This EAD item is critical, i.e., it is used only with the negative value of its ead_label, indicating that the receiving RS must process the protocol with the received access token, or else abort the EDHOC session (see Section 3.8 of [RFC9528]). A Client or Resource Server supporting the profile of ACE defined in this document MUST support this EAD item.¶
-EAD_ACCESS_TOKEN is only used when uploading the first access token of a token series, but not for the update of access rights, see Section 4.8.¶
+EAD_ACCESS_TOKEN is used only when uploading the first access token of a token series, but not for the update of access rights, see Section 4.8.¶
Editor's note: Add example. Value for ead_label not from lowest range, suggested value 26.¶
This EAD item is critical, i.e., it is used only with the negative value of its ead_label, indicating that the receiving RS must process the protocol with the access token associated with this session_id and with the AUTH_CRED_C used in the EDHOC session, or else abort the EDHOC session (see Section 3.8 of [RFC9528]). A client or resource server supporting the profile of ACE defined in this document MUST support this EAD item.¶
-EAD_SESSION_ID is used if the access token is provisioned to the RS and valid, but there is a need to establish a new OSCORE Security Context between C and RS.¶
+EAD_SESSION_ID is used only if the access token has been provisioned to the RS and is valid, but there is a need to establish a (new) OSCORE Security Context with EDHOC between C and RS.¶
Editor's note: Add example. Value for ead_label from lowest range.¶
diff --git a/submission-updates/draft-ietf-ace-edhoc-oscore-profile.txt b/submission-updates/draft-ietf-ace-edhoc-oscore-profile.txt index 529f5d0..9df3cce 100644 --- a/submission-updates/draft-ietf-ace-edhoc-oscore-profile.txt +++ b/submission-updates/draft-ietf-ace-edhoc-oscore-profile.txt @@ -1031,7 +1031,7 @@ Table of Contents supporting the profile of ACE defined in this document MUST support this EAD item. - EAD_ACCESS_TOKEN is only used when uploading the first access token + EAD_ACCESS_TOKEN is used only when uploading the first access token of a token series, but not for the update of access rights, see Section 4.8. @@ -1054,9 +1054,9 @@ Table of Contents server supporting the profile of ACE defined in this document MUST support this EAD item. - EAD_SESSION_ID is used if the access token is provisioned to the RS - and valid, but there is a need to establish a new OSCORE Security - Context between C and RS. + EAD_SESSION_ID is used only if the access token has been provisioned + to the RS and is valid, but there is a need to establish a (new) + OSCORE Security Context with EDHOC between C and RS. Editor's note: Add example. Value for ead_label from lowest range.