Network Working Group P. Hallam-Baker Internet-Draft Comodo Group Inc. Intended status: Informational August 18, 2017 Expires: February 19, 2018 Mathematical Mesh: Reference draft-hallambaker-mesh-reference-05 Abstract The Mathematical Mesh ?The Mesh? is an end-to-end secure infrastructure that facilitates the exchange of configuration and credential data between multiple user devices. The core protocols of the Mesh are described with examples of common use cases and reference data. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on February 19, 2018. Copyright Notice Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Hallam-Baker Expires February 19, 2018 [Page 1] Internet-Draft Mathematical Mesh Reference August 2017 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1. Requirements Language . . . . . . . . . . . . . . . . . . 4 2.2. Defined Terms . . . . . . . . . . . . . . . . . . . . . . 4 2.3. Related Specifications . . . . . . . . . . . . . . . . . 5 2.4. Implementation Status . . . . . . . . . . . . . . . . . . 5 3. Protocol Overview . . . . . . . . . . . . . . . . . . . . . . 5 3.1. Creating a new portal account . . . . . . . . . . . . . . 5 3.1.1. Checking Account Identifier for uniqueness . . . . . 5 3.2. Creating a new user profile . . . . . . . . . . . . . . . 6 3.2.1. Publishing a new user profile . . . . . . . . . . . . 13 3.3. Connecting a device profile to a user profile . . . . . . 15 3.3.1. Profile Authentication . . . . . . . . . . . . . . . 17 3.3.2. Connection request . . . . . . . . . . . . . . . . . 20 3.3.3. Administrator Polls Pending Connections . . . . . . . 21 3.3.4. Administrator updates and publishes the personal profile. . . . . . . . . . . . . . . . . . . . . . . 23 3.3.5. Administrator posts completion request. . . . . . . . 24 3.3.6. Connecting device polls for status update. . . . . . 25 3.4. Adding an application profile to a user profile . . . . . 26 3.5. Creating a recovery profile . . . . . . . . . . . . . . . 27 3.6. Recovering a profile . . . . . . . . . . . . . . . . . . 28 4. Shared Classes . . . . . . . . . . . . . . . . . . . . . . . 28 4.1. Cryptographic Data Classes . . . . . . . . . . . . . . . 28 4.1.1. Structure: PublicKey . . . . . . . . . . . . . . . . 28 4.1.2. Structure: SignedData . . . . . . . . . . . . . . . . 29 4.1.3. Structure: EncryptedData . . . . . . . . . . . . . . 29 4.2. Common Application Classes . . . . . . . . . . . . . . . 29 4.2.1. Structure: Connection . . . . . . . . . . . . . . . . 29 5. Mesh Profile Objects . . . . . . . . . . . . . . . . . . . . 30 5.1. Base Profile Objects . . . . . . . . . . . . . . . . . . 30 5.1.1. Structure: Entry . . . . . . . . . . . . . . . . . . 30 5.1.2. Structure: SignedProfile . . . . . . . . . . . . . . 30 5.1.3. Structure: Advice . . . . . . . . . . . . . . . . . . 31 5.1.4. Structure: PortalAdvice . . . . . . . . . . . . . . . 31 5.1.5. Structure: Profile . . . . . . . . . . . . . . . . . 31 5.2. Device Profile Classes . . . . . . . . . . . . . . . . . 32 5.2.1. Structure: SignedDeviceProfile . . . . . . . . . . . 32 5.2.2. Structure: DeviceProfile . . . . . . . . . . . . . . 32 5.2.3. Structure: DevicePrivateProfile . . . . . . . . . . . 32 5.3. Master Profile Objects . . . . . . . . . . . . . . . . . 33 5.3.1. Structure: SignedMasterProfile . . . . . . . . . . . 33 5.3.2. Structure: MasterProfile . . . . . . . . . . . . . . 33 5.4. Personal Profile Objects . . . . . . . . . . . . . . . . 33 5.4.1. Structure: SignedPersonalProfile . . . . . . . . . . 33 5.4.2. Structure: PersonalProfile . . . . . . . . . . . . . 34 Hallam-Baker Expires February 19, 2018 [Page 2] Internet-Draft Mathematical Mesh Reference August 2017 5.4.3. Structure: ApplicationProfileEntry . . . . . . . . . 34 5.5. Application Profile Objects . . . . . . . . . . . . . . . 35 5.5.1. Structure: SignedApplicationProfile . . . . . . . . . 35 5.5.2. Structure: ApplicationProfile . . . . . . . . . . . . 35 5.5.3. Structure: ApplicationProfilePrivate . . . . . . . . 35 5.5.4. Structure: ApplicationDevicePublic . . . . . . . . . 35 5.5.5. Structure: ApplicationDevicePrivate . . . . . . . . . 35 5.6. Key Escrow Objects . . . . . . . . . . . . . . . . . . . 36 5.6.1. Structure: EscrowEntry . . . . . . . . . . . . . . . 36 5.6.2. Structure: OfflineEscrowEntry . . . . . . . . . . . . 36 5.6.3. Structure: OnlineEscrowEntry . . . . . . . . . . . . 36 5.6.4. Structure: EscrowedKeySet . . . . . . . . . . . . . . 36 6. Portal Connection . . . . . . . . . . . . . . . . . . . . . . 36 6.1. Connection Request and Response Structures . . . . . . . 36 6.1.1. Structure: ConnectionRequest . . . . . . . . . . . . 36 6.1.2. Structure: SignedConnectionRequest . . . . . . . . . 37 6.1.3. Structure: ConnectionResult . . . . . . . . . . . . . 37 6.1.4. Structure: SignedConnectionResult . . . . . . . . . . 37 7. Mesh Portal Service Reference . . . . . . . . . . . . . . . . 37 7.1. Request Messages . . . . . . . . . . . . . . . . . . . . 38 7.1.1. Message: MeshRequest . . . . . . . . . . . . . . . . 38 7.2. Response Messages . . . . . . . . . . . . . . . . . . . . 38 7.2.1. Message: MeshResponse . . . . . . . . . . . . . . . . 38 7.3. Imported Objects . . . . . . . . . . . . . . . . . . . . 38 7.4. Common Structures . . . . . . . . . . . . . . . . . . . . 38 7.4.1. Structure: KeyValue . . . . . . . . . . . . . . . . . 38 7.4.2. Structure: SearchConstraints . . . . . . . . . . . . 39 7.5. Transaction: Hello . . . . . . . . . . . . . . . . . . . 39 7.6. Transaction: ValidateAccount . . . . . . . . . . . . . . 40 7.6.1. Message: ValidateRequest . . . . . . . . . . . . . . 40 7.6.2. Message: ValidateResponse . . . . . . . . . . . . . . 40 7.7. Transaction: CreateAccount . . . . . . . . . . . . . . . 41 7.7.1. Message: CreateRequest . . . . . . . . . . . . . . . 41 7.7.2. Message: CreateResponse . . . . . . . . . . . . . . . 42 7.8. Transaction: DeleteAccount . . . . . . . . . . . . . . . 42 7.8.1. Message: DeleteRequest . . . . . . . . . . . . . . . 42 7.8.2. Message: DeleteResponse . . . . . . . . . . . . . . . 42 7.9. Transaction: Get . . . . . . . . . . . . . . . . . . . . 42 7.9.1. Message: GetRequest . . . . . . . . . . . . . . . . . 43 7.9.2. Message: GetResponse . . . . . . . . . . . . . . . . 43 7.10. Transaction: Publish . . . . . . . . . . . . . . . . . . 44 7.10.1. Message: PublishRequest . . . . . . . . . . . . . . 44 7.10.2. Message: PublishResponse . . . . . . . . . . . . . . 44 7.11. Transaction: Status . . . . . . . . . . . . . . . . . . . 44 7.11.1. Message: StatusRequest . . . . . . . . . . . . . . . 44 7.11.2. Message: StatusResponse . . . . . . . . . . . . . . 45 7.12. Transaction: ConnectStart . . . . . . . . . . . . . . . . 45 7.12.1. Message: ConnectStartRequest . . . . . . . . . . . . 45 Hallam-Baker Expires February 19, 2018 [Page 3] Internet-Draft Mathematical Mesh Reference August 2017 7.12.2. Message: ConnectStartResponse . . . . . . . . . . . 46 7.13. Transaction: ConnectStatus . . . . . . . . . . . . . . . 46 7.13.1. Message: ConnectStatusRequest . . . . . . . . . . . 46 7.13.2. Message: ConnectStatusResponse . . . . . . . . . . . 46 7.14. Transaction: ConnectPending . . . . . . . . . . . . . . . 46 7.14.1. Message: ConnectPendingRequest . . . . . . . . . . . 47 7.14.2. Message: ConnectPendingResponse . . . . . . . . . . 47 7.15. Transaction: ConnectComplete . . . . . . . . . . . . . . 47 7.15.1. Message: ConnectCompleteRequest . . . . . . . . . . 47 7.15.2. Message: ConnectCompleteResponse . . . . . . . . . . 48 7.16. Transaction: Transfer . . . . . . . . . . . . . . . . . . 48 7.16.1. Message: TransferRequest . . . . . . . . . . . . . . 48 7.16.2. Message: TransferResponse . . . . . . . . . . . . . 48 8. Security Considerations . . . . . . . . . . . . . . . . . . . 49 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 49 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 49 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 49 11.1. Normative References . . . . . . . . . . . . . . . . . . 49 11.2. Informative References . . . . . . . . . . . . . . . . . 49 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 50 1. Introduction NB: The reference material in this document is generated from the schema used to derive the source code. The tool used to create this material has not been optimized to produce output for the IETF documentation format at this time. Consequently, the formatting is currently sub-optimal. 