Return-Path: <orie@or13.io>
X-Original-To: auth48archive@mail2.ietf.org
Delivered-To: auth48archive@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1])
	by mail2.ietf.org (Postfix) with ESMTP id EB417FACEFA0
	for <auth48archive@mail2.ietf.org>; Thu,  4 Jun 2026 05:56:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1;
	t=1780577809; bh=E3tVcW47tDDbQ8Q+Iq5ixsecmvMiFvUIKIBZXlKlD98=;
	h=References:In-Reply-To:From:Date:Subject:To:Cc;
	b=BneYLS8qkDzDy9BHuWvcS4BYqHKQH+dGj8O4xAXP7ExOOQfaXB7B1mozE/I7cn992
	 AnDlsTHQhoesfx5ebycB1ubxJMvVdKDZFXYNQkCUc6ywnEQc1YCi2YdX6CuwqaAA1j
	 fio47lfVBMPozDz8Ox68jA4XvGWzERpX5RBfHtKk=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level: 
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5
	tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
	DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001,
	RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001]
	autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key)
	header.d=or13.io
Received: from mail2.ietf.org ([166.84.6.31])
	by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id OnyAlAdZ5TqF for <auth48archive@mail2.ietf.org>;
	Thu,  4 Jun 2026 05:56:47 -0700 (PDT)
Received: from mail-vk1-xa2d.google.com (mail-vk1-xa2d.google.com
 [IPv6:2607:f8b0:4864:20::a2d])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256)
	(No client certificate requested)
	by mail2.ietf.org (Postfix) with ESMTPS id 83DACFACEE92
	for <auth48archive@rfc-editor.org>; Thu,  4 Jun 2026 05:55:47 -0700 (PDT)
Received: by mail-vk1-xa2d.google.com with SMTP id
 71dfb90a1353d-59ebb89109aso539342e0c.1
        for <auth48archive@rfc-editor.org>;
 Thu, 04 Jun 2026 05:55:47 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1780577741; cv=none;
        d=google.com; s=arc-20240605;
        b=ZB52eCbRWiCvpfAknNscLvqMSSh3kU2BSlYa8GoSe6YE2reIjOKicQnfz+oQZKxnki
         E3meICeVLLa0lEA82ikiU9EzTKnMYP3TuhyyLbySjiNCfLYOMiAr0/7TZllhErLtSuhp
         SO90jqZCA8JbF8gy0OCTSMFwtdAodYISytJiXIY1xkBHHeiLUBP0hTVqDZKVk04ofMPf
         NPJNL8kRhRZW2jn2FsQ+j69NmGLdMSpYTRjLiyoY6rja4iaXuYeVTppNgeuEwtx1Ds+J
         ehE4yJHYgrAcdedLf4lSVdllOexiThoSh1HFKHnCiDej1Y/OxD21RL+JjCH+rkuxm/NL
         auuQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;
 s=arc-20240605;
        h=cc:to:subject:message-id:date:from:in-reply-to:references
         :mime-version:dkim-signature;
        bh=dy57vf/zaEe5C5k7pflMdHu+ilqx8dxm2SD+qSnrCoU=;
        fh=hklrrz2lynJyuhD+LPtG4vycnGgiZKDyV7HeEFZ4t2g=;
        b=XDBMIhvEYaPF5R0S827rhGN82pCV7YlhqQ4pKEF89u3MfcYQWzt8dwf4AcQASc91nE
         dhDIMiogxqOYymX//L0GX6VZaN9ktrtGCJ3csODS7tE28NDP9o3xjonKAzkgea8vrOLl
         JtfOwXG2AbRrtPFiYdAPQruJXAY7jz7boA3qpumBl3kdgPPC3FBuqWVJBpYBfN/Ez/pZ
         kwAGYH+94yVky1yzmVDLDJD7DoA6m3Q6HHcNNei3wM2AlNLqhj6N9T2PKR1JJJ1zphfc
         AbAMxv+5l84qwbvlfHx+BkarP04FqbAP3PQ+5FM5CZn0/lhnrs+nsWfWKd6bhsL8l9O1
         MrKw==;
        darn=rfc-editor.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=or13.io; s=google; t=1780577741; x=1781182541; darn=rfc-editor.org;
        h=cc:to:subject:message-id:date:from:in-reply-to:references
         :mime-version:from:to:cc:subject:date:message-id:reply-to;
        bh=dy57vf/zaEe5C5k7pflMdHu+ilqx8dxm2SD+qSnrCoU=;
        b=K+Ro+gteNJeg+g3NSekDeJDniTbMuBxH2k8IrKke9cjUJWGVqeqJ6rhLNWUYXy4k21
         r4VyDJn2O95KiIR0+vcpOaz5aRm/F1mbOhl0eTE7ev0XiSkhOzCpbENWjzcvAfSeoVDq
         EBOrm415CDAAkVbK6AzGe6yxXGQ1rzpiklFUl3trvzlbRP5WZEsYsQhwLTyEFKeSK0QD
         G4nlQTGcaiGW33A8isvJL7eEeD9mhvbDMcdYPxlUnU2IKGlNW6hvpg6cIkUrU/8CRlk5
         VI9zy2UwmPE365rfnRDM5hmjUxtTKTvIY1C8CVXlSYkGlNgkPI/nZTCO2Z5Ol7p43cfT
         qfRg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20251104; t=1780577741; x=1781182541;
        h=cc:to:subject:message-id:date:from:in-reply-to:references
         :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
