Constrained RESTful Environments T. Fossati Internet-Draft Linaro Updates: 7252 (if approved) E. Dijk Intended status: Standards Track IoTconsultancy.nl Expires: 11 August 2025 7 February 2025 Update to the IANA CoAP Content-Formats Registration Procedures draft-ietf-core-cf-reg-update-02 Abstract This document updates RFC7252 regarding the registration procedures for the "CoAP Content-Formats" registry, within the "CoRE Parameters" registry group. The affected registration procedures are specifically those regarding the IETF Review or IESG Approval portion of the registry as well as those regarding the First Come First Served (FCFS) portion of the registry. About This Document This note is to be removed before publishing as an RFC. The latest revision of this draft can be found at https://core- wg.github.io/cf-reg-update/draft-ietf-core-cf-reg-update.html. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-ietf-core-cf-reg-update/. Discussion of this document takes place on the Constrained RESTful Environments Working Group mailing list (mailto:core@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/core/. Subscribe at https://www.ietf.org/mailman/listinfo/core/. Source for this draft and an issue tracker can be found at https://github.com/core-wg/cf-reg-update. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Fossati & Dijk Expires 11 August 2025 [Page 1] Internet-Draft CoAP Content-Format Registrations Update February 2025 Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 11 August 2025. Copyright Notice Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Conventions and Definitions . . . . . . . . . . . . . . . . . 3 3. Examples for Erroneous Registrations . . . . . . . . . . . . 3 3.1. The Media Type is Unknown . . . . . . . . . . . . . . . . 4 3.2. The Media Type Parameter is Unknown . . . . . . . . . . . 4 3.3. The Media Type Parameter Value is Invalid . . . . . . . . 4 3.4. The Content Coding is Unknown . . . . . . . . . . . . . . 5 3.5. Duplicate Entry with Default Media Type Parameters . . . 5 3.6. Duplicate Entry with Default Content Coding . . . . . . . 5 3.7. Duplicate Entry with Equivalent Parameter . . . . . . . . 6 4. Security Considerations . . . . . . . . . . . . . . . . . . . 6 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 5.1. Temporary Content-Format Registrations . . . . . . . . . 8 5.2. Adding the Media Type Column to the Registry . . . . . . 9 5.3. Expert Review Procedure . . . . . . . . . . . . . . . . . 9 5.4. Preferred Format for the Content Type Field . . . . . . . 10 5.5. Temporary Note Removal . . . . . . . . . . . . . . . . . 10 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 11 6.1. Normative References . . . . . . . . . . . . . . . . . . 11 6.2. Informative References . . . . . . . . . . . . . . . . . 11 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 12 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 12 Fossati & Dijk Expires 11 August 2025 [Page 2] Internet-Draft CoAP Content-Format Registrations Update February 2025 1. Introduction Section 12.3 of [RFC7252] describes the registration procedures for the "CoAP Content-Formats" registry within the "CoRE Parameters" registry group [IANA.core-parameters]. (Note that the columns of this registry have been revised according to [Err4954].) In particular, the text defines the rules for obtaining CoAP Content- Format identifiers from the IETF Review or IESG Approval portion of the registry (256-9999) as well as from the First Come First Served (FCFS) portion of the registry (10000-64999). For the (FCFS) portion of the registry, these rules do not involve the Designated Expert (DE) and are managed solely by IANA personnel to finalize the registration. Unfortunately, the instructions do not explicitly require checking that the combination of content-type (i.e., media type with optional parameters) and content coding associated with the requested CoAP Content-Format is semantically valid. This task is generally non- trivial, requiring knowledge from multiple documents and technologies, which is not a task to demand solely from the registrar. This lack of guidance may engender confusion in both the registering party and the registrar, and has already led to erroneous registrations. In Section 5, this document updates [RFC7252] by modifying the registration procedures for the "CoAP Content-Formats" registry regarding its IETF Review or IESG Approval portion as well as its FCFS portion, to mitigate the risk of unintentional or malicious errors. 2. Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [BCP14] (RFC2119) (RFC8174) when, and only when, they appear in all capitals, as shown here. This document uses the terms "media type", "content coding", "content-type" and "content format" as defined in Section 2 of [RFC9193]. 3. Examples for Erroneous Registrations This section contains a few examples of registration requests for a CoAP Content-Format with identifier 64999 in the FCFS space that must not be allowed to succeed. Fossati & Dijk Expires 11 August 2025 [Page 3] Internet-Draft CoAP Content-Format Registrations Update February 2025 The following considerations also apply to alternative examples where, for the same combination of content type and content coding, a registration was requested for a CoAP Content-Format with identifier in the IETF Review or IESG Approval space. That is, such registrations must not be allowed to succeed. 