2. Definitions This section presents the related specifications and standard, the terms that are used as terms of art within the documents and the terms used as requirements language. 2.1. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] [RFC2119] . 2.2. Defined Terms The terms of art used in this document are described in the Mesh Architecture Guide [draft-hallambaker-mesh-architecture] [draft-hallambaker-mesh-architecture] . Hallam-Baker Expires February 19, 2018 [Page 4] Internet-Draft Mathematical Mesh Reference August 2017 2.3. Related Specifications The architecture of the Mathematical Mesh is described in the Mesh Architecture Guide [draft-hallambaker-mesh-architecture] [draft-hallambaker-mesh-architecture] . The Mesh documentation set and related specifications are described in this document. 2.4. Implementation Status The implementation status of the reference code base is described in the companion document [draft-hallambaker-mesh-developer] [draft-hallambaker-mesh-developer] . 3. Protocol Overview [Account request does not specify the portal in the request body, only the HTTP package includes this information. This is probably a bug.] 3.1. Creating a new portal account A user interacts with a Mesh service through a Mesh portal provider with which she establishes a portal account. For user convenience, a portal account identifier has the familiar @ format established in [~RFC822]. For example Alice selects example.com as her portal provider and chooses the account name alice. Her portal account identifier is alice. A user MAY establish accounts with multiple portal providers and/or change their portal provider at any time they choose. 3.1.1. Checking Account Identifier for uniqueness The first step in creating a new account is to check to see if the chosen account identifier is available. This allows a client to validate user input and if necessary warn the user that they need to choose a new account identifier when the data is first entered. The ValidateRequest message contains the requested account identifier and an optional language parameter to allow the service to provide informative error messages in a language the user understands. The Language field contains a list of ISO language identifier codes in order of preference, most preferred first. Hallam-Baker Expires February 19, 2018 [Page 5] Internet-Draft Mathematical Mesh Reference August 2017 POST /.well-known/mmm/HTTP/1.1 Host: example.com Content-Length: 90 { "ValidateRequest": { "Account": "test@prismproof.org", "Language": ["en-uk"]}} Figure 1 The ValidateResponse message returns the result of the validation request in the Valid field. Note that even if the value true is returned, a subsequent account creation request MAY still fail. HTTP/1.1 200 OK Date: Sat 19 Aug 2017 01:29:33 Content-Length: 190 { "ValidateResponse": { "Status": 201, "StatusDescription": "Operation completed successfully", "Valid": true, "Minimum": 1, "InvalidCharacters": ".,:;{}()[]<>?|\\@#"}} Figure 2 [Note that for the sake of concise presentation, the HTTP binding information is omitted from future examples.] 3.2. Creating a new user profile The first step in creating a new personal profile is to create a Master Profile object. This contains the long term Master Signing Key that will remain constant for the life of the profile, at least one Online Signature Key to be used for administering the personal profile and (optionally), one or more master escrow keys. For convenience, the descriptions of the Master Signing Key, Online Signing Keys and Escrow Keys typically include PKIX certificates signed by the Master Signing Key. This allows PKIX based applications to make use of PKIX certificate chains to express the same trust relationships described in the Mesh. { "MasterProfile": { Hallam-Baker Expires February 19, 2018 [Page 6] Internet-Draft Mathematical Mesh Reference August 2017 "Identifier": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN", "MasterSignatureKey": { "UDF": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN", "X509Certificate": " MIIFXTCCBEWgAwIBAgIRAOTDeMIxZ2CZjzhjGSSFbWEwDQYJKoZIhvcNAQENBQAw LjEsMCoGA1UEAxYjTUM3V1YtUlZYU0stVlFBQVEtNFVEWFQtNDRNWUctU1paUE4w ... GoMqzbUEN8B8Jici8tmiLAbw7vhXSGxmlB3TTZyRneIQ" , "PublicParameters": { "PublicKeyRSA": { "kid": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN", "n": " mgP7xdMUiyMMSLKXvx01_5ztGN5Sxp_u92V6u5o_UEzz9Jk-m0bf5k9RPqf8lzGn Y_rYm3MT648v_3KbEOvU7Kw2evC_b8kdpnkUJdDY5T0mWrLKlHLFBHvG-77MVDY6 P4gLqRQo48AB5FIiLPPig2KpMdgL7KBozDeLtHySd6RJJR8F_S5TXGdLTE0znx8X fVo7WgAvWvSjZF4DBBFVD5fVmaqhDLv1dx_ZwmEL9Et2fZAAHR7jATZaN_wWnutl 6YHqSxTVpp6yaS4zkOPB4Ttdlge3EOWr9Zbze0S9kMIHoVE4MXp3RPAbgYhaaCkU YZKmXNhJK8Wqgs6eaOa17Q" , "e": " AQAB" }}}, "MasterEscrowKeys": [{ "UDF": "MAYGU-KOZIK-U7ZFR-WNSG5-I5N75-HWCZQ", "X509Certificate": " MIIFXTCCBEWgAwIBAgIRAIJ_5SV70cXF3CFbLzfdiW4wDQYJKoZIhvcNAQENBQAw LjEsMCoGA1UEAxYjTUM3V1YtUlZYU0stVlFBQVEtNFVEWFQtNDRNWUctU1paUE4w ... F1dm2JNIyvjGgHHLRfEb5CdAcxHeWW9LiVuA-i8ysbhn" , "PublicParameters": { "PublicKeyRSA": { "kid": "MAYGU-KOZIK-U7ZFR-WNSG5-I5N75-HWCZQ", "n": " zzeXpXZTHcCybpgByPzvdVPfjd7we3MI1AmKAFiQmZJxePhnOff2fBdJm8H3O2Ga SmhgOgeoURGC3ZmOtABoYC2K9vqvu-zQbcic8Qh5TqS9MGIJAV4gzG_xTRkX8ehV MaUnPBP2_eapGthgBXNO0Tx-b1FIKmLvUC76QI2M-R2_V6OuoyGsob27mTW8zLEJ F2fSZUUHWvWPmDajk_SJBR7owdVVNR0GEh20TOl08BvOqg9g-9bAX8LPiMp8T2PC EmqC5x3BsInOEpzMIjAiWQkXTIvm5bZRMh20GDsLqRPzVxY2gu3P0vxKd4qpwJxI Rl_HdBsqmRC3khtp8ONZ6Q" , "e": " AQAB" }}}], "OnlineSignatureKeys": [{ "UDF": "MBDWG-CNYIB-KC3ZL-6HMY7-UAF6J-LOCXI", "X509Certificate": " Hallam-Baker Expires February 19, 2018 [Page 7] Internet-Draft Mathematical Mesh Reference August 2017 MIIFXDCCBESgAwIBAgIQWP5WHkoX9RH33gRvG1WR4zANBgkqhkiG9w0BAQ0FADAu MSwwKgYDVQQDFiNNQzdXVi1SVlhTSy1WUUFBUS00VURYVC00NE1ZRy1TWlpQTjAe ... yc-hLXmMaNlKgW_jIcY5lodRjxQ3VQfgr6g9II-jWeY" , "PublicParameters": { "PublicKeyRSA": { "kid": "MBDWG-CNYIB-KC3ZL-6HMY7-UAF6J-LOCXI", "n": " ooX--9-NAkimIZU57kKh4WcRrXztA8FYvNWz7Ja33yZBhOhHegU4WlHF5TZM2c20 Jcr7nCi1NEzr-grWnNs36AKgLOZdY1RfcYPEnpftldUpbr776a8n1gWNKtUPC8oW xV3FHZvFpzXNe3qVEoVoRH5947SNSIfG1i3iSlwwMDIFIDQ6_SRFXxMZ_jEbFrbS NpNDC4ZXNlghbEmFfetPtqtjXMYskZsZd7gdUw3SLExQF7e6ubk-a-zNsZO0MgB- D_HAYtEWafCZ8pfkJEMxWeIQKCGRTe6ACh1Hczj2dKuvIobgamGJyo-xIPF-Bn96 EHIUh2Mv57zMgayJIxTZMQ" , "e": " AQAB" }}}]}} Figure 3 The Master Profile is always signed using the Master Signing Key: Hallam-Baker Expires February 19, 2018 [Page 8] Internet-Draft Mathematical Mesh Reference August 2017 { "SignedMasterProfile": { "Identifier": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJNYXN0ZXJQcm9maWxlIjogewogICAgIklkZW50aWZpZXIiOiAiTUM3V1Yt UlZYU0stVlFBQVEtNFVEWFQtNDRNWUctU1paUE4iLAogICAgIk1hc3RlclNpZ25h ... QiJ9fX1dfX0" , "signatures": [{ "header": { "kid": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCmdqSE9hYjM4SHZUNUhZd3l2 NEc0cFVuRVlDMUZQUzUtLTZEQ19XOUM0UDgwbGhYWXl1M2p0cFNoNkMyWHFTN0kK QUwyaWhPaGEtcXBiUlpJNDJnM2h2USJ9" , "signature": " HFcnfDnxT_2epMRm_yUf1bjLeaIc6TmLaHkJPQWZFqWDVH4UZmeAi0NJxmEWZQ56 PEgsBIAfGaONbaqPeY6DFr9acQreAEEubBvkRuFo7KDAl2e1t91T2Cb3PcEcMtEM OOjs2e-VOBZm-PNgZUeJ_EtoDACW-Cq6LBML-1sMCRG7VE8rK-T7N6AgSBPMehG4 AIIGUQAuTJcpxyafH5CWASEFpzzl3cWy9jY0Ip1X5J_OkwOkJS5lGWgHW3VLHKPD ns04-I_41ZJBeExHlIYexIN8A37CAhs6_8kn-7xLePS-_FsvPoJHmotsjflQy6H3 LTOVO3SN3yRwRyiGMDMkVg" }]}}} Figure 4 Since the device used to create the personal profile is typically connected to the profile, a Device profile entry is created for it. This contains a Device Signing Key, a Device Encryption Key and a Device Authentication Key: Hallam-Baker Expires February 19, 2018 [Page 9] Internet-Draft Mathematical Mesh Reference August 2017 { "JoseWebSignature": { "unprotected": { "dig": "S512"}, "payload": " ewogICJEZXZpY2VQcm9maWxlIjogewogICAgIklkZW50aWZpZXIiOiAiTUFOR0gt TzRBNVUtWEVSMzItSjNJUE8tS0RHM0ctV01ZU0MiLAogICAgIk5hbWVzIjogWyJE ... UlVLakRRIiwKICAgICAgICAgICJlIjogIgpBUUFCIn19fX19" , "signatures": [{ "header": { "kid": "MANGH-O4A5U-XER32-J3IPO-KDG3G-WMYSC"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiClg0alV1OEF1RXdkbnllZzNJ c01ZdFpNNUdDV2U4V0s4OHplOWVDZFl1emRVZW1EQWVtOF9mZDhaTWtNa2JDTTEK U1ZCajMyc0ZvM0k0Y3R4VlBLdUZTQSJ9" , "signature": " ZwDQQrMxeiYgRvArdztwsdEYxrQciSv6dAijVHxhgY84YWPHVAVBuQSNqQ5kf8IQ Rh1vkclw_4bM7E3SAkMwP6hVVEy-ApLwA_C8GcUFfCq0OyGUQjm1w9lp7fNmuGEx