         :message-id:reply-to;
        bh=dy57vf/zaEe5C5k7pflMdHu+ilqx8dxm2SD+qSnrCoU=;
        b=NtlMZTQF8A6b95qqpvlmzTiPHWd1HOFrfQn6Fyc+iZKSaaq2oTjxYhHotE7h3+cdyi
         DotqCuj85mJajtbkXtPnfxZTcmXWOLXj0ZO64VznY2VF155dgJeOjU2LkCMF+gh1h5Zw
         uUgDlXLcRaFo61YWkk3/vAOzxXAncnyeW9g1J7dOxvUuiZo2dTcPfH7iJR3mv0qbXt7o
         Z96R3TdHbO9QnuFw0rJ8HCRvUCDpL8o2egXMWZSdYBnP6lF4qGA1GY7RX3jmlnwJ6n49
         RYVTrpIlwotSfEMA10VsBmFLTbF8e9rryXU0FqFjjJUxawGRO5qmHZIKo4EcqPEQ6reI
         JM4w==
X-Forwarded-Encrypted: i=1;
 AFNElJ8CLY0o9U+Z1Y5zD4NywkpJLJVz+z3xeCySqV8gL8u3wbv+F/tlXC6FxLyg7HdvCW8YGEVT/4pIbt9FK+Kt@rfc-editor.org
X-Gm-Message-State: AOJu0YzP13aHhUDhnf537cI87TYjBD61qy/fVjaDNe7dws/YopIvDBGM
	muW5aTjpxVH2BAT3atjtObsKvw5oEHqFMSHsXNuhDMS7z0q2k+bhUOLSMP/HLPTC/UY/kvPHfXh
	xDr7k9HTmHCMJ7nzgl7HrB8PqtthnOtiOwDS+44TAPQ==
X-Gm-Gg: Acq92OEdSnq7GJNUI6KMn5s7NglOHXaHMneW92z/QkKA3yzHtL0fcJYLQeP9z1aPDig
	ahRgtiKheeHESYhY3ivRZbickPJMgh8OoPmpKPVnxQu0uE0sF5O3Hojs38Q+eGl0ZmCQ+aIvS2H
	cxKhbNS0tc8fGfCyiMGQatipki6izu559vjrD+zwnMB6/uvdoucGiuwUErVAkRMclad6UBqVtd5
	Fg+tRxMDSHD3qwmLef4znboEnghzQUM8wobvDOPdBTXjQtJCAdLimjRFGtj4KrtaaXpGbD9H9+1
	BwmpVChQ5hXIZU9VOKxhKBmWlh3Isbgrb462b6Yus7ciJ249IBJM
X-Received: by 2002:a05:6122:3788:b0:56f:6b46:28be with SMTP id
 71dfb90a1353d-5a6e61c91cdmr4678026e0c.8.1780577741423; Thu, 04 Jun 2026
 05:55:41 -0700 (PDT)
MIME-Version: 1.0
References: <177933119520.10.8108173421221401387@rfc-editor.org>
 <64AEC0B7-82F5-420F-8226-80E8363163EE@staff.rfc-editor.org>
 <CAMzqgoyKfg2batAyo=pLaS5ZRYOcUQLE1TR6ZEJQngNceWtuYA@mail.gmail.com>
 <EC6FFBB9-1588-4D5F-80F8-ECE65E39E051@staff.rfc-editor.org>
 <CAMzqgoxWFi9z0TAzC2fohzS9e5nu02Pny1RT-fQsWOZMb0EtSQ@mail.gmail.com>
 <89d21ea2-00e4-3159-6199-5aac513b26ac@ietf.contact>
In-Reply-To: <89d21ea2-00e4-3159-6199-5aac513b26ac@ietf.contact>
From: Orie <orie@or13.io>
Date: Thu, 4 Jun 2026 07:55:30 -0500
X-Gm-Features: AVVi8Cf5nWd0egnW75wJG6T0BIcBJNu29Nc35ossZ2njdi5Ot_AfieTDVQ-ZYmc
Message-ID: 
 <CAMzqgoy-RWr6f1ZQ3rOMG2MMDx4gV3R_jCvFhQBZqE0_tcPW2Q@mail.gmail.com>
To: Henk Birkholz <henk.birkholz@ietf.contact>
Content-Type: multipart/alternative; boundary="000000000000c5d19406536d0f79"
Message-ID-Hash: 6VEAPAJYLO5MCLVJVV25WZWN2YKAD65Z
X-Message-ID-Hash: 6VEAPAJYLO5MCLVJVV25WZWN2YKAD65Z
X-MailFrom: orie@or13.io
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency;
 loop; banned-address; member-moderation; nonmember-moderation; administrivia;
 implicit-dest; max-recipients; max-size; news-moderation; no-subject;
 digests; suspicious-header
CC: Megan Ferguson <mferguson@staff.rfc-editor.org>,
 Steve Lasker <stevenlasker@hotmail.com>, auth48archive@rfc-editor.org,
 jon.geater@gmail.com, debcooley1@gmail.com, stndrds-inacio@andrew.cmu.edu,
 sec-ads@ietf.org, cose-chairs@ietf.org, rfc-editor@rfc-editor.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: =?utf-8?q?=5Bauth48=5D_Re=3A_Final_review_in_markdown=3A_RFC-to-be_9995_draf?=
 =?utf-8?q?t-ietf-cose-hash-envelope_for_your_review?=
List-Id: "Archiving AUTH48 exchanges between the RFC Production Center,
 the authors, and other related parties" <auth48archive.rfc-editor.org>
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/auth48archive/vgkkxnU4mdP4htZMcdDpQSAux80>
List-Archive: <https://mailarchive.ietf.org/arch/browse/auth48archive>
List-Help: <mailto:auth48archive-request@rfc-editor.org?subject=help>
List-Owner: <mailto:auth48archive-owner@rfc-editor.org>
List-Post: <mailto:auth48archive@rfc-editor.org>
List-Subscribe: <mailto:auth48archive-join@rfc-editor.org>
List-Unsubscribe: <mailto:auth48archive-leave@rfc-editor.org>

--000000000000c5d19406536d0f79
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Lets go with Henk's reply regarding commas.

OS

On Thu, Jun 4, 2026 at 7:54=E2=80=AFAM Henk Birkholz <henk.birkholz@ietf.co=
ntact>
wrote:

> Hi!
