Draft: draft-ietf-cose-x509

Commentary: ... and found during the IoTdir review . 
 Thanks ,  !
In the process of writing RFC8152 the working group discussed X.509
certificates RFC5280 and decided that no use cases were prestented
that showed a need to support certificates.  Since that time a number
of cases have been defined in which X.509 certificate support is
necessary, and by implication, applications will need a documented
and consistent way to handle such certificates.  This document
defines a set of attributes that will allow applications to transport
and refer to X.509 certificates in a consistent manner.
In the process of writing RFC8152 the working group discussed X.509
certificates RFC5280 and decided that no use cases were presented
that showed a need to support certificates.  Since that time a number
of cases have been defined in which X.509 certificate support is
necessary, and by implication, applications will need a documented
and consistent way to handle such certificates.  This document
defines a set of attributes that will allow applications to transport
and refer to X.509 certificates in a consistent manner.
In some of these cases, a constrained device is being deployed in the
context of an existing X.509 PKI: for example, in the 6TiSCH
environment I-D.richardson-enrollment-roadmap, describes a device
enrollment solution that relies on the presence in the device of a
factory-installed certificate.  The I-D.selander-ace-cose-ecdhe draft
was also written with the idea that long term certificates could be
used to provide for authentication of devices, and uses them to
establish session keys.  A third scenario is the use of COSE as the
basis for a secure messaging application.  This scenario assumes the
presence of long term keys and a central authentication authority.
Basing such an application on public key certificates allows it to
make use of well established key management disciplines.
In some of these cases, a constrained device is being deployed in the
context of an existing X.509 PKI: for example, in the 6TiSCH
environment, I-D.richardson-enrollment-roadmap describes a device
enrollment solution that relies on the presence in the device of a
factory-installed certificate.  The I-D.ietf-lake-edhoc draft was
also written with the idea that long term certificates could be used
to provide for authentication of devices, and uses them to establish
session keys.  A third scenario is the use of COSE as the basis for a
secure messaging application.  This scenario assumes the presence of
long term keys and a central authentication authority.  Basing such
an application on public key certificates allows it to make use of
well established key management disciplines.
It is not necessarily expected that constrained devices themselves
will evaluate and process of X.509 certificates: it is perfectly
reasonable for a constrained device to be provisioned with a
certificate which it can then provide to a relying party - along with
a signature or encrypted message - on the assumption that the relying
party is not a constrained device, and is capable of performing the
required certificate evaluation and processing.  It is also
reasonable that a constrained device would have the hash of a
certificate associated with a public key and be configured to use a
public key for that thumbprint, but without performing the
certificate evaluation or even having the entire certificate.
It is not necessarily expected that constrained devices themselves
will evaluate and process X.509 certificates: it is perfectly
reasonable for a constrained device to be provisioned with a
certificate which it can then provide to a relying party - along with
a signature or encrypted message - on the assumption that the relying
party is not a constrained device, and is capable of performing the
required certificate evaluation and processing.  It is also
reasonable that a constrained device would have the hash of a
certificate associated with a public key and be configured to use a
public key for that thumbprint, but without performing the
certificate evaluation or even having the entire certificate.