CnMLPBTM0jTTKJaEOYTYVUx17WGNgT4Uj3nVmXmyEo1wCMOuv4Ihncg7RV2QEmvq XRAey8umSywia7vbusWNV4eQ2ha41xuVfd-N7cpQCDXw1ZW-PawMStf_knD2Q0T6 CRj7y3pOq1yJvHW_3H-z7YnalRLpAEupvzKovt68fEl9ZROvHk1XEuMhqo8TwVQU QDRTMCZFvdndRNwVCbvaFg" }]}} Figure 5 The Device Profile is signed using the Device Signing Key: Hallam-Baker Expires February 19, 2018 [Page 10] Internet-Draft Mathematical Mesh Reference August 2017 { "SignedDeviceProfile": { "Identifier": "MANGH-O4A5U-XER32-J3IPO-KDG3G-WMYSC", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJEZXZpY2VQcm9maWxlIjogewogICAgIklkZW50aWZpZXIiOiAiTUFOR0gt TzRBNVUtWEVSMzItSjNJUE8tS0RHM0ctV01ZU0MiLAogICAgIk5hbWVzIjogWyJE ... UlVLakRRIiwKICAgICAgICAgICJlIjogIgpBUUFCIn19fX19" , "signatures": [{ "header": { "kid": "MANGH-O4A5U-XER32-J3IPO-KDG3G-WMYSC"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiClg0alV1OEF1RXdkbnllZzNJ c01ZdFpNNUdDV2U4V0s4OHplOWVDZFl1emRVZW1EQWVtOF9mZDhaTWtNa2JDTTEK U1ZCajMyc0ZvM0k0Y3R4VlBLdUZTQSJ9" , "signature": " ZwDQQrMxeiYgRvArdztwsdEYxrQciSv6dAijVHxhgY84YWPHVAVBuQSNqQ5kf8IQ Rh1vkclw_4bM7E3SAkMwP6hVVEy-ApLwA_C8GcUFfCq0OyGUQjm1w9lp7fNmuGEx CnMLPBTM0jTTKJaEOYTYVUx17WGNgT4Uj3nVmXmyEo1wCMOuv4Ihncg7RV2QEmvq XRAey8umSywia7vbusWNV4eQ2ha41xuVfd-N7cpQCDXw1ZW-PawMStf_knD2Q0T6 CRj7y3pOq1yJvHW_3H-z7YnalRLpAEupvzKovt68fEl9ZROvHk1XEuMhqo8TwVQU QDRTMCZFvdndRNwVCbvaFg" }]}}} Figure 6 A personal profile would typically contain at least one application when first created. For the sake of demonstration, we will do this later. The personal profile thus consists of the master profile and the device profile: { "PersonalProfile": { "Identifier": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN", "SignedMasterProfile": { "Identifier": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJNYXN0ZXJQcm9maWxlIjogewogICAgIklkZW50aWZpZXIiOiAiTUM3V1Yt Hallam-Baker Expires February 19, 2018 [Page 11] Internet-Draft Mathematical Mesh Reference August 2017 UlZYU0stVlFBQVEtNFVEWFQtNDRNWUctU1paUE4iLAogICAgIk1hc3RlclNpZ25h ... QiJ9fX1dfX0" , "signatures": [{ "header": { "kid": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCmdqSE9hYjM4SHZUNUhZd3l2 NEc0cFVuRVlDMUZQUzUtLTZEQ19XOUM0UDgwbGhYWXl1M2p0cFNoNkMyWHFTN0kK QUwyaWhPaGEtcXBiUlpJNDJnM2h2USJ9" , "signature": " HFcnfDnxT_2epMRm_yUf1bjLeaIc6TmLaHkJPQWZFqWDVH4UZmeAi0NJxmEWZQ56 PEgsBIAfGaONbaqPeY6DFr9acQreAEEubBvkRuFo7KDAl2e1t91T2Cb3PcEcMtEM OOjs2e-VOBZm-PNgZUeJ_EtoDACW-Cq6LBML-1sMCRG7VE8rK-T7N6AgSBPMehG4 AIIGUQAuTJcpxyafH5CWASEFpzzl3cWy9jY0Ip1X5J_OkwOkJS5lGWgHW3VLHKPD ns04-I_41ZJBeExHlIYexIN8A37CAhs6_8kn-7xLePS-_FsvPoJHmotsjflQy6H3 LTOVO3SN3yRwRyiGMDMkVg" }]}}, "Devices": [{ "Identifier": "MANGH-O4A5U-XER32-J3IPO-KDG3G-WMYSC", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJEZXZpY2VQcm9maWxlIjogewogICAgIklkZW50aWZpZXIiOiAiTUFOR0gt TzRBNVUtWEVSMzItSjNJUE8tS0RHM0ctV01ZU0MiLAogICAgIk5hbWVzIjogWyJE ... UlVLakRRIiwKICAgICAgICAgICJlIjogIgpBUUFCIn19fX19" , "signatures": [{ "header": { "kid": "MANGH-O4A5U-XER32-J3IPO-KDG3G-WMYSC"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiClg0alV1OEF1RXdkbnllZzNJ c01ZdFpNNUdDV2U4V0s4OHplOWVDZFl1emRVZW1EQWVtOF9mZDhaTWtNa2JDTTEK U1ZCajMyc0ZvM0k0Y3R4VlBLdUZTQSJ9" , "signature": " ZwDQQrMxeiYgRvArdztwsdEYxrQciSv6dAijVHxhgY84YWPHVAVBuQSNqQ5kf8IQ Rh1vkclw_4bM7E3SAkMwP6hVVEy-ApLwA_C8GcUFfCq0OyGUQjm1w9lp7fNmuGEx CnMLPBTM0jTTKJaEOYTYVUx17WGNgT4Uj3nVmXmyEo1wCMOuv4Ihncg7RV2QEmvq XRAey8umSywia7vbusWNV4eQ2ha41xuVfd-N7cpQCDXw1ZW-PawMStf_knD2Q0T6 CRj7y3pOq1yJvHW_3H-z7YnalRLpAEupvzKovt68fEl9ZROvHk1XEuMhqo8TwVQU QDRTMCZFvdndRNwVCbvaFg" }]}}], "Applications": []}} Hallam-Baker Expires February 19, 2018 [Page 12] Internet-Draft Mathematical Mesh Reference August 2017 Figure 7 The personal profile is then signed using the Online Signing Key: { "SignedPersonalProfile": { "Identifier": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJQZXJzb25hbFByb2ZpbGUiOiB7CiAgICAiSWRlbnRpZmllciI6ICJNQzdX Vi1SVlhTSy1WUUFBUS00VURYVC00NE1ZRy1TWlpQTiIsCiAgICAiU2lnbmVkTWFz ... aW9ucyI6IFtdfX0" , "signatures": [{ "header": { "kid": "MBDWG-CNYIB-KC3ZL-6HMY7-UAF6J-LOCXI"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCjk4MEhfWnp3emxzeWtLQ0lF N1pBRUo5Z2dMRTc5cTRyQ3IwRjMwaVp2S1lKTldnaWlhTmdKOEhfZmFPbGZFWHkK YXoyNmdFQmtsbS1VTTdUMDJpVjJ0QSJ9" , "signature": " aS--SDvXmNWvwpWkbvhSAQOWX0B5IOGf93RpLX-QE8PYEGbORkd155Mg0Vl7QBhG UhQlCAd4R-pDN3-1rE5YP0OXHCwG44nXBgap-IqZ6ZPAvSOS6AruMqLsJLGmtYPK 4mdY8ZLnrwM88C0EgqsVhv_T2D0-roAImUHIqNu-9vJh3tL1jRqfubDappHWnF3S 9FiIK-cS_5Zo_ZB5OTSq_RJWCFmTXAK23onQ0cyJEq52cCF39KL5wKDQ3FcmEdTq SInUgfB6gJ5zkibWJIZWwR3HZqmi-2fNFCqimgNN1cvk2fzaA5c-AnRhQOTlXI1D nqRrjDbDLB2LdU_GLVarIg" }]}}} Figure 8 3.2.1. Publishing a new user profile Once the signed personal profile is created, the client can finaly make the request for the service to create the account. The request object contains the requested account identifier and profile: Hallam-Baker Expires February 19, 2018 [Page 13] Internet-Draft Mathematical Mesh Reference August 2017 { "CreateRequest": { "Account": "test@prismproof.org", "Profile": { "SignedPersonalProfile": { "Identifier": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJQZXJzb25hbFByb2ZpbGUiOiB7CiAgICAiSWRlbnRpZmllciI6ICJNQzdX Vi1SVlhTSy1WUUFBUS00VURYVC00NE1ZRy1TWlpQTiIsCiAgICAiU2lnbmVkTWFz ... aW9ucyI6IFtdfX0" , "signatures": [{ "header": { "kid": "MBDWG-CNYIB-KC3ZL-6HMY7-UAF6J-LOCXI"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCjk4MEhfWnp3emxzeWtLQ0lF N1pBRUo5Z2dMRTc5cTRyQ3IwRjMwaVp2S1lKTldnaWlhTmdKOEhfZmFPbGZFWHkK YXoyNmdFQmtsbS1VTTdUMDJpVjJ0QSJ9" , "signature": " aS--SDvXmNWvwpWkbvhSAQOWX0B5IOGf93RpLX-QE8PYEGbORkd155Mg0Vl7QBhG UhQlCAd4R-pDN3-1rE5YP0OXHCwG44nXBgap-IqZ6ZPAvSOS6AruMqLsJLGmtYPK 4mdY8ZLnrwM88C0EgqsVhv_T2D0-roAImUHIqNu-9vJh3tL1jRqfubDappHWnF3S 9FiIK-cS_5Zo_ZB5OTSq_RJWCFmTXAK23onQ0cyJEq52cCF39KL5wKDQ3FcmEdTq SInUgfB6gJ5zkibWJIZWwR3HZqmi-2fNFCqimgNN1cvk2fzaA5c-AnRhQOTlXI1D nqRrjDbDLB2LdU_GLVarIg" }]}}}}} Figure 9 The service reports the success (or failure) of the account creation request: { "CreateResponse": { "Status": 201, "StatusDescription": "Operation completed successfully"}} Figure 10 Hallam-Baker Expires February 19, 2018 [Page 14] Internet-Draft Mathematical Mesh Reference August 2017 3.3. Connecting a device profile to a user profile Connecting a device to a profile requires the client on the new device to interact with a client on a device that has administration capabilities, i.e. it has access to an Online Signing Key. Since clients cannot interact directly with other clients, a service is required to mediate the connection. This service is provided by a Mesh portal provider. All service transactions are initiated by the clients. First the connecting device posts ConnectStart, after which it may poll for the outcome of the connection request using ConnectStatus. Periodically, the Administration Device polls for a list of pending connection requests using ConnectPending. After posting a request, the administration device posts the result using ConnectComplete: Connecting Mesh Administration Device Service Device | | | | ConnectStart | | | ----------------------> | | | | ConnectPending | | | <---------------------- | | | | | | ConnectComplete | | | <---------------------- | | ConnectStatus | | | ----------------------> | | Figure 11 The first step in the process is for the client to generate a device profile. Ideally the device profile is bound to the device in a read-only fashion such that applications running on the device can make use of the deencryption and authentication keys but these private keys cannot be extracted from the device: { "DeviceProfile": { "Identifier": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD", "Names": ["Default"], "Description": "Unknown", "DeviceSignatureKey": { "UDF": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD", "PublicParameters": { "PublicKeyRSA": { Hallam-Baker Expires February 19, 2018 [Page 15] Internet-Draft Mathematical Mesh Reference August 2017 "kid": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD", "n": " ueeCAkqDQ-y7uc2TByy1r_OoKNFRAACtr4EbWkL2caJu5sYA6BaZD7LHh0RS9lFq hyV4BAS1PGjmXYvVJ5quvMkHussQiJUDBEu6Pk6bK1m4pRBI5-5BpfPNijrTjg2O TXv9tbmxPVI3X9Emg7WDETN_NCrv6vEA1ONaTmUznE4ilCTkti4gQoeHAJ8KUtO3 zrATmUXzRbQxxS2clalq9OkaPz05kDeuZYlGqIaUXlSb_oKnMFPhOgPLARddEHYS jhbGsI5hWDH_TrhDZgK0sTAibroEsPaAvXx1nHzPgzVOAZQI7n8wWWmPQdRkWJkO