>
> Sorry, maybe my reply never made it out. I have to disagree with Orie on
> (3) here and I thought that I stated that before (but cannot find a
> corresponding reply in my Sent box, so here it is "again"):
>
> For consistency over all CDDL, I would propose:
>
> >    Hash_Envelope_Protected_Header =3D {
> >        ? &(alg: 1) =3D> int,
> >        &(payload_hash_alg: 258) =3D> int,
> >        ? &(payload_preimage_content_type: 259) =3D> uint / tstr,
> >        ? &(payload_location: 260) =3D> tstr,
> >        * (int / tstr) =3D> any
> >    }
>
> which would be consistent with the previous CDDL block:
>
> >    Hash_Envelope_as_COSE_Sign1 =3D [
> >        protected: bstr .cbor Hash_Envelope_Protected_Header,
> >        unprotected: Hash_Envelope_Unprotected_Header,
> >        payload: bstr / nil,
> >        signature: bstr
> >    ]
>
> All of the variants are correct. This proposal is purely optical and
> target towards consistency.
>
>
> Viele Gr=C3=BC=C3=9Fe,
>
> Henk
>
>
>
>
> On 04.06.26 14:41, Orie wrote:
> > Hi,
> >
> > Addressing 3 and 11:
> >
> > 3. keep the comma.
> > 11. use " for values, not `.
> >
> > Regards,
> >
> > OS
> >
> > On Wed, May 27, 2026 at 12:30=E2=80=AFPM Megan Ferguson
> > <mferguson@staff.rfc-editor.org <mailto:mferguson@staff.rfc-editor.org>=
>
>
> > wrote:
> >
> >     Hi Orie,
> >
> >     Thanks for the reply and guidance!
> >
> >     We have updated as requested.  We believe questions #3 and #11
> >     remain unresolved for now.
> >
> >     We have posted the updated files below.  Please review carefully as
> >     we do not make changes once a document is published as an RFC.
> >
> >     The files are available here (please refresh):
> >     https://www.rfc-editor.org/authors/rfc9995.md
> >     <https://www.rfc-editor.org/authors/rfc9995.md>
> >     https://www.rfc-editor.org/authors/rfc9995.html
> >     <https://www.rfc-editor.org/authors/rfc9995.html>
> >     https://www.rfc-editor.org/authors/rfc9995.pdf
> >     <https://www.rfc-editor.org/authors/rfc9995.pdf>
> >     https://www.rfc-editor.org/authors/rfc9995.txt
> >     <https://www.rfc-editor.org/authors/rfc9995.txt>
> >
> >     The diff files are available here (please refresh):
> >     https://www.rfc-editor.org/authors/rfc9995-diff.html
> >     <https://www.rfc-editor.org/authors/rfc9995-diff.html>
> (comprehensive)
> >     https://www.rfc-editor.org/authors/rfc9995-rfcdiff.html
> >     <https://www.rfc-editor.org/authors/rfc9995-rfcdiff.html> (side by
> side)
> >
> >     https://www.rfc-editor.org/authors/rfc9995-auth48diff.html
> >     <https://www.rfc-editor.org/authors/rfc9995-auth48diff.html> (AUTH4=
8
> >     changes only)
> >     https://www.rfc-editor.org/authors/rfc9995-auth48rfcdiff.html
> >     <https://www.rfc-editor.org/authors/rfc9995-auth48rfcdiff.html>
> >     (side by side)
> >
> >     The details of the AUTH48 status of your document are here:
> >     https://www.rfc-editor.org/auth48/rfc9995
> >     <https://www.rfc-editor.org/auth48/rfc9995>
> >
> >     Thank you.
> >
> >     Megan Ferguson
> >     RFC Production Center
> >
> >
> >      > On May 27, 2026, at 7:15=E2=80=AFAM, Orie <orie@or13.io
> >     <mailto:orie@or13.io>> wrote:
> >      >
> >      >
> >      > Hi,
> >      >
> >      > Thank you for the work on this document!
> >      > Inline for the rest:
> >      >
> >      >
> >      > On Tue, May 26, 2026 at 11:56=E2=80=AFAM Megan Ferguson
> >     <mferguson@staff.rfc-editor.org
> >     <mailto:mferguson@staff.rfc-editor.org>> wrote:
> >      > Just resending to add Steve=E2=80=99s preferred email to the thr=
ead.
> >      >
> >      > > On May 20, 2026, at 8:39=E2=80=AFPM, rfc-editor@rfc-editor.org
> >     <mailto:rfc-editor@rfc-editor.org> wrote:
> >      > >
> >      > > Authors,
> >      > >
> >      > > While reviewing this document during AUTH48, please resolve (a=
s
> >     necessary) the following questions, which are also in the source
> file.
> >      > >
> >      > > 1) <!-- [rfced] Please insert any keywords (beyond those that
> >     appear in
> >      > > the title) for use on https://www.rfc-editor.org/search
> >     <https://www.rfc-editor.org/search>. -->
> >      > >
> >      > >
> >      > > 2) <!--[rfced] Please review and confirm this suggested update
> >     maintains
> >      > > your intended meaning:
> >      > >
> >      > > Original:
> >      > > COSE defined detached payloads in Section 2 of [RFC9052], usin=
g
> >     nil as
> >      > > the payload.
> >      > >
> >      > > Perhaps:
> >      > > Section 2 of [RFC9052] defines detached payloads for COSE,
> >     using nil
> >      > > as the payload.  -->
> >      > >
> >      >
> >      > I prefer your edit to the original here.
> >      >
> >      > >
> >      > > 3) <!--[rfced] Please review our update to add a comma at the
> >     end of a line in the CDDL:
> >      > >
> >      > > Original:
> >      > > &(payload_hash_alg: 258) =3D> int
> >      > >
> >      > > Current:
> >      > > &(payload_hash_alg: 258) =3D> int,
> >      > >
> >      > > -->
> >      > >
> >      >
> >      > I prefer the comma, though I will admit I have lost track of CDD=
L
> >     best practices for this... @Henk Birkholz ?
