm].¶

If the Group OSCORE verification succeeds, and the target resource requires authorization, the RS retrieves the authorization information from the Access Token associated with the Group OSCORE Security Context. Then, the RS MUST verify that the action requested on the resource is authorized.¶

The response code MUST be 4.01 (Unauthorized) if the RS has no valid Access Token for the Client. If the RS has an Access Token for the Client but no actions are authorized on the target resource, the RS MUST reject the request and MUST respond to the Client with a 4.03 (Forbidden) response. If the RS has an Access Token for the Client but the requested action is not authorized, the RS MUST reject the request and MUST respond to the Client with a 4.05 (Method Not Allowed) response.¶

4.5. Change of Client's Authentication Credential in the Group

During its membership in the OSCORE group, the Client might change the authentication credential that it uses in the group. When this happens, the Client uploads the new authentication credential to the Group Manager, as defined in Section 9.4 of [I-D.ietf-ace-key-groupcomm-oscore].¶

After that, and in order to continue communicating with the RS, the Client MUST perform the following actions.¶

1. The Client requests a new Access Token to the AS, as defined in Section 3. In particular, when sending the POST request as defined in Section 3.1, the Client indicates:¶

   • The current Group Identifier of the OSCORE group, as value of the 'context_id' parameter.¶
   • The current Sender ID it has in the OSCORE group, as value of the 'salt_input' parameter.¶
   • The new authentication credential it uses in the OSCORE group, as inner confirmation value of the 'req_cnf' parameter.¶
   • The proof-of-possession (PoP) evidence corresponding to the public key of the new authentication credential, as value of the 'client_cred_verify' or 'client_cred_verify_mac' parameter.¶
2. After receiving the response from the AS (see Section 3.2), the Client performs the same exchanges with the RS as defined in Section 4.¶

When receiving the new Access Token, the RS performs the same steps defined in Section 4.2, with the following addition in case the new Access Token is successfully verified and stored. The RS also deletes the old Access Token, i.e., the one whose associated triple (GID, SaltInput, AuthCred) has the same GID and SaltInput values as in the triple including the new authentication credential of the Client and associated with the new Access Token.¶

10.1. ACE Profile Registry

IANA is asked to add the following entry to the "ACE Profile" registry within the "Authentication and Authorization for Constrained Environments (ACE)" registry group, following the procedure specified in Section 8.8 of [RFC9200].¶

• Name: coap_group_oscore¶
• Description: Profile to secure communications between constrained nodes using the Authentication and Authorization for Constrained Environments framework, by enabling authentication and fine-grained authorization of members of an OSCORE group, that use a pre-established Group OSCORE Security Context to communicate with Group OSCORE.¶
• CBOR Value: TBD (value between 1 and 255)¶
• Reference: [RFC-XXXX]¶

10.2. OAuth Parameters Registry

IANA is asked to add the following entries to the "OAuth Parameters" registry, following the procedure specified in Section 11.2 of [RFC6749].¶

• Name: "context_id"¶
• Parameter Usage Location: token request¶
• Change Controller: IESG¶
• Specification Document(s): Section 3.1.1 of [RFC-XXXX]¶

• Name: "salt_input"¶
• Parameter Usage Location: token request¶
• Change Controller: IESG¶
• Specification Document(s): Section 3.1.2 of [RFC-XXXX]¶

• Name: "client_cred_verify"¶
• Parameter Usage Location: token request¶
• Change Controller: IESG¶
• Specification Document(s): Section 3.1.3 of [RFC-XXXX]¶

• Name: "client_cred_verify_mac"¶
• Parameter Usage Location: token request¶
• Change Controller: IESG¶
• Specification Document(s): Section 3.1.4 of [RFC-XXXX]¶

10.3. OAuth Parameters CBOR Mappings Registry

IANA is asked to add the following entries to the "OAuth Parameters CBOR Mappings" registry within the "Authentication and Authorization for Constrained Environments (ACE)" registry group, following the procedure specified in Section 8.10 of [RFC9200].¶

• Name: "context_id"¶
• CBOR Key: TBD¶
• Value Type: bstr¶
• Reference: Section 3.1.1 of [RFC-XXXX]¶

• Name: "salt_input"¶
• CBOR Key: TBD¶
• Value Type: bstr¶
• Reference: Section 3.1.2 of [RFC-XXXX]¶

• Name: "client_cred_verify"¶
• CBOR Key: TBD¶
• Value Type: bstr¶
• Reference: Section 3.1.3 of [RFC-XXXX]¶

• Name: "client_cred_verify_mac"¶
• CBOR Key: TBD¶
• Value Type: bstr¶
• Reference: Section 3.1.4 of [RFC-XXXX]¶

10.4. CBOR Web Token (CWT) Claims Registry

IANA is asked to add the following entries to the "CBOR Web Token (CWT) Claims" registry, following the procedure specified in Section 9.1 of [RFC8392].¶

• Claim Name: "salt_input"¶
• Claim Description: Client provided salt input¶
• JWT Claim Name: "N/A"¶
• Claim Key: TBD¶
• Claim Value Type(s): bstr¶
• Change Controller: IESG¶
• Specification Document(s): Section 3.2.1 of [RFC-XXXX]¶

• Claim Name: "contextId_input"¶
• Claim Description: Client context id input¶
• JWT Claim Name: "N/A"¶
• Claim Key: TBD¶
• Claim Value Type(s): bstr¶
• Change Controller: IESG¶
• Specification Document(s): Section 3.2.2 of [RFC-XXXX]¶

10.5. TLS Exporter Label Registry

IANA is asked to add the following entry to the "TLS Exporter Label" registry within the "Transport Layer Security (TLS) Parameters" registry group, following the procedure specified in Section 6 of [RFC5705] and updated in Section 12 of [RFC8447].¶

• Value: EXPORTER-ACE-Sign-Challenge-Client-AS¶
• DTLS-OK: Y¶
• Recommended: N¶
• Reference: Section 3.1 of [RFC-XXXX]¶