eIMgrO-elI0RGs3Ju4mStQ" , "e": " AQAB" }}}, "DeviceAuthenticationKey": { "UDF": "MCEA7-TTV2M-UYGTD-KUW4W-WZBHO-WU7QN", "PublicParameters": { "PublicKeyRSA": { "kid": "MCEA7-TTV2M-UYGTD-KUW4W-WZBHO-WU7QN", "n": " tqWSDHavRC5cILmPI8bFqaek70-vaC2gFoNEPVTxs5BNgjMwSE5jjtpFmFSAZOL- xo_rMhQqwSqK4SUgjKSrk9pMWFPTUGcb4o4AY6JhERfo92Gx0owv3qQmt06BdXBH K9Wth9ARbpOLJF0G1ymEgrO_X22A1yMsYzT915mZwXnxzN-ICyIwQ2K4qdB_8g_p KPgWod5jSb4PtKwu26Cx0dTOjzAbFyloU8lxIWuGMgZWPUzi7cFzL9A4hIw4eM7d oEtzD4STncKEq0Or60YJ4Kkw7E25aVrlk9jrKF3YGu7TRoUIHXMa06x8r-c-UKNf oxCundz4aAisHXsg2i9nlQ" , "e": " AQAB" }}}, "DeviceEncryptiontionKey": { "UDF": "MCWBO-ERCF5-TYEHN-573FA-WZYNG-UKX4N", "PublicParameters": { "PublicKeyRSA": { "kid": "MCWBO-ERCF5-TYEHN-573FA-WZYNG-UKX4N", "n": " 2FTQmwHHfwPl7OvKlyYwEHIF3VKsjSqsCh1ZOVw_SI8oITPQTaJ_VIeIrokOTZ7i 0IosAlWD9MpIWUmn1qw2B_VbSOuiKtMVs6RWt0DAFpC6gedQy8WRGQlatskSYYJ- 14Mlv87bGGMo1P815SP53yQ28MNgO8g1ZGVqBSs5_KLHcWakNDd0hKAFgF8KVcvF EyCmOGyIV-WtuJ44bagnX9JO1WuBwRVqlhkLqvp0CblJjQPiedTI2WjdeogyAbqr EfLtJzqayrGhzJa-xud4PipcI-ebpTrbD2XEB_4UKbV-Wuo5oFIXYQbNNDM-WPUE OqBgaurX7yuoanb8FQELXQ" , "e": " AQAB" }}}}} Figure 12 The device profile is then signed: Hallam-Baker Expires February 19, 2018 [Page 16] Internet-Draft Mathematical Mesh Reference August 2017 { "SignedDeviceProfile": { "Identifier": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJEZXZpY2VQcm9maWxlIjogewogICAgIklkZW50aWZpZXIiOiAiTUFRVE4t WUZJQlEtQ0s0QlctVFZURTMtR0ZQWTUtWUdKQkQiLAogICAgIk5hbWVzIjogWyJE ... ICAgICAgICAgImUiOiAiCkFRQUIifX19fX0" , "signatures": [{ "header": { "kid": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCkFhX0kzUUNvakpFekxRNVN3 MmxGLVBibnY2c3hKal8yTjBHUmJ5N1JYSmxBaXdWQ1NiY0lJWkpDVkowVkdYcjkK WVJJanNLT05qSFhLeExuOG5KTlRZdyJ9" , "signature": " ZpO0YsoYwnf_rAVEZMVjqvcFEI2PnCgX6xcVOvuIu7hi5z53bSSxAkVxUGWJxHax 11eTiS37iYDOqP3pWg19HS6hl55bWAwL9A6X3bJXFsj8Zm7Iw4UyzYGFRkon_TKL mFVzcsbgvLehgCaLsM9tNXuv6po_imD6ibacK2QpOQjM4E0xUUvr6rFM76zVcLJ_ Ki5EXrulsex4COciNkeNCacJOaMIS8JFlQG-3FNND9FL8DW1_pZOGSJX_t3LWpCS qbU4yKlIooE964wFivE21nm96SnpNhCiJTkGGgYZgtZ6RQZSKul1yfSs6qJrMuII LF4gj2QwhQCwi5Y4L3FNng" }]}}} Figure 13 3.3.1. Profile Authentication One of the main architecutral principles of the Mesh is bilateral authentication. Every device that is connected to a Mesh profile MUST authenticate the profile it is connecting to and every Mesh profile administrator MUST authenticate devices that are connected. Having created the necessary profile, the device MUST verify that it is connecting to the correct Mesh profile. The best mechanism for achieving this purpose depends on the capabilities of the device being connected. The administration device obviously requires some means of communicating with the user to serve its function. But the device being connected may have a limited display capability or no user interaction capability at all. Hallam-Baker Expires February 19, 2018 [Page 17] Internet-Draft Mathematical Mesh Reference August 2017 3.3.1.1. Interactive Devices If the device has user input and display capabilities, it can verify that it is connecting to the correct display by first requesting the user enter the portal account of the profile they wish to connect to, retreiving the profile associated with the device and displaying the profile fingerprint. The client requests the profile for the requested account name: { "GetRequest": { "Account": "test@prismproof.org", "Multiple": false}} Figure 14 The response contains the requested profile information. Hallam-Baker Expires February 19, 2018 [Page 18] Internet-Draft Mathematical Mesh Reference August 2017 { "GetResponse": { "Status": 201, "StatusDescription": "Operation completed successfully", "Entries": [{ "SignedPersonalProfile": { "Identifier": "MC7WV-RVXSK-VQAAQ-4UDXT-44MYG-SZZPN", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJQZXJzb25hbFByb2ZpbGUiOiB7CiAgICAiSWRlbnRpZmllciI6ICJNQzdX Vi1SVlhTSy1WUUFBUS00VURYVC00NE1ZRy1TWlpQTiIsCiAgICAiU2lnbmVkTWFz ... aW9ucyI6IFtdfX0" , "signatures": [{ "header": { "kid": "MBDWG-CNYIB-KC3ZL-6HMY7-UAF6J-LOCXI"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCjk4MEhfWnp3emxzeWtLQ0lF N1pBRUo5Z2dMRTc5cTRyQ3IwRjMwaVp2S1lKTldnaWlhTmdKOEhfZmFPbGZFWHkK YXoyNmdFQmtsbS1VTTdUMDJpVjJ0QSJ9" , "signature": " aS--SDvXmNWvwpWkbvhSAQOWX0B5IOGf93RpLX-QE8PYEGbORkd155Mg0Vl7QBhG UhQlCAd4R-pDN3-1rE5YP0OXHCwG44nXBgap-IqZ6ZPAvSOS6AruMqLsJLGmtYPK 4mdY8ZLnrwM88C0EgqsVhv_T2D0-roAImUHIqNu-9vJh3tL1jRqfubDappHWnF3S 9FiIK-cS_5Zo_ZB5OTSq_RJWCFmTXAK23onQ0cyJEq52cCF39KL5wKDQ3FcmEdTq SInUgfB6gJ5zkibWJIZWwR3HZqmi-2fNFCqimgNN1cvk2fzaA5c-AnRhQOTlXI1D nqRrjDbDLB2LdU_GLVarIg" }]}}}]}} Figure 15 Having received the profile data, the user can then verify that the device is attempting to connect to the correct profile by verifying that the fingerprint shown by the device attempting to connect is correct. 3.3.1.2. Constrained Interaction Devices Connection of an Internet of Things 'IoT' device that does not have the ability to accept user input requires a mechanism by which the user can identify the device they wish to connect to their profile and a mechanism to authenticate the profile to the device. Hallam-Baker Expires February 19, 2018 [Page 19] Internet-Draft Mathematical Mesh Reference August 2017 If the connecting device has a wired communication capability such as a USB port, this MAY be used to effect the device connection using a standardized interaction profile. But an increasing number of constrained IoT devices are only capable of wireless communication. Configuration of such devices for the purpose of the Mesh requires that we also consider configuration of the wireless networking capabilities at the same time. The precise mechanism by which this is achieved is therefore outside the scope of this particular document. However prototypes have been built and are being considered that make use of some or all of the following communication techniques: o Wired serial connection (RS232, RS485). o DHCP signalling. o Machine readable device identifiers (barcodes, QRCodes). o Default device profile installed during manufacture. o Optical communication path using camera on administrative device and status light on connecting device to communicate the device identifier, challenge nonce and confirm profile fingerprint. o Speech output on audio capable connecting device. 3.3.2. Connection request After the user verifies the device fingerprint as correct, the client posts a device connection request to the portal: Hallam-Baker Expires February 19, 2018 [Page 20] Internet-Draft Mathematical Mesh Reference August 2017 { "ConnectStartRequest": { "SignedRequest": { "Identifier": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJDb25uZWN0aW9uUmVxdWVzdCI6IHsKICAgICJQYXJlbnRVREYiOiAiTUM3 V1YtUlZYU0stVlFBQVEtNFVEWFQtNDRNWUctU1paUE4iLAogICAgIkRldmljZSI6 ... fX0sCiAgICAiRGV2aWNlRGF0YSI6IFtdfX0" , "signatures": [{ "header": { "kid": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCnl5NFB5VlczNE4yOWxtRXJ6 QndLaTc5R0FMcGN1YkZTdnJOYlljMUVwNFY3WFJPdG44dF9fTUVCVE43VzNPdGUK ZzdmOUNvUV80QW11aml6N25nczJhQSJ9" , "signature": " PP0nYt9eMq4ckofi5r0RHLyeV7mlF3oe0G-t_OJoclMqbZrUc4dwSPlQ0JT6ZWg- aJqmg1bZu48lnB-9-oe9wHXSJSboUBoZYqH_983tINQU2-k4ljFkr8Ff71g3LHYv 840yUAAVyiN1r2ftz-rRfJQSvxPztvbRcJ7OQBbsmMl3B4woVfdX-KB8GrvVs7Rg jMi8wgN8EnTiSCZ2d7IllHvUmCiVnmTuEf4kwOqCLq2a-bMTdQnXyFPEFSHIq1pY vCeNbidTcSDpjLqxDXqiW1r8hYbRmLqd-jKTT7SDpmbKzfK0OGjIC-0sRfrPK1uC B9RuP0Youg2eeioBPdHlVQ" }]}}, "AccountID": "test@prismproof.org"}} Figure 16 The portal verifies that the request is accepable and returns the transaction result: { "ConnectStartResponse": {}} Figure 17 3.3.3. Administrator Polls Pending Connections The client can poll the portal for the status of pending requests at any time (modulo any service throttling restrictions at the service side). But the request status will only change when an update is posted by an administration device. Hallam-Baker Expires February 19, 2018 [Page 21] Internet-Draft Mathematical Mesh Reference August 2017 Since the user is typically connecting a device to their profile, the next step in connecting the device is to start the administration client. When started, the client polls for pending connection requests using ConnectPendingRequest. { "ConnectPendingRequest": { "AccountID": "test@prismproof.org"}} Figure 18 The service responds with a list of pending requests: { "ConnectPendingResponse": { "Pending": [{ "Identifier": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJDb25uZWN0aW9uUmVxdWVzdCI6IHsKICAgICJQYXJlbnRVREYiOiAiTUM3 