3.1. The Media Type is Unknown The registrant requests an FCFS Content-Format ID for an unknown media type: +==========================+================+=======+ | Content Type | Content Coding | ID | +==========================+================+=======+ | application/unknown+cbor | - | 64999 | +--------------------------+----------------+-------+ Table 1: Attempt at Registering Content-Format for an Unknown Media Type 3.2. The Media Type Parameter is Unknown The registrant requests an FCFS Content-Format ID for an existing media type with an unknown parameter: +=======================================+================+=======+ | Content Type | Content Coding | ID | +=======================================+================+=======+ | application/cose; unknown-parameter=1 | - | 64999 | +---------------------------------------+----------------+-------+ Table 2: Attempt at Registering Content-Format for Media Type with Unknown Parameter 3.3. The Media Type Parameter Value is Invalid The registrant requests an FCFS Content-Format ID for an existing media type with an invalid parameter value: +=====================================+================+=======+ | Content Type | Content Coding | ID | +=====================================+================+=======+ | application/cose; cose-type=invalid | - | 64999 | +-------------------------------------+----------------+-------+ Table 3: Attempt at Registering Content-Format for Media Type with Invalid Parameter Value Fossati & Dijk Expires 11 August 2025 [Page 4] Internet-Draft CoAP Content-Format Registrations Update February 2025 3.4. The Content Coding is Unknown The registrant requests an FCFS Content-Format ID for an existing media type with an unknown content coding: +========================+================+=======+ | Content Type | Content Coding | ID | +========================+================+=======+ | application/senml+cbor | inflate | 64999 | +------------------------+----------------+-------+ Table 4: Attempt at Registering Content-Format with Unknown Content Coding 3.5. Duplicate Entry with Default Media Type Parameters The registrant requests an FCFS Content-Format ID for a media type that includes a parameter set to its default value, while a (hypothetical) Content-Format ID 64900 is already registered for this media type without that parameter. As a result, this could lead to the creation of two separate Content-Format IDs for the same "logical" entry. +===================================+================+=======+ | Content Type | Content Coding | ID | +===================================+================+=======+ | application/my | - | 64900 | +-----------------------------------+----------------+-------+ | application/my; parameter=default | - | 64999 | +-----------------------------------+----------------+-------+ Table 5: Attempt at Registering an Equivalent Logical Entry with a Different Content-Format ID (1) 3.6. Duplicate Entry with Default Content Coding The registrant requests an FCFS Content-Format ID for the "identity" Content Coding, which is the default coding. If accepted, this request would duplicate an entry with (hypothetical) Content-Format ID 64900 where the "Content Coding" field is left empty. Fossati & Dijk Expires 11 August 2025 [Page 5] Internet-Draft CoAP Content-Format Registrations Update February 2025 +================+================+=======+ | Content Type | Content Coding | ID | +================+================+=======+ | application/my | - | 64900 | +----------------+----------------+-------+ | application/my | identity | 64999 | +----------------+----------------+-------+ Table 6: Attempt at Registering an Equivalent Logical Entry with a Different Content-Format ID (2) 3.7. Duplicate Entry with Equivalent Parameter The registrant requests an FCFS Content-Format ID for a media type that includes a parameter. The value of this parameter appears distinct from that of a previously registered Content-Format that also includes this parameter. However, the semantics of the parameter value are identical to the existing registration. In this example, the eat_profile parameter value (which can be any URI) is set as a Uniform Resource Name (URN) [RFC8141]. Since for URNs, the Namespace Identifier (foo in the example) is defined as case insensitive, the two registrations are semantically identical. +=========================+================+=======+ | Content Type | Content Coding | ID | +=========================+================+=======+ | application/eat+cwt; | - | 64900 | | eat_profile="urn:foo:1" | | | +-------------------------+----------------+-------+ | application/eat+cwt; | - | 64999 | | eat_profile="urn:FOO:1" | | | +-------------------------+----------------+-------+ Table 7: Attempt at Registering an Equivalent Logical Entry with a Different Content-Format ID (3) 4. Security Considerations This document hardens the registration procedures of CoAP Content- Formats in ways that reduce the chances of malicious manipulation of the associated