> >      >
> >      > >
> >      > > 4) <!--[rfced] Please review our updates to the following text
> >     to ensure
> >      > > we have maintained your intended meaning:
> >      > >
> >      > > Original:
> >      > >   For example, when the actual content is a bstr, a Verifier
> >     appraising
> >      > >   a content-type bstr has to decide if that bstr describes the
> >     digest
> >      > >   bytes or the preimage bytes.  Setting preimage-content-type
> >     to bstr,
> >      > >   makes it clear that the preimage bytes themselves were a bst=
r.
> >      > >
> >      > > Current:
> >      > >   For example, when the actual content is a byte string (bstr)=
,
> a
> >      > >   verifier appraising the payload has to decide whether that
> bstr
> >      > >   represents the digest bytes or the preimage bytes.  Setting
> >      > >   payload_preimage_content_type to bstr makes it clear that th=
e
> >      > >   preimage bytes themselves were a bstr.
> >      > >
> >      >
> >      > Current looks good to me.
> >      >
> >      > > -->
> >      > >
> >      > >
> >      > > 5) <!-- [rfced] We updated the URL for application/spdx+json a=
s
> >     shown below, as the original was 404. Please review and let us know
> >     if any corrections are needed.
> >      > >
> >      > > Original:
> >     https://www.iana.org/assignments/media-types/application/spdx+
> >     <https://www.iana.org/assignments/media-types/application/spdx+>
> >      > > current:
> >     https://www.iana.org/assignments/media-types/application/spdx+json
> >     <https://www.iana.org/assignments/media-types/application/spdx+json=
>
> >      > > -->
> >      > >
> >      >
> >      > Thanks for correcting!
> >      >
> >      > >
> >      > > 6) <!--[rfced] Using "the" before manifest.spdx.json makes it
> >     feel like a
> >      > > label is missing.  Please review.
> >      > >
> >      > > Original:
> >      > >   The payload of this COSE_Sign1 is the SHA256 hash of the
> >      > >   manifest.spdx.json.
> >      > >
> >      > > -->
> >      > >
> >      >
> >      > "the" could be removed here I think.
> >      >
> >      > >
> >      > > 7) <!--[rfced] Please review if internet should be Internet
> here:
> >      > >
> >      > > Original:
> >      > >   Verifiers that do not have access to the internet and obtain
> the
> >      > >   preimage via other means will not be able to perform that
> >     check, nor
> >      > >   to derive utility from it.
> >      > > -->
> >      >
> >      > I think it can remain lower case here.
> >      >   >
> >      > >
> >      > > 8) <!-- [rfced] We updated the "Value Registry" column of tabl=
e
> >     1 to include references to "CoAP Content-Formats" and "COSE
> >     Algorithms".  Please review and let us know any concerns.  The
> >     references have been added as informative references.
> >      > >
> >      > > Because we added a reference to the COSE Algorithms registry,
> >     we also replaced the URL below with an in text citation.  Please
> >     review.
> >      > >
> >      > > Original:
> >      > >   Note that when using a pre-hash
> >      > >   algorithm, the algorithm MUST be registered in the IANA COSE
> >      > >   Algorithms registry (https://www.iana.org/assignments/cose/
> >     <https://www.iana.org/assignments/cose/>
> >      > >   cose.xhtml#algorithms), and MUST be distinguishable from
> >     non-pre hash
> >      > >   variants that may also be present.
> >      > >
> >      > > Current:
> >      > >   Note that, when using a pre-hash algorithm,
> >      > >   the algorithm MUST be registered in the IANA "COSE Algorithm=
s"
> >      > >   registry [COSE-Algorithms] and MUST be distinguishable from
> >     non-pre-
> >      > >   hash variants that may also be present.
> >      > > -->
> >      >
> >      > Looks good to me.
> >      >   >
> >      > >
> >      > > 9) <!--[rfced] Please review the following possible
> >     inconsistencies with regard to terminology:
> >      > >
> >      > > COSE_MAC vs. COSE_Mac
> >      > > SHA-256 vs. SHA256
> >      > > SHA-384 vs. SHA384
> >      > > -->
> >      >
> >      > It must be "COSE_Mac" and  "SHA-256".
> >      >
> >      > >
> >      > >
> >      > > 10) <!--[rfced] We had the following questions related to
> >     abbreviation use in the document:
> >      > >
> >      > > a) Please note that we have expanded abbreviations on first us=
e.
> >      > > Please review for accuracy.
> >      > >
> >      > > b) Would you like to expand SPDX as "System Package Data
> >     Exchange" on
> >      > > first use?  -->
> >      > >
> >      >
> >      > No, but expanded as "Software Package Data Exchange" seems like =
a
> >     good idea:
> >     https://en.wikipedia.org/wiki/Software_Package_Data_Exchange
> >     <https://en.wikipedia.org/wiki/Software_Package_Data_Exchange>
> >      >
> >      >
> >      > >
> >      > > 11) <!--[rfced] In the response to our intake form, we saw:
> >      > >
> >      > > We only use ` ... I suspect we might be better off using " for
> >     a few
> >      > > values instead of `, and reserve ` for highlighting code point=
s
> and
> >      > > not examples.
> >      > >
> >      > > Please let us know if/how updates should be made using Old/New
> >     and/or
> >      > > by updating the edited file directly. -->
> >      > >
> >      >
> >      > Lets address this at the end, to avoid chatter, I'm not attached
> >     to making any changes here, just called it out during intake.
> >      >
> >      > >
> >      > > Thank you.