V1YtUlZYU0stVlFBQVEtNFVEWFQtNDRNWUctU1paUE4iLAogICAgIkRldmljZSI6 ... fX0sCiAgICAiRGV2aWNlRGF0YSI6IFtdfX0" , "signatures": [{ "header": { "kid": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCnl5NFB5VlczNE4yOWxtRXJ6 QndLaTc5R0FMcGN1YkZTdnJOYlljMUVwNFY3WFJPdG44dF9fTUVCVE43VzNPdGUK ZzdmOUNvUV80QW11aml6N25nczJhQSJ9" , "signature": " PP0nYt9eMq4ckofi5r0RHLyeV7mlF3oe0G-t_OJoclMqbZrUc4dwSPlQ0JT6ZWg- aJqmg1bZu48lnB-9-oe9wHXSJSboUBoZYqH_983tINQU2-k4ljFkr8Ff71g3LHYv 840yUAAVyiN1r2ftz-rRfJQSvxPztvbRcJ7OQBbsmMl3B4woVfdX-KB8GrvVs7Rg jMi8wgN8EnTiSCZ2d7IllHvUmCiVnmTuEf4kwOqCLq2a-bMTdQnXyFPEFSHIq1pY vCeNbidTcSDpjLqxDXqiW1r8hYbRmLqd-jKTT7SDpmbKzfK0OGjIC-0sRfrPK1uC B9RuP0Youg2eeioBPdHlVQ" }]}}]}} Figure 19 Hallam-Baker Expires February 19, 2018 [Page 22] Internet-Draft Mathematical Mesh Reference August 2017 3.3.4. Administrator updates and publishes the personal profile. The device profile is added to the Personal profile which is then signed by the online signing key. The administration client publishes the updated profile to the Mesh through the portal: { "ConnectPendingRequest": { "AccountID": "test@prismproof.org"}} Figure 20 As usual, the service returns the response code: { "ConnectPendingResponse": { "Pending": [{ "Identifier": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJDb25uZWN0aW9uUmVxdWVzdCI6IHsKICAgICJQYXJlbnRVREYiOiAiTUM3 V1YtUlZYU0stVlFBQVEtNFVEWFQtNDRNWUctU1paUE4iLAogICAgIkRldmljZSI6 ... fX0sCiAgICAiRGV2aWNlRGF0YSI6IFtdfX0" , "signatures": [{ "header": { "kid": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCnl5NFB5VlczNE4yOWxtRXJ6 QndLaTc5R0FMcGN1YkZTdnJOYlljMUVwNFY3WFJPdG44dF9fTUVCVE43VzNPdGUK ZzdmOUNvUV80QW11aml6N25nczJhQSJ9" , "signature": " PP0nYt9eMq4ckofi5r0RHLyeV7mlF3oe0G-t_OJoclMqbZrUc4dwSPlQ0JT6ZWg- aJqmg1bZu48lnB-9-oe9wHXSJSboUBoZYqH_983tINQU2-k4ljFkr8Ff71g3LHYv 840yUAAVyiN1r2ftz-rRfJQSvxPztvbRcJ7OQBbsmMl3B4woVfdX-KB8GrvVs7Rg jMi8wgN8EnTiSCZ2d7IllHvUmCiVnmTuEf4kwOqCLq2a-bMTdQnXyFPEFSHIq1pY vCeNbidTcSDpjLqxDXqiW1r8hYbRmLqd-jKTT7SDpmbKzfK0OGjIC-0sRfrPK1uC B9RuP0Youg2eeioBPdHlVQ" }]}}]}} Figure 21 Hallam-Baker Expires February 19, 2018 [Page 23] Internet-Draft Mathematical Mesh Reference August 2017 3.3.5. Administrator posts completion request. Having accepted the device and connected it to the profile, the administration client creates and signs a connection completion result which is posted to the portal using ConnectCompleteRequest: { "ConnectCompleteRequest": { "Result": { "Identifier": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJDb25uZWN0aW9uUmVzdWx0IjogewogICAgIkRldmljZSI6IHsKICAgICAg IklkZW50aWZpZXIiOiAiTUFRVE4tWUZJQlEtQ0s0QlctVFZURTMtR0ZQWTUtWUdK ... dUIKa2RZenBiV3kzNTZiY2oyZDZoUmtmZyJ9XX19fX19" , "signatures": [{ "header": { "kid": "MBDWG-CNYIB-KC3ZL-6HMY7-UAF6J-LOCXI"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCi1ZUjc5bXREeWFYS0hrRXJU NUJKSzJsbi11ZjZpUVN2eXkxYWtoc0lQZTBuVWR5N1dqZ2lLSElmcDJ6MVhsOTIK NllDbjBjaGoxZVBxV0RaOTM1R2JuZyJ9" , "signature": " bMdM4wiG6kin76JJ6QOgGEpKsVduOqk5UG-l2JYCcsDhAkyLa-v9tJbA8AlYfOq1 w2NwwfOR5c7fiT9OGOa5HVMFc1MY6vjbOjsn_op18PRruc3uFM5SEmW6rW6wWA8e q31B0wmK14uLpFp8X7nLO71DyuoTXnq0EDlIaY01ysGASBVve0qlo0G5QZvyU4oV KspDsQJJ0bl2fizkg50tBPWxOZ1KM4jGSEGkvrAB2D5CLozT3p-TYlHObAjz5O2i vLy_uH6YdZlbsHf1deOAeJ1qsF75ahXtf_pSjYVX10jKDW1lzAaTXD-FxkVmxM8i p-zPsos3ednASLWIf6dIpw" }]}}, "AccountID": "test@prismproof.org"}} Figure 22 Again, the service returns the response code: { "ConnectCompleteResponse": {}} Figure 23 Hallam-Baker Expires February 19, 2018 [Page 24] Internet-Draft Mathematical Mesh Reference August 2017 3.3.6. Connecting device polls for status update. As stated previously, the connecting device polls the portal periodically to determine the status of the pending request using ConnectStatusRequest: { "ConnectStatusRequest": { "AccountID": "test@prismproof.org", "DeviceID": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD"}} Figure 24 If the response is that the connection status has not changed, the service MAY return a response that specifies a minimum retry interval. In this case however there is a connection result: { "ConnectStatusResponse": { "Result": { "Identifier": "MAQTN-YFIBQ-CK4BW-TVTE3-GFPY5-YGJBD", "SignedData": { "unprotected": { "dig": "S512"}, "payload": " ewogICJDb25uZWN0aW9uUmVzdWx0IjogewogICAgIkRldmljZSI6IHsKICAgICAg IklkZW50aWZpZXIiOiAiTUFRVE4tWUZJQlEtQ0s0QlctVFZURTMtR0ZQWTUtWUdK ... dUIKa2RZenBiV3kzNTZiY2oyZDZoUmtmZyJ9XX19fX19" , "signatures": [{ "header": { "kid": "MBDWG-CNYIB-KC3ZL-6HMY7-UAF6J-LOCXI"}, "protected": " ewogICJhbGciOiAiUlM1MTIiLAogICJ2YWwiOiAiCi1ZUjc5bXREeWFYS0hrRXJU NUJKSzJsbi11ZjZpUVN2eXkxYWtoc0lQZTBuVWR5N1dqZ2lLSElmcDJ6MVhsOTIK NllDbjBjaGoxZVBxV0RaOTM1R2JuZyJ9" , "signature": " bMdM4wiG6kin76JJ6QOgGEpKsVduOqk5UG-l2JYCcsDhAkyLa-v9tJbA8AlYfOq1 w2NwwfOR5c7fiT9OGOa5HVMFc1MY6vjbOjsn_op18PRruc3uFM5SEmW6rW6wWA8e q31B0wmK14uLpFp8X7nLO71DyuoTXnq0EDlIaY01ysGASBVve0qlo0G5QZvyU4oV KspDsQJJ0bl2fizkg50tBPWxOZ1KM4jGSEGkvrAB2D5CLozT3p-TYlHObAjz5O2i vLy_uH6YdZlbsHf1deOAeJ1qsF75ahXtf_pSjYVX10jKDW1lzAaTXD-FxkVmxM8i p-zPsos3ednASLWIf6dIpw" }]}}}} Figure 25 Hallam-Baker Expires February 19, 2018 [Page 25] Internet-Draft Mathematical Mesh Reference August 2017 [Should probably unpack further.] 3.4. Adding an application profile to a user profile Application profiles are published separately from the personal profile to which they are linked. This allows a device to be given administration capability for a particular application without granting administration capability for the profile itself and the ability to connect additional profiles and devices. Another advantage of this separation is that an application profile might be managed by a separate party. In an enterprise, the application profile for a user's corporate email account could be managed by the corporate IT department. A user MAY have multiple application profiles for the same application. If a user has three email accounts, they would have three email application profiles, one for each account. In this example, the user has requested a PaswordProfile to be created. When populated, this records the usernames and passwords for the various Web sites that the user has created accounts at and has requested the Web browser store in the Mesh. Unlike a traditional password management service, the data stored the Password Profile is encrypted end to end and can only be decrypted by the devices that hold a decryption key. { "PasswordProfile": { "Identifier": "MBMBD-JYUK7-3BQG2-NZKFE-CMW5J-IUSRB-A"}} Figure 26 The application profile is published to the Mesh in the same way as any other profile update, via a a Publish transaction: {Point.Messages[0].String()} The service returns a status response. {Point.Messages[1].String()} Note that the degree of verification to be performed by the service when an application profile is published is an open question. Having created the application profile, the administration client adds it to the personal profile and publishes it: Hallam-Baker Expires February 19, 2018 [Page 26] Internet-Draft Mathematical Mesh Reference August 2017 {Point.Messages[0].String()} Note that if the publication was to happen in the reverse order, with the personal profile being published before the application profile, the personal profile might be rejected by the portal for inconsistency as it links to a non existent application profile. Though the value of such a check is debatable. It might well be preferable to not make such checks as it permits an application profile to have a degree of anonymity. {Point.Messages[1].String()} 3.5. Creating a recovery profile The Mesh invites users to put all their data eggs in one cryptographic basket. If the private keys in their master profile are lost, they could lose all their digital assets. The debate over the desirability of key escrow is a complex one. Not least because voluntary key escrow by the user to protect the user's digital assets is frequently conflated with mechanisms to support 'Lawful Access' through government managed backdoors. Accidents happen and so do disasters. For most users and most applications, data loss is a much more important concern than data disclosure. The option of using a robust key recovery mechanism is therefore essential for use of strong cryptography is to become ubiquitous. There are of course circumstances in which