Incorporated comments, introduced registry for schemes

Author: glpatcern

IETF-OCM-MLS.md

@@ -1587,19 +1587,22 @@ Each notification MAY include the optional `encryption` field:
   },
   "encryption": {
     "resourceId": "3a02538b-aa54-42f2-8853-a38996e211b1"
-    "scheme": "ocm-mls-1",
-    "cipher": "AES-256-GCM",
+    "scheme": "ocm-mls",
+    "ocm-mls": {
+      "cipher": "AES-256-GCM",
+    }
   }
 }
 ~~~
 
 The `encryption` field is OPTIONAL as per [OCM] Share Creation
 Notification specification.  If absent, the resource is unencrypted.
-If present, it MUST carry the encryption-related parameters according
-to the [OCM] specification, where:
+If present, and the symmetric encryption available via OCM-MLS is to
+be used, it MUST carry the encryption-related parameters according to
+the [OCM] specification, where:
 - `resourceId` is the stable resource identifier described in
 {{resource-id}}
-- `scheme` is to be set to `"ocm-mls-1"`
+- `scheme` is to be set to `"ocm-mls"`
 - `cipher` names the content AEAD that the resource is encrypted with
 ({{file-key-wrapping}}), one of the AEAD algorithms defined for HPKE
 ([RFC9180] Section 7.3): `"AES-128-GCM"`, `"AES-256-GCM"`, or
@@ -2012,6 +2015,20 @@ registrations do not modify the protocols' own registrations:
    +===============+============+=====================+===============+
 ~~~
 
+The following entries are to be registered in the "OCM Encryption
+Schemes" registry defined in [OCM], within the "Open Cloud Mesh (OCM)
+Parameters" group:
+
+~~~
+   +=========+============+===============+
+   | Scheme  | Share Type | Reference     |
+   +=========+============+===============+
+   | ocm-pgp | federation | This document |
+   | ocm-mls | federation | This document |
+   +=========+============+===============+
+~~~
+
+
 # Open Issues
 
 This section collects open design issues and shall be removed before

IETF-OCM.md

@@ -1100,9 +1100,17 @@ described in [OCM-IP].
   - REQUIRED resourceId (string) - a unique identifier of the
     underlying resource.
   - REQUIRED scheme (string) - an identifier of the encryption scheme
-    used to encrypt the resource, such as "ocm-pgp-1".
-  - REQUIRED cipher (string) - the encryption algorithm used to encrypt
-    the resource as in [RFC9180] Section 7.3.
+    used to encrypt the resource, such as "ocm-pgp".  Registered values
+    are listed in the "OCM Encryption Schemes" registry (see
+    [IANA Considerations](#iana-considerations)).
+  - REQUIRED {schemeObject} (object) - an object keyed with the given
+    scheme, containing the details of the encryption used.
+    For the "ocm-gpg" scheme, it MUST contain:
+    - fingerprints (array of strings) - one or more fingerprints of
+      the public keys used to encrypt the resource.
+    For the "ocm-mls" scheme, it MUST contain:
+    - cipher (string) - the encryption algorithm used to encrypt the
+      resource as in [RFC9180] Section 7.3.
 * REQUIRED protocol (object)
   JSON object with specific options for each protocol.
   The supported protocols are:
@@ -1886,7 +1894,7 @@ policy for each registry in this group is "Specification Required"
 is documented in a stable, publicly available specification and that it
 does not duplicate an existing entry.
 
-## OCM Resource Types Registry
+### OCM Resource Types Registry
 
 IANA is requested to create the "OCM Resource Types" registry in the
 "Open Cloud Mesh (OCM) Parameters" group.  This registry records the
@@ -1908,7 +1916,7 @@ the [OCM API Discovery](#ocm-api-discovery) endpoint.
    +===============+=====================+===============+
 ~~~
 
-## OCM Protocols Registry
+### OCM Protocols Registry
 
 IANA is requested to create the "OCM Protocols" registry in the "Open
 Cloud Mesh (OCM) Parameters" group.  Each entry records a protocol
@@ -1942,7 +1950,7 @@ for a given resource type and share type is governed by the
    +================+=========+===============+
 ~~~
 