> >      > > Megan Ferguson and Sandy Ginoza
> >      > > RFC Production Center
> >      > >
> >      > >
> >      > >
> >      > >
> >      > > On May 20, 2026, at 4:20=E2=80=AFPM, rfc-editor@rfc-editor.org
> >     <mailto:rfc-editor@rfc-editor.org> wrote:
> >      > >
> >      > > RFC Author(s):
> >      > >
> >      > > Your document is now ready for Final Review (previously AUTH48=
).
> >      > >
> >      > > The document was edited in kramdown-rfc as part of the RPC
> >     pilot test (see
> >      > >
> >
> https://www.rfc-editor.org/rpc/wiki/doku.php?id=3Dpilot_test_kramdown_rfc=
 <
> https://www.rfc-editor.org/rpc/wiki/doku.php?id=3Dpilot_test_kramdown_rfc=
>).
> >      > >
> >      > > Please review the procedures for your review using kramdown-rf=
c:
> >      > >
> >      > >
> >
> https://www.rfc-editor.org/rpc/wiki/doku.php?id=3Dpilot_test_instructions=
_completing_auth48_using_kramdown
> <
> https://www.rfc-editor.org/rpc/wiki/doku.php?id=3Dpilot_test_instructions=
_completing_auth48_using_kramdown
> >
> >      > >
> >      > > Once the review is complete, it will be published as an RFC.
> >      > >
> >      > >
> >      > > Files
> >      > > -----
> >      > >
> >      > > The files are available here:
> >      > > https://www.rfc-editor.org/authors/rfc9995.md
> >     <https://www.rfc-editor.org/authors/rfc9995.md>
> >      > > https://www.rfc-editor.org/authors/rfc9995.html
> >     <https://www.rfc-editor.org/authors/rfc9995.html>
> >      > > https://www.rfc-editor.org/authors/rfc9995.pdf
> >     <https://www.rfc-editor.org/authors/rfc9995.pdf>
> >      > > https://www.rfc-editor.org/authors/rfc9995.txt
> >     <https://www.rfc-editor.org/authors/rfc9995.txt>
> >      > >
> >      > > Diff file of the text:
> >      > > https://www.rfc-editor.org/authors/rfc9995-diff.html
> >     <https://www.rfc-editor.org/authors/rfc9995-diff.html>
> >      > > https://www.rfc-editor.org/authors/rfc9995-rfcdiff.html
> >     <https://www.rfc-editor.org/authors/rfc9995-rfcdiff.html> (side by
> side)
> >      > >
> >      > > Diff of the kramdown:
> >      > > https://www.rfc-editor.org/authors/rfc9995-md-diff.html
> >     <https://www.rfc-editor.org/authors/rfc9995-md-diff.html>
> >      > > https://www.rfc-editor.org/authors/rfc9995-md-rfcdiff.html
> >     <https://www.rfc-editor.org/authors/rfc9995-md-rfcdiff.html> (side
> >     by side)
> >      > >
> >      > >
> >      > > Tracking progress
> >      > > -----------------
> >      > >
> >      > > The details of the AUTH48 status of your document are here:
> >      > > https://www.rfc-editor.org/auth48/rfc9995
> >     <https://www.rfc-editor.org/auth48/rfc9995>
> >      > >
> >      > >
> >      > > Please let us know if you have any questions.
> >      > >
> >      > > Thank you for your cooperation,
> >      > >
> >      > > RFC Editor
> >      > >
> >      > > --------------------------------------
> >      > > RFC 9995 (draft-ietf-cose-hash-envelope)
> >      > >
> >      > > Title            : COSE Hash Envelope
> >      > > Author(s)        : O. Steele,
> >      > >                  S. Lasker,
> >      > >                  H. Birkholz
> >      > > WG Chair(s)      : Ivaylo Petrov, Michael Jones
> >      > > Area Director(s) : Deb Cooley, Christopher Inacio
> >      > >
> >      >
> >
>

--000000000000c5d19406536d0f79
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Lets go with Henk&#39;s reply regarding commas.<br><br>OS<=
/div><br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" =
class=3D"gmail_attr">On Thu, Jun 4, 2026 at 7:54=E2=80=AFAM Henk Birkholz &=
lt;henk.birkholz@ietf.contact&gt; wrote:<br></div><blockquote class=3D"gmai=
l_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,20=
4,204);padding-left:1ex">Hi!<br>
<br>
Sorry, maybe my reply never made it out. I have to disagree with Orie on <b=
r>
(3) here and I thought that I stated that before (but cannot find a <br>
corresponding reply in my Sent box, so here it is &quot;again&quot;):<br>
<br>
For consistency over all CDDL, I would propose:<br>
<br>
&gt;=C2=A0 =C2=A0 Hash_Envelope_Protected_Header =3D {<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 ? &amp;(alg: 1) =3D&gt; int,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 &amp;(payload_hash_alg: 258) =3D&gt; int,<b=
r>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 ? &amp;(payload_preimage_content_type: 259)=
 =3D&gt; uint / tstr,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 ? &amp;(payload_location: 260) =3D&gt; tstr=
,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 * (int / tstr) =3D&gt; any<br>
&gt;=C2=A0 =C2=A0 }<br>
<br>
which would be consistent with the previous CDDL block:<br>
<br>
&gt;=C2=A0 =C2=A0 Hash_Envelope_as_COSE_Sign1 =3D [<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 protected: bstr .cbor Hash_Envelope_Protect=
ed_Header,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 unprotected: Hash_Envelope_Unprotected_Head=
er,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 payload: bstr / nil,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 signature: bstr<br>
&gt;=C2=A0 =C2=A0 ]<br>
<br>
All of the variants are correct. This proposal is purely optical and <br>
target towards consistency.<br>
<br>
<br>
Viele Gr=C3=BC=C3=9Fe,<br>
<br>
Henk<br>
<br>
<br>
<br>
<br>
On 04.06.26 14:41, Orie wrote:<br>
&gt; Hi,<br>
&gt; <br>
&gt; Addressing 3 and 11:<br>
&gt; <br>
&gt; 3. keep the comma.<br>
&gt; 11. use &quot; for values, not `.<br>
&gt; <br>
&gt; Regards,<br>
&gt; <br>
&gt; OS<br>
&gt; <br>
&gt; On Wed, May 27, 2026 at 12:30=E2=80=AFPM Megan Ferguson <br>
&gt; &lt;<a href=3D"mailto:mferguson@staff.rfc-editor.org" target=3D"_blank=
">mferguson@staff.rfc-editor.org</a> &lt;mailto:<a href=3D"mailto:mferguson=
@staff.rfc-editor.org" target=3D"_blank">mferguson@staff.rfc-editor.org</a>=
&gt;&gt; <br>
&gt; wrote:<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0Hi Orie,<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0Thanks for the reply and guidance!<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0We have updated as requested.=C2=A0 We believe ques=
tions #3 and #11<br>
&gt;=C2=A0 =C2=A0 =C2=A0remain unresolved for now.<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0We have posted the updated files below.=C2=A0 Pleas=
e review carefully as<br>
&gt;=C2=A0 =C2=A0 =C2=A0we do not make changes once a document is published=
 as an RFC.<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0The files are available here (please refresh):<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/authors/rfc99=
95.md" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/auth=
ors/rfc9995.md</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995.md" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/=
authors/rfc9995.md</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/authors/rfc99=
95.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/au=
thors/rfc9995.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.or=
g/authors/rfc9995.html</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/authors/rfc99=