some users may prefer to risk losing some of their data rather than risk disclosure. Since any key recovery infrastructure necessarily introduces the risk of coercion, the choice of whether to use key recovery or not is left to the user to decide. The Mesh permits users to escrow their private keys in the Mesh itself in an OfflineEscrowEntry. Such entries are encrypted using the strongest degree of encryption available under a symmetric key. The symmetric key is then in turn split using Shamir secret sharing using an n of m threshold scheme. The OfflineEscrowEntry identifier is a UDF fingerprint of the symmetric key used to encrypt the data. This guarantees that a party that has the decryption key has the ability to locate the corresponding Escrow entry. The OfflineEscrowEntry is published using the usual Publish transaction: Hallam-Baker Expires February 19, 2018 [Page 27] Internet-Draft Mathematical Mesh Reference August 2017 {Point.Messages[0].String()} The response indicates success or failure: {Point.Messages[1].String()} 3.6. Recovering a profile To recover a profile, the user MUST supply the necessary number of secret shares. These are then used to calculate the UDF fingerprint to use as the locator in a Get transaction: {Point.Messages[0].String()} If the transaction succeeds, GetResponse is returned with the requested data. {Point.Messages[1].String()} The client can now decrypt the OfflineEscrowEntry to recover the private key(s). 4. Shared Classes The following classes are used as common elements in Mesh profile specifications.a 4.1. Cryptographic Data Classes Most Mesh objects are signed and/or encrypted. For consistency all Mesh classes make use of the cryptographic data classes described in this section. 4.1.1. Structure: PublicKey The PublicKey class is used to describe public key pairs and trust assertions associated with a public key. String (Optional) UDF fingerprint of the public key parameters/ Binary (Optional) List of X.509 Certificates Binary [0..Many] Hallam-Baker Expires February 19, 2018 [Page 28] Internet-Draft Mathematical Mesh Reference August 2017 X.509 Certificate chain. Binary (Optional) X.509 Certificate Signing Request. 4.1.2. Structure: SignedData Container for JOSE signed data and related attributes. Binary (Optional) The signed data 4.1.3. Structure: EncryptedData Container for JOSE encrypted data and related attributes. Binary (Optional) The encrypted data 4.2. Common Application Classes 4.2.1. Structure: Connection Describes network connection parameters for an application String (Optional) DNS address of the server Integer (Optional) TCP/UDP Port number String (Optional) DNS service prefix as described in [!RFC6335] String [0..Many] Describes the security mode to use. Valid choices are Direct/Upgrade/None String (Optional) Username to present to the service for authentication Hallam-Baker Expires February 19, 2018 [Page 29] Internet-Draft Mathematical Mesh Reference August 2017 String (Optional) Password to present to the service for authentication String (Optional) Service connection parameters in URI format String (Optional) List of the supported/acceptable authentication mechanisms, preferred mechanism first. Integer (Optional) Service timeout in seconds. Boolean (Optional) If set, the client should poll the specified service intermittently for updates. 5. Mesh Profile Objects 5.1. Base Profile Objects 5.1.1. Structure: Entry Base class for all Mesh Profile objects. String (Optional) Globally unique identifier that remains constant for the lifetime of the entry. 5.1.2. Structure: SignedProfile o Inherits: Entry Contains a signed profile entry JoseWebSignature (Optional) The signed profile. Note that each child of SignedProfile requires that the Payload field of the SignedData object contain an object of a specific type. For Hallam-Baker Expires February 19, 2018 [Page 30] Internet-Draft Mathematical Mesh Reference August 2017 example, a SignedDeviceProfile object MUST contain a Payload field that contains a DeviceProfile object. Advice (Optional) Additional data that is not authenticated. 5.1.3. Structure: Advice Additional data bound to a signed profile that is not authenticated. DateTime (Optional) If specified, the profile was the default profile at the specified date and time. The current default for that type of profile is the profile with the most recent Default timestamp. 5.1.4. Structure: PortalAdvice o Inherits: Advice String [0..Many] A portal address at which this profile is registered. 5.1.5. Structure: Profile o Inherits: Entry Parent class from which all profile types are derived String [0..Many] Fingerprints of index terms for profile retrieval. The use of the fingerprint of the name rather than the name itself is a precaution against enumeration attacks and other forms of abuse. DateTime (Optional) The time instant the profile was last modified. String (Optional) A Uniform Notary Token providing evidence that a signature was performed after the notary token was created. Hallam-Baker Expires February 19, 2018 [Page 31] Internet-Draft Mathematical Mesh Reference August 2017 5.2. Device Profile Classes 5.2.1. Structure: SignedDeviceProfile o Inherits: SignedProfile Contains a signed device profile [None] 5.2.2. Structure: DeviceProfile o Inherits: Profile Describes a mesh device. String (Optional) Description of the device PublicKey (Optional) Key used to sign certificates for the DAK and DEK. The fingerprint of the DSK is the UniqueID of the Device Profile PublicKey (Optional) Key used to authenticate requests made by the device. PublicKey (Optional) Key used to pass encrypted data to the device such as a DeviceUseEntry 5.2.3. Structure: DevicePrivateProfile Private portion of device encryption profile. Key (Optional) Private portion of the DeviceSignatureKey Key (Optional) Private portion of the DeviceAuthenticationKey Key (Optional) Hallam-Baker Expires February 19, 2018 [Page 32] Internet-Draft Mathematical Mesh Reference August 2017 Private portion of the DeviceEncryptiontionKey 5.3. Master Profile Objects 5.3.1. Structure: SignedMasterProfile o Inherits: SignedProfile Contains a signed Personal master profile [None] 5.3.2. Structure: MasterProfile o Inherits: Profile Describes the long term parameters associated with a personal profile. PublicKey (Optional) The root of trust for the Personal PKI, the public key of the PMSK is presented as a self-signed X.509v3 certificate with Certificate Signing use enabled. The PMSK is used to sign certificates for the PMEK, POSK and PKEK keys. PublicKey [0..Many] A Personal Profile MAY contain one or more PMEK keys to enable escrow of private keys used for stored data. PublicKey [0..Many] A Personal profile contains at least one POSK which is used to sign device administration application profiles. 5.4. Personal Profile Objects 5.4.1. Structure: SignedPersonalProfile o Inherits: SignedProfile Contains a signed Personal current profile [None] Hallam-Baker Expires February 19, 2018 [Page 33] Internet-Draft Mathematical Mesh Reference August 2017 5.4.2. Structure: PersonalProfile o Inherits: Profile Describes the current applications and devices connected to a personal master profile. SignedMasterProfile (Optional) The corresponding master profile. The profile MUST be signed by the PMSK. SignedDeviceProfile [0..Many] The set of device profiles connected to the profile. The profile MUST be signed by the DSK in the profile. ApplicationProfileEntry [0..Many] Application profiles connected to this profile. 