registry. Other than that, it does not change the Security Considerations of [RFC7252]. Fossati & Dijk Expires 11 August 2025 [Page 6] Internet-Draft CoAP Content-Format Registrations Update February 2025 5. IANA Considerations // RFC Editor: in this section, please replace RFCthis with the RFC // number assigned to this document and remove this note. The CoAP Content-Formats registration procedures defined in Section 12.3 of [RFC7252] are modified as shown in Table 8. +========================+================+=========================+ | Range | Registration | Note | | | Procedures | | +========================+================+=========================+ | 0-255 | Expert Review | Review procedure | | | | described in RFCthis, | | | | Section 5.3 | +------------------------+----------------+-------------------------+ | 256-9999 | IETF Review | Review procedure | | | with Expert | described in RFCthis, | | | Review or IESG | Section 5.3 | | | Approval with | | | | Expert Review | | +------------------------+----------------+-------------------------+ | 10000-64999 (No | First Come | The corresponding media | | parameters and empty | First Served | type must be registered | | Content Coding and | | (or approved for | | media type not yet | | publication) in the | | used in this | | "Media Types" registry | | registry) | | [IANA.media-types] | +------------------------+----------------+-------------------------+ | 10000-64999 | Expert Review | Review procedure | | (Includes parameters | | described in RFCthis, | | and/or Content | | Section 5.3 | | Coding and/or media | | | | type appears in this | | | | registry) | | | +------------------------+----------------+-------------------------+ | 65000-65535 | Experimental | | | | use (no | | | | operational | | | | use) | | +------------------------+----------------+-------------------------+ Table 8: Updated CoAP Content-Formats Registration Procedures The 256-9999 range now has registration procedures requiring IETF Review with Expert Review or IESG Approval with Expert Review. In particular: Fossati & Dijk Expires 11 August 2025 [Page 7] Internet-Draft CoAP Content-Format Registrations Update February 2025 * All assignments according to "IETF Review with Expert Review" are made on an "IETF Review" basis per Section 4.8 of [BCP26] with "Expert Review" additionally required per Section 4.5 of [BCP26]. The procedure for early IANA allocation of "standards track code points" defined in [RFC7120] also applies. When such a procedure is used, IANA will ask the Designated Expert(s) to approve the early allocation before registration. In addition, working group chairs are encouraged to consult the Expert(s) early during the process outlined in Section 3.1 of [RFC7120]. * All assignments according to "IESG Approval with Expert Review" are made on an "IESG Approval" basis per Section 4.10 of [BCP26] with "Expert Review" additionally required per Section 4.5 of [BCP26]. The 10000-64999 range now has two separate registration procedures. If the registration consists solely of a registered media type name in the "Content Type" field, without any parameter names or "Content Coding", and the media type has not yet been used in this registry, then the policy is FCFS, as before. In all other cases, the policy will be Expert Review, following the checklist described in Section 5.3. A new column with the title "Note" has been added to the registry, which contains information about the expected review procedure. 5.1. Temporary Content-Format Registrations This section clarifies that the CoAP Content-Formats registry allows temporary registrations within the 0-255 and 256-9999 ranges. The range 10000-64999 does not allow temporary registrations. A temporary registration may be created for example by an IANA early allocation action, requested by the authors of an Internet Draft in the IETF stream. Or it may be created because the referenced media type is still provisional (that is, included in the IANA Provisional Standard Media Type Registry). Fossati & Dijk Expires 11 August 2025 [Page 8] Internet-Draft CoAP Content-Format Registrations Update February 2025 A temporary registration is marked by an IANA note with the label "TEMPORARY" in the corresponding registry entry. Once the required review procedure for the temporary ID has successfully completed, and the referenced media type is included in the IANA Media Types registry, IANA must remove the "TEMPORARY" label so that the entry becomes permanent. If the requested temporary entry does not successfully pass its required review procedure, IANA must remove the entry again and set the Content-Format ID value back to "Unassigned". This may happen for example when an Internet-Draft requesting a Content-Format ID is abandoned, or when the referenced provisional media type is abandoned. 