95.pdf" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/aut=
hors/rfc9995.pdf</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995.pdf" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org=
/authors/rfc9995.pdf</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/authors/rfc99=
95.txt" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/aut=
hors/rfc9995.txt</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995.txt" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org=
/authors/rfc9995.txt</a>&gt;<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0The diff files are available here (please refresh):=
<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/authors/rfc99=
95-diff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.o=
rg/authors/rfc9995-diff.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995-diff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-edit=
or.org/authors/rfc9995-diff.html</a>&gt; (comprehensive)<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/authors/rfc99=
95-rfcdiff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-edito=
r.org/authors/rfc9995-rfcdiff.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995-rfcdiff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-e=
ditor.org/authors/rfc9995-rfcdiff.html</a>&gt; (side by side)<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/authors/rfc99=
95-auth48diff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-ed=
itor.org/authors/rfc9995-auth48diff.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995-auth48diff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rf=
c-editor.org/authors/rfc9995-auth48diff.html</a>&gt; (AUTH48<br>
&gt;=C2=A0 =C2=A0 =C2=A0changes only)<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/authors/rfc99=
95-auth48rfcdiff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc=
-editor.org/authors/rfc9995-auth48rfcdiff.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995-auth48rfcdiff.html" rel=3D"noreferrer" target=3D"_blank">https://www=
.rfc-editor.org/authors/rfc9995-auth48rfcdiff.html</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0(side by side)<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0The details of the AUTH48 status of your document a=
re here:<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/auth48/rfc999=
5" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/auth48/r=
fc9995</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/auth48/rf=
c9995" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/auth=
48/rfc9995</a>&gt;<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0Thank you.<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0Megan Ferguson<br>
&gt;=C2=A0 =C2=A0 =C2=A0RFC Production Center<br>
&gt; <br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; On May 27, 2026, at 7:15=E2=80=AFAM, Orie &lt=
;<a href=3D"mailto:orie@or13.io" target=3D"_blank">orie@or13.io</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;mailto:<a href=3D"mailto:orie@or13.io" target=
=3D"_blank">orie@or13.io</a>&gt;&gt; wrote:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; Hi,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; Thank you for the work on this document!<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; Inline for the rest:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; On Tue, May 26, 2026 at 11:56=E2=80=AFAM Mega=
n Ferguson<br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"mailto:mferguson@staff.rfc-editor.or=
g" target=3D"_blank">mferguson@staff.rfc-editor.org</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;mailto:<a href=3D"mailto:mferguson@staff.rfc-ed=
itor.org" target=3D"_blank">mferguson@staff.rfc-editor.org</a>&gt;&gt; wrot=
e:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; Just resending to add Steve=E2=80=99s preferr=
ed email to the thread.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; On May 20, 2026, at 8:39=E2=80=AFPM, <a =
href=3D"mailto:rfc-editor@rfc-editor.org" target=3D"_blank">rfc-editor@rfc-=
editor.org</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;mailto:<a href=3D"mailto:rfc-editor@rfc-editor.=
org" target=3D"_blank">rfc-editor@rfc-editor.org</a>&gt; wrote:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Authors,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; While reviewing this document during AUT=
H48, please resolve (as<br>
&gt;=C2=A0 =C2=A0 =C2=A0necessary) the following questions, which are also =
in the source file.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 1) &lt;!-- [rfced] Please insert any key=
words (beyond those that<br>
&gt;=C2=A0 =C2=A0 =C2=A0appear in<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; the title) for use on <a href=3D"https:/=
/www.rfc-editor.org/search" rel=3D"noreferrer" target=3D"_blank">https://ww=
w.rfc-editor.org/search</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/search" r=
el=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/search</a>&g=
t;. --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 2) &lt;!--[rfced] Please review and conf=
irm this suggested update<br>
&gt;=C2=A0 =C2=A0 =C2=A0maintains<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; your intended meaning:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Original:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; COSE defined detached payloads in Sectio=
n 2 of [RFC9052], using<br>
&gt;=C2=A0 =C2=A0 =C2=A0nil as<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; the payload.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Perhaps:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Section 2 of [RFC9052] defines detached =
payloads for COSE,<br>
&gt;=C2=A0 =C2=A0 =C2=A0using nil<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; as the payload.=C2=A0 --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; I prefer your edit to the original here.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 3) &lt;!--[rfced] Please review our upda=
te to add a comma at the<br>
&gt;=C2=A0 =C2=A0 =C2=A0end of a line in the CDDL:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Original:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; &amp;(payload_hash_alg: 258) =3D&gt; int=
<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Current:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; &amp;(payload_hash_alg: 258) =3D&gt; int=
,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; I prefer the comma, though I will admit I hav=
e lost track of CDDL<br>
&gt;=C2=A0 =C2=A0 =C2=A0best practices for this... @Henk Birkholz ?<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 4) &lt;!--[rfced] Please review our upda=
tes to the following text<br>
&gt;=C2=A0 =C2=A0 =C2=A0to ensure<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; we have maintained your intended meaning=
:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Original:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0For example, when the actual=
 content is a bstr, a Verifier<br>