5.4.3. Structure: ApplicationProfileEntry Personal profile entry describing the privileges of specific devices. String (Optional) The unique identifier of the application String (Optional) The application type String (Optional) Optional friendly name identifying the application. String [0..Many] List of devices authorized to sign application profiles String [0..Many] List of devices authorized to read private parts of application profiles Hallam-Baker Expires February 19, 2018 [Page 34] Internet-Draft Mathematical Mesh Reference August 2017 5.5. Application Profile Objects 5.5.1. Structure: SignedApplicationProfile o Inherits: SignedProfile Contains a signed device profile [None] 5.5.2. Structure: ApplicationProfile o Inherits: Profile Parent class from which all application profiles inherit. [None] 5.5.3. Structure: ApplicationProfilePrivate o Inherits: Entry The base class for all private profiles. [None] 5.5.4. Structure: ApplicationDevicePublic o Inherits: Entry Describes the public per device data String (Optional) Description of the device for convenience of the user. String (Optional) Fingerprint of device that this key corresponds to. 5.5.5. Structure: ApplicationDevicePrivate o Inherits: Entry Describes the private per device data [None] Hallam-Baker Expires February 19, 2018 [Page 35] Internet-Draft Mathematical Mesh Reference August 2017 5.6. Key Escrow Objects 5.6.1. Structure: EscrowEntry o Inherits: Entry Contains escrowed data JoseWebEncryption (Optional) The encrypted escrow data 5.6.2. Structure: OfflineEscrowEntry o Inherits: EscrowEntry Contains data escrowed using the offline escrow mechanism. [None] 5.6.3. Structure: OnlineEscrowEntry o Inherits: EscrowEntry Contains data escrowed using the online escrow mechanism. [None] 5.6.4. Structure: EscrowedKeySet A set of escrowed keys. [None] 6. Portal Connection 6.1. Connection Request and Response Structures 6.1.1. Structure: ConnectionRequest Describes a connection request. String (Optional) UDF of Mesh Profile to which connection is requested. SignedDeviceProfile (Optional) Hallam-Baker Expires February 19, 2018 [Page 36] Internet-Draft Mathematical Mesh Reference August 2017 The Device profile to be connected 6.1.2. Structure: SignedConnectionRequest o Inherits: SignedProfile Contains a ConnectionRequest signed by the corresponding device signature key. [None] 6.1.3. Structure: ConnectionResult Describes the result of a connection request. o Inherits: ConnectionRequest String (Optional) The result of the connection request. Valid responses are: Accepted, Refused, Query. 6.1.4. Structure: SignedConnectionResult o Inherits: SignedProfile Contains a signed connection result [None] 7. Mesh Portal Service Reference _mmm._tcp /.well-known/mmm Every Mesh Portal Service transaction consists of exactly one request followed by exactly one response. Mesh Service transactions MAY cause modification of the data stored in the Mesh Portal or the Mesh itself but do not cause changes to the connection state. The protocol itself is thus idempotent. There is no set sequence in which operations are required to be performed. It is not necessary to perform a Hello transaction prior to a ValidateAccount, Publish or any other transaction. Hallam-Baker Expires February 19, 2018 [Page 37] Internet-Draft Mathematical Mesh Reference August 2017 7.1. Request Messages A Mesh Portal Service request consists of a payload object that inherits from the MeshRequest class. When using the HTTP binding, the request MUST specify the portal DNS address in the HTTP Host field. 7.1.1. Message: MeshRequest Base class for all request messages. String (Optional) Name of the Mesh Portal Service to which the request is directed. 7.2. Response Messages A Mesh Portal Service response consists of a payload object that inherits from the MeshResponse class. When using the HTTP binding, the response SHOULD report the Status response code in the HTTP response message. However the response code returned in the payload object MUST always be considered authoritative. 7.2.1. Message: MeshResponse Base class for all response messages. Contains only the status code and status description fields. [None] 7.3. Imported Objects The Mesh Service protocol makes use of JSON objects defined in the JOSE Signatgure and Encryption specifications. 7.4. Common Structures The following common structures are used in the protocol messages: 7.4.1. Structure: KeyValue Describes a Key/Value structure used to make queries for records matching one or more selection criteria. String (Optional) The data retrieval key. Hallam-Baker Expires February 19, 2018 [Page 38] Internet-Draft Mathematical Mesh Reference August 2017 String (Optional) The data value to match. 7.4.2. Structure: SearchConstraints Specifies constraints to be applied to a search result. These allow a client to limit the number of records returned, the quantity of data returned, the earliest and latest data returned, etc. DateTime (Optional) Only data published on or after the specified time instant is requested. DateTime (Optional) Only data published before the specified time instant is requested. This excludes data published at the specified time instant. Integer (Optional) Maximum number of data entries to return. Integer (Optional) Maximum number of data bytes to return. String (Optional) Specifies a page key returned in a previous search operation in which the number of responses exceeded the specified bounds. When a page key is specified, all the other search parameters except for MaxEntries and MaxBytes are ignored and the service returns the next set of data responding to the earlier query. 7.5. Transaction: Hello Request: HelloRequest Response: HelloResponse Report service and version information. The Hello transaction provides a means of determining which protocol versions, message encodings and transport protocols are supported by the service. Hallam-Baker Expires February 19, 2018 [Page 39] Internet-Draft Mathematical Mesh Reference August 2017 7.6. Transaction: ValidateAccount Request: ValidateRequest Response: ValidateResponse Request validation of a proposed name for a new account. For validation of a user's account name during profile creation. 7.6.1. Message: ValidateRequest o Inherits: MeshRequest Describes the proposed account properties. Currently, these are limited to the account name but could be extended in future versions of the protocol. String (Optional) Account name requested Boolean (Optional) If true, request a reservation for the specified account name. Note that the service is not obliged to honor reservation requests. String [0..Many] List of ISO language codes in order of preference. For creating explanatory text. 7.6.2. Message: ValidateResponse o Inherits: MeshResponse States whether the proposed account properties are acceptable and (optional) returns an indication of what properties are valid. Note that receiving a 'Valid' responseto a Validate Request does not guarantee creation of the account. In addition to the possibility that the account namecould be requested by another user between the Validate and Create transactions, a portal service MAY perform more stringent validation criteria when an account is actually being created. For example, checking with the authoritative list of current accounts rather than a cached copy. Boolean (Optional) Hallam-Baker Expires February 19, 2018 [Page 40] Internet-Draft Mathematical Mesh Reference August 2017 If true, the specified account identifier is acceptable. If false, the account identifier is rejected. Integer (Optional) Specifies the minimum length of an account name. Integer (Optional) Specifies the maximum length of an account name. String (Optional) A list of characters that the service does not accept in account names. The list of characters MAY not be exhaustive but SHOULD include any illegal characters in the proposed account name. String (Optional) Text explaining the reason an account name was rejected. 7.7. Transaction: CreateAccount Request: CreateRequest Response: CreateResponse Request creation of a new portal account. Unlike a profile, a mesh account is specific to a particular Mesh portal. A mesh account must be created and accepted before a profile can be published. 7.7.1. Message: CreateRequest Request creation of a new portal account. The request specifies the requested account identifier and the Mesh profile to be associated with the account. o Inherits: MeshRequest String (Optional) Account identifier requested. Hallam-Baker Expires February 19, 2018 [Page 41] Internet-Draft Mathematical Mesh Reference August 2017 7.7.2. Message: CreateResponse o Inherits: MeshResponse Reports the success or failure of a Create transaction. [None] 7.8. Transaction: DeleteAccount Request: DeleteRequest Response: DeleteResponse Request deletion of a portal account. Deletes a portal account but not the underlying profile. Once registered, profiles are permanent. 7.8.1. Message: DeleteRequest Request deletion of a new portal account. The request specifies the requested account identifier. o Inherits: MeshRequest String (Optional) Account identifier to be deleted. 