5.2. Adding the Media Type Column to the Registry To assist users of the CoAP Content-Formats registry in finding detailed information about the media type associated with each CoAP Content-Format, and to ensure that a media type exists before a new entry can be registered, IANA is requested to add a new column "Media Type" to the registry. This new column can be placed directly to the right of the existing "Content Type" column. The "Media Type" field for each entry lists the (base) media type name and provides a hyperlink to registration information for that media type as recorded by IANA. If the media type is provisional, the hyperlink points to the IANA "Provisional Standard Media Type" registry [IANA.provisional-standard-media-types]. Note that the registration request procedure remains unchanged. A requester does not need to fill out the "Media Type" field separately, as the necessary information is already provided in the "Content Type" field of the request. 5.3. Expert Review Procedure The Designated Expert is instructed to perform the Expert Review, as described by the following checklist: 1. The combination of content-type and content coding for which the registration is requested must not be already present in the "CoAP Content-Formats" registry; 2. The media type associated with the requested Content-Format must exist (or must have been approved for registration) in the "Media Types" registry [IANA.media-types]; 3. The optional parameter names must have been defined in association with the media type, and any parameter values associated with such parameter names must be as permitted; Fossati & Dijk Expires 11 August 2025 [Page 9] Internet-Draft CoAP Content-Format Registrations Update February 2025 4. The Content Type is in the preferred format defined in Section 5.4; 5. If a Content Coding is specified, it must exist (or must have been approved for registration) in the "HTTP Content Coding" registry of the "Hypertext Transfer Protocol (HTTP) Parameters" [IANA.http-parameters]. For the 0-255 range, in addition to the checks described above, the DE is instructed to also evaluate the requested codepoint concerning the limited availability of the 1-byte codepoint space. For the 256-9999 range and the 10000-64999 range, a similar criterion may also apply where combinations of media type parameters and content coding choices consume considerable code point space. 5.4. Preferred Format for the Content Type Field This section defines the preferred string format for including a requested Content Type into the CoAP Content-Formats registry. During the review process, the Designated Expert(s) or IANA may rewrite a requested Content Type into this preferred string format before approval. The preferred string format is as follows: 1. For any case-insensitive elements, lowercase characters must be used. See Section 8.3.1 of [RFC9110] for a definition of case- insensitive elements and some examples. 2. Parameter values are only quoted if the value is such that it requires use of quoted-string per Section 5.6.6 of [RFC9110]. Otherwise, a parameter value is included unquoted. 3. A semicolon followed by one space character is used as the separator between media type and parameters. 5.5. Temporary Note Removal This section is to be removed before publishing as an RFC. The following note has been added to the registry as a temporary fix: "Note: The validity of the combination of Content Coding, Content Type and parameters is checked prior to assignment." IANA is instructed to remove this note from the registry when this document is approved for publication. RFC-Editor: please remove this section once the note has been removed. Fossati & Dijk Expires 11 August 2025 [Page 10] Internet-Draft CoAP Content-Format Registrations Update February 2025 6. References 6.1. Normative References [BCP14] Best Current Practice 14, . At the time of writing, this BCP comprises the following: Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [BCP26] Cotton, M., Leiba, B., and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 8126, DOI 10.17487/RFC8126, June 2017, . [RFC7120] Cotton, M., "Early IANA Allocation of Standards Track Code Points", BCP 100, RFC 7120, DOI 10.17487/RFC7120, January 2014, . [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained Application Protocol (CoAP)", RFC 7252, DOI 10.17487/RFC7252, June 2014, . [RFC9110] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, Ed., "HTTP Semantics", STD 97, RFC 9110, DOI 10.17487/RFC9110, June 2022, . 6.2. Informative References [Err4954] RFC Errata Report 4954, RFC 7252, . [IANA.core-parameters] IANA, "Constrained RESTful Environments (CoRE) Parameters", . Fossati & Dijk Expires 11 August 2025 [Page 11] Internet-Draft CoAP Content-Format Registrations Update February 2025 [IANA.http-parameters] IANA, "Hypertext Transfer Protocol (HTTP) Parameters", . [IANA.media-types] IANA, "Media Types", . [IANA.provisional-standard-media-types] IANA, "Provisional Standard Media Type Registry", . [RFC8141] Saint-Andre, P. and J. Klensin, "Uniform Resource Names (URNs)", RFC 8141, DOI 10.17487/RFC8141, April 2017, . [RFC9193] Keränen, A. and C. Bormann, "Sensor Measurement Lists (SenML) Fields for Indicating Data Value Content-Format", RFC 9193, DOI 10.17487/RFC9193, June 2022, . Acknowledgments Thank you Amanda Baber, Carsten Bormann, Francesca Palombini, and Marco Tiloca for your reviews, comments, suggestions and fixes. Authors' Addresses Thomas Fossati Linaro Email: thomas.fossati@linaro.org Esko Dijk IoTconsultancy.nl Email: esko.dijk@iotconsultancy.nl Fossati & Dijk Expires 11 August 2025 [Page 12]