&gt;=C2=A0 =C2=A0 =C2=A0appraising<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0a content-type bstr has to d=
ecide if that bstr describes the<br>
&gt;=C2=A0 =C2=A0 =C2=A0digest<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0bytes or the preimage bytes.=
=C2=A0 Setting preimage-content-type<br>
&gt;=C2=A0 =C2=A0 =C2=A0to bstr,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0makes it clear that the prei=
mage bytes themselves were a bstr.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Current:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0For example, when the actual=
 content is a byte string (bstr), a<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0verifier appraising the payl=
oad has to decide whether that bstr<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0represents the digest bytes =
or the preimage bytes.=C2=A0 Setting<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0payload_preimage_content_typ=
e to bstr makes it clear that the<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0preimage bytes themselves we=
re a bstr.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; Current looks good to me.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 5) &lt;!-- [rfced] We updated the URL fo=
r application/spdx+json as<br>
&gt;=C2=A0 =C2=A0 =C2=A0shown below, as the original was 404. Please review=
 and let us know<br>
&gt;=C2=A0 =C2=A0 =C2=A0if any corrections are needed.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Original:<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.iana.org/assignments/media-t=
ypes/application/spdx+" rel=3D"noreferrer" target=3D"_blank">https://www.ia=
na.org/assignments/media-types/application/spdx+</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.iana.org/assignments/med=
ia-types/application/spdx+" rel=3D"noreferrer" target=3D"_blank">https://ww=
w.iana.org/assignments/media-types/application/spdx+</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; current:<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.iana.org/assignments/media-t=
ypes/application/spdx+json" rel=3D"noreferrer" target=3D"_blank">https://ww=
w.iana.org/assignments/media-types/application/spdx+json</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.iana.org/assignments/med=
ia-types/application/spdx+json" rel=3D"noreferrer" target=3D"_blank">https:=
//www.iana.org/assignments/media-types/application/spdx+json</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; Thanks for correcting!<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 6) &lt;!--[rfced] Using &quot;the&quot; =
before manifest.spdx.json makes it<br>
&gt;=C2=A0 =C2=A0 =C2=A0feel like a<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; label is missing.=C2=A0 Please review.<b=
r>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Original:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0The payload of this COSE_Sig=
n1 is the SHA256 hash of the<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0manifest.spdx.json.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &quot;the&quot; could be removed here I think=
.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 7) &lt;!--[rfced] Please review if inter=
net should be Internet here:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Original:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0Verifiers that do not have a=
ccess to the internet and obtain the<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0preimage via other means wil=
l not be able to perform that<br>
&gt;=C2=A0 =C2=A0 =C2=A0check, nor<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0to derive utility from it.<b=
r>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; I think it can remain lower case here.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;=C2=A0 =C2=A0&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 8) &lt;!-- [rfced] We updated the &quot;=
Value Registry&quot; column of table<br>
&gt;=C2=A0 =C2=A0 =C2=A01 to include references to &quot;CoAP Content-Forma=
ts&quot; and &quot;COSE<br>
&gt;=C2=A0 =C2=A0 =C2=A0Algorithms&quot;.=C2=A0 Please review and let us kn=
ow any concerns.=C2=A0 The<br>
&gt;=C2=A0 =C2=A0 =C2=A0references have been added as informative reference=
s.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Because we added a reference to the COSE=
 Algorithms registry,<br>
&gt;=C2=A0 =C2=A0 =C2=A0we also replaced the URL below with an in text cita=
tion.=C2=A0 Please<br>
&gt;=C2=A0 =C2=A0 =C2=A0review.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Original:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0Note that when using a pre-h=
ash<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0algorithm, the algorithm MUS=
T be registered in the IANA COSE<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0Algorithms registry (<a href=
=3D"https://www.iana.org/assignments/cose/" rel=3D"noreferrer" target=3D"_b=
lank">https://www.iana.org/assignments/cose/</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.iana.org/assignments/cos=
e/" rel=3D"noreferrer" target=3D"_blank">https://www.iana.org/assignments/c=
ose/</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0cose.xhtml#algorithms), and =
MUST be distinguishable from<br>
&gt;=C2=A0 =C2=A0 =C2=A0non-pre hash<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0variants that may also be pr=
esent.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Current:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0Note that, when using a pre-=
hash algorithm,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0the algorithm MUST be regist=
ered in the IANA &quot;COSE Algorithms&quot;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0registry [COSE-Algorithms] a=
nd MUST be distinguishable from<br>
&gt;=C2=A0 =C2=A0 =C2=A0non-pre-<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0hash variants that may also =
be present.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; Looks good to me.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;=C2=A0 =C2=A0&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 9) &lt;!--[rfced] Please review the foll=
owing possible<br>
&gt;=C2=A0 =C2=A0 =C2=A0inconsistencies with regard to terminology:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; COSE_MAC vs. COSE_Mac<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; SHA-256 vs. SHA256<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; SHA-384 vs. SHA384<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; It must be &quot;COSE_Mac&quot; and=C2=A0 &qu=
ot;SHA-256&quot;.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 10) &lt;!--[rfced] We had the following =
questions related to<br>
&gt;=C2=A0 =C2=A0 =C2=A0abbreviation use in the document:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; a) Please note that we have expanded abb=
reviations on first use.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Please review for accuracy.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; b) Would you like to expand SPDX as &quo=