7.8.2. Message: DeleteResponse o Inherits: MeshResponse Reports the success or failure of a Delete transaction. [None] 7.9. Transaction: Get Request: GetRequest Response: GetResponse Search for data in the mesh that matches a set of properties described by a sequence of key/value pairs. Hallam-Baker Expires February 19, 2018 [Page 42] Internet-Draft Mathematical Mesh Reference August 2017 7.9.1. Message: GetRequest Describes the Portal or Mesh data to be retreived. o Inherits: MeshRequest String (Optional) Lookup by profile ID String (Optional) Lookup by Account ID KeyValue [0..Many] List of KeyValue pairs specifying the conditions to be met SearchConstraints (Optional) Constrain the search to a specific time interval and/or limit the number and/or total size of data records returned. Boolean (Optional) If true return multiple responses if available Boolean (Optional) If true, the client requests that the full Mesh data record be returned containing both the Mesh entry itself and the Mesh metadata that allows the date and time of the publication of the Mesh entry to be verified. 7.9.2. Message: GetResponse Reports the success or failure of a Get transaction. If a Mesh entry matching the specified profile is found, containsthe list of entries matching the request. o Inherits: MeshResponse DataItem [0..Many] List of mesh data records matching the request. String (Optional) Hallam-Baker Expires February 19, 2018 [Page 43] Internet-Draft Mathematical Mesh Reference August 2017 If non-null, indicates that the number and/or size of the data records returned exceeds either the SearchConstraints specified in the request or internal server limits. 7.10. Transaction: Publish Request: PublishRequest Response: PublishResponse Publish a profile or key escrow entry to the mesh. 7.10.1. Message: PublishRequest Requests publication of the specified Mesh entry. o Inherits: MeshRequest [None] 7.10.2. Message: PublishResponse Reports the success or failure of a Publish transaction. o Inherits: MeshResponse [None] 7.11. Transaction: Status Request: StatusRequest Response: StatusResponse Request the current status of the mesh as seen by the portal to which it is directed. The response to the status request contains the last signed checkpoint and proof chains for each of the peer portals that have been checkpointed. [Not currently implemented] 7.11.1. Message: StatusRequest o Inherits: MeshRequest Initiates a status transaction. Hallam-Baker Expires February 19, 2018 [Page 44] Internet-Draft Mathematical Mesh Reference August 2017 [None] 7.11.2. Message: StatusResponse Reports the success or failure of a Status transaction. o Inherits: MeshResponse DateTime (Optional) Time that the last write update was made to the Mesh DateTime (Optional) Time that the last Mesh checkpoint was calculated. DateTime (Optional) Time at which the next Mesh checkpoint should be calculated. String (Optional) Last checkpoint value. 7.12. Transaction: ConnectStart Request: ConnectStartRequest Response: ConnectStartResponse Request connection of a new device to a mesh profile 7.12.1. Message: ConnectStartRequest o Inherits: MeshRequest Initial device connection request. SignedConnectionRequest (Optional) Device connection request signed by thesignature key of the device requesting connection. String (Optional) Account identifier of account to which the device is requesting connection. Hallam-Baker Expires February 19, 2018 [Page 45] Internet-Draft Mathematical Mesh Reference August 2017 7.12.2. Message: ConnectStartResponse Reports the success or failure of a ConnectStart transaction. o Inherits: MeshRequest [None] 7.13. Transaction: ConnectStatus Request: ConnectStatusRequest Response: ConnectStatusResponse Request status of pending connection request of a new device to a mesh profile 7.13.1. Message: ConnectStatusRequest o Inherits: MeshRequest Request status information for a pending request posted previously. String (Optional) Account identifier for which pending connection information is requested. String (Optional) Device identifier of device requesting status information. 7.13.2. Message: ConnectStatusResponse Reports the success or failure of a ConnectStatus transaction. o Inherits: MeshRequest SignedConnectionResult (Optional) The signed ConnectionResult object. 7.14. Transaction: ConnectPending Request: ConnectPendingRequest Response: ConnectPendingResponse Hallam-Baker Expires February 19, 2018 [Page 46] Internet-Draft Mathematical Mesh Reference August 2017 Request a list of pending requests for an administration profile. 7.14.1. Message: ConnectPendingRequest o Inherits: MeshRequest Specify the criteria for pending requests. String (Optional) The account identifier of the account for which pending connection requests are requested. SearchConstraints (Optional) Constrain the search to a specific time interval and/or limit the number and/or total size of data records returned. 7.14.2. Message: ConnectPendingResponse Reports the success or failure of a ConnectPending transaction. o Inherits: MeshRequest SignedConnectionRequest [0..Many] A list of pending requests satisfying the criteria set out in the request. String (Optional) If non-null, indicates that the number and/or size of the data records returned exceeds either the SearchConstraints specified in the request or internal server limits. 7.15. Transaction: ConnectComplete Request: ConnectCompleteRequest Response: ConnectCompleteResponse Post response to a pending connection request. 7.15.1. Message: ConnectCompleteRequest Reports the success or failure of a ConnectComplete transaction. o Inherits: MeshRequest Hallam-Baker Expires February 19, 2018 [Page 47] Internet-Draft Mathematical Mesh Reference August 2017 SignedConnectionResult (Optional) The connection result to be posted to the portal. The result MUST be signed by a valid administration key for the Mesh profile. String (Optional) The account identifier to which the connection result is posted. 7.15.2. Message: ConnectCompleteResponse o Inherits: MeshRequest Reports the success or failure of a ConnectComplete transaction. [None] 7.16. Transaction: Transfer Request: TransferRequest Response: TransferResponse Perform a bulk transfer of the log between the specified transaction identifiers. Requires appropriate authorization [Not currently implemented] 7.16.1. Message: TransferRequest Request a bulk transfer of the log between the specified transaction identifiers. Requires appropriate authorization o Inherits: MeshRequest SearchConstraints (Optional) Constrain the search to a specific time interval and/or limit the number and/or total size of data records returned. 7.16.2. Message: TransferResponse o Inherits: MeshResponse Reports the success or failure of a Transfer transaction. If successful, contains the list of Mesh records to be transferred. DataItem [0..Many] Hallam-Baker Expires February 19, 2018 [Page 48] Internet-Draft Mathematical Mesh Reference August 2017 List of mesh data records matching the request. String (Optional) If non-null, indicates that the number and/or size of the data records returned exceeds either the SearchConstraints specified in the request or internal server limits. 8. Security Considerations 9. IANA Considerations All the IANA considerations for the Mesh documents are specified in this document 10. Acknowledgements 11. References 11.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997. [RFC6335] Cotton, M., Eggert, L., Touch, J., Westerlund, M., and S. Cheshire, "Internet Assigned Numbers Authority (IANA) Procedures for the Management of the Service Name and Transport Protocol Port Number Registry", BCP 165, RFC 6335, DOI 10.17487/RFC6335, August 2011. 11.2. Informative References [draft-hallambaker-mesh-architecture] Hallam-Baker, P., "Mathematical Mesh: Architecture", draft-hallambaker-mesh-architecture-03 (work in progress), May 2017. [draft-hallambaker-mesh-developer] Hallam-Baker, P., "Mathematical Mesh: Developer's Guide", draft-hallambaker-mesh-developer-02 (work in progress), September 2016. [RFC822] Crocker, D., "STANDARD FOR THE FORMAT OF ARPA INTERNET TEXT MESSAGES", STD 11, RFC 822, DOI 10.17487/RFC0822, August 1982. Hallam-Baker Expires February 19, 2018 [Page 49] Internet-Draft Mathematical Mesh Reference August 2017 Author's Address Phillip Hallam-Baker Comodo Group Inc. Email: philliph@comodo.com Hallam-Baker Expires February 19, 2018 [Page 50]