-## OCM Share Types Registry
+### OCM Share Types Registry
 
 IANA is requested to create the "OCM Share Types" registry in the
 "Open Cloud Mesh (OCM) Parameters" group.  Each entry records a share
@@ -1966,7 +1974,7 @@ The "federation" share type, for example, is registered by [OCM-MLS].
    +============+===============+
 ~~~
 
-## OCM Share Payloads Registry
+### OCM Share Payloads Registry
 
 IANA is requested to create the "OCM Share Payloads" registry in the
 "Open Cloud Mesh (OCM) Parameters" group.  Whereas the "OCM Resource
@@ -2017,7 +2025,7 @@ interoperable way, they can do so using this very mechanism.
    +===============+============+=====================+===============+
 ~~~
 
-## OCM Notification Types Registry
+### OCM Notification Types Registry
 
 IANA is requested to create the "OCM Notification Types" registry in
 the "Open Cloud Mesh (OCM) Parameters" group.  This registry records
@@ -2051,6 +2059,26 @@ payload.
    +===========================+===========+===============+
 ~~~
 
+### OCM Encryption Schemes Registry
+
+IANA is requested to create the "OCM Encryption Schemes" registry in
+the "Open Cloud Mesh (OCM) Parameters" group.  This registry records
+the values that MAY appear in the "encryption.scheme" field of a
+[Share Creation Notification](#share-creation-notification).
+
+   Registration Policy: Specification Required [RFC8126]
+
+   Initial Contents:
+
+~~~
+   +=========+============+===============+
+   | Scheme  | Share Type | Reference     |
+   +=========+============+===============+
+   | ocm-pgp | user       | This document |
+   | ocm-pgp | group      | This document |
+   +=========+============+===============+
+~~~
+
 # Security Considerations
 
 ## Threat Model

spec.yaml

@@ -423,18 +423,18 @@ components:
                       Implementations that support receiving SSH shares MUST
                       advertise them here, with an empty object as value.
                 additionalProperties:
-                    oneOf:
-                      - type: string
-                      - type: object
-                    description: >
-                      Any additional protocol supported for this resource type SHOULD
-                      be advertised here, where the value MAY correspond to a top-level
-                      URI to be used for that protocol, or any other relevant
-                      attribute required for that protocol. Similarly, additional
-                      receiving capabilities for custom protocols SHOULD be advertised.
-                      Additional protocols are to be registered in the "OCM Protocols"
-                      registry (see the IANA Considerations section of the OCM
-                      Internet-Draft).
+                  oneOf:
+                    - type: string
+                    - type: object
+                  description: >
+                    Any additional protocol supported for this resource type SHOULD
+                    be advertised here, where the value MAY correspond to a top-level
+                    URI to be used for that protocol, or any other relevant
+                    attribute required for that protocol. Similarly, additional
+                    receiving capabilities for custom protocols SHOULD be advertised.
+                    Additional protocols are to be registered in the "OCM Protocols"
+                    registry (see the IANA Considerations section of the OCM
+                    Internet-Draft).
                 example:
                   webdav: /remote/dav/ocm/
                   webdav-receive: {
@@ -613,7 +613,6 @@ components:
           required:
             - resourceId
             - scheme
-            - cipher
           properties:
             resourceId:
               type: string
@@ -623,11 +622,25 @@ components:
             scheme:
               type: string
               description: >
-                An identifier of the encryption scheme used to encrypt the resource.
-            cipher:
-              type: string
+                An identifier of the encryption scheme used to encrypt the resource, as
+                defined in the OCM IANA registry for encryption schemes. The value MUST
+                be a registered scheme name, such as 'ocm-pgp' or 'ocm-mls'.
+            additionalProperties:
+              type: object
               description: >
-                The encryption algorithm used to encrypt the resource.
+                This object MUST be keyed with the name of the encryption scheme, and its
+                value MUST be a JSON object with additional properties specific to that
+                scheme. For the 'ocm-pgp' scheme, the object MUST contain a 'fingerprints'
+                array of string, with one or more fingerprints of the public keys used to
+                encrypt the resource. For the 'ocm-mls' scheme, the object MUST contain
+                a 'cipher' string with the identifier of the cipher used to encrypt the
+                resource, such as 'AES-256-GCM'.
+            example:
+              resourceId: 7c084226-d9a1-11e6-bf26-cec0c932ce01
+              scheme: ocm-pgp
+              ocm-pgp:
+                fingerprints:
+                  - 3F:2A:4B:5C:6D:7E:8F:9A:0B:1C:2D:3E:4F:5A:6B:7C
         protocol:
           type: object
           description: |