t;System Package Data<br>
&gt;=C2=A0 =C2=A0 =C2=A0Exchange&quot; on<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; first use?=C2=A0 --&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; No, but expanded as &quot;Software Package Da=
ta Exchange&quot; seems like a<br>
&gt;=C2=A0 =C2=A0 =C2=A0good idea:<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://en.wikipedia.org/wiki/Software_P=
ackage_Data_Exchange" rel=3D"noreferrer" target=3D"_blank">https://en.wikip=
edia.org/wiki/Software_Package_Data_Exchange</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://en.wikipedia.org/wiki/Softwa=
re_Package_Data_Exchange" rel=3D"noreferrer" target=3D"_blank">https://en.w=
ikipedia.org/wiki/Software_Package_Data_Exchange</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; 11) &lt;!--[rfced] In the response to ou=
r intake form, we saw:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; We only use ` ... I suspect we might be =
better off using &quot; for<br>
&gt;=C2=A0 =C2=A0 =C2=A0a few<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; values instead of `, and reserve ` for h=
ighlighting code points and<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; not examples.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Please let us know if/how updates should=
 be made using Old/New<br>
&gt;=C2=A0 =C2=A0 =C2=A0and/or<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; by updating the edited file directly. --=
&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; Lets address this at the end, to avoid chatte=
r, I&#39;m not attached<br>
&gt;=C2=A0 =C2=A0 =C2=A0to making any changes here, just called it out duri=
ng intake.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Thank you.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Megan Ferguson and Sandy Ginoza<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; RFC Production Center<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; On May 20, 2026, at 4:20=E2=80=AFPM, <a =
href=3D"mailto:rfc-editor@rfc-editor.org" target=3D"_blank">rfc-editor@rfc-=
editor.org</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;mailto:<a href=3D"mailto:rfc-editor@rfc-editor.=
org" target=3D"_blank">rfc-editor@rfc-editor.org</a>&gt; wrote:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; RFC Author(s):<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Your document is now ready for Final Rev=
iew (previously AUTH48).<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; The document was edited in kramdown-rfc =
as part of the RPC<br>
&gt;=C2=A0 =C2=A0 =C2=A0pilot test (see<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/rpc/wiki/doku=
.php?id=3Dpilot_test_kramdown_rfc" rel=3D"noreferrer" target=3D"_blank">htt=
ps://www.rfc-editor.org/rpc/wiki/doku.php?id=3Dpilot_test_kramdown_rfc</a> =
&lt;<a href=3D"https://www.rfc-editor.org/rpc/wiki/doku.php?id=3Dpilot_test=
_kramdown_rfc" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.=
org/rpc/wiki/doku.php?id=3Dpilot_test_kramdown_rfc</a>&gt;).<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Please review the procedures for your re=
view using kramdown-rfc:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0<a href=3D"https://www.rfc-editor.org/rpc/wiki/doku=
.php?id=3Dpilot_test_instructions_completing_auth48_using_kramdown" rel=3D"=
noreferrer" target=3D"_blank">https://www.rfc-editor.org/rpc/wiki/doku.php?=
id=3Dpilot_test_instructions_completing_auth48_using_kramdown</a> &lt;<a hr=
ef=3D"https://www.rfc-editor.org/rpc/wiki/doku.php?id=3Dpilot_test_instruct=
ions_completing_auth48_using_kramdown" rel=3D"noreferrer" target=3D"_blank"=
>https://www.rfc-editor.org/rpc/wiki/doku.php?id=3Dpilot_test_instructions_=
completing_auth48_using_kramdown</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Once the review is complete, it will be =
published as an RFC.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Files<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; -----<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; The files are available here:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; <a href=3D"https://www.rfc-editor.org/au=
thors/rfc9995.md" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-edit=
or.org/authors/rfc9995.md</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995.md" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/=
authors/rfc9995.md</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; <a href=3D"https://www.rfc-editor.org/au=
thors/rfc9995.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-ed=
itor.org/authors/rfc9995.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.or=
g/authors/rfc9995.html</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; <a href=3D"https://www.rfc-editor.org/au=
thors/rfc9995.pdf" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-edi=
tor.org/authors/rfc9995.pdf</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995.pdf" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org=
/authors/rfc9995.pdf</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; <a href=3D"https://www.rfc-editor.org/au=
thors/rfc9995.txt" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-edi=
tor.org/authors/rfc9995.txt</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995.txt" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org=
/authors/rfc9995.txt</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Diff file of the text:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; <a href=3D"https://www.rfc-editor.org/au=
thors/rfc9995-diff.html" rel=3D"noreferrer" target=3D"_blank">https://www.r=
fc-editor.org/authors/rfc9995-diff.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995-diff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-edit=
or.org/authors/rfc9995-diff.html</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; <a href=3D"https://www.rfc-editor.org/au=
thors/rfc9995-rfcdiff.html" rel=3D"noreferrer" target=3D"_blank">https://ww=
w.rfc-editor.org/authors/rfc9995-rfcdiff.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995-rfcdiff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-e=
ditor.org/authors/rfc9995-rfcdiff.html</a>&gt; (side by side)<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Diff of the kramdown:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; <a href=3D"https://www.rfc-editor.org/au=
thors/rfc9995-md-diff.html" rel=3D"noreferrer" target=3D"_blank">https://ww=
w.rfc-editor.org/authors/rfc9995-md-diff.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995-md-diff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-e=
ditor.org/authors/rfc9995-md-diff.html</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; <a href=3D"https://www.rfc-editor.org/au=
thors/rfc9995-md-rfcdiff.html" rel=3D"noreferrer" target=3D"_blank">https:/=
/www.rfc-editor.org/authors/rfc9995-md-rfcdiff.html</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/authors/r=
fc9995-md-rfcdiff.html" rel=3D"noreferrer" target=3D"_blank">https://www.rf=
c-editor.org/authors/rfc9995-md-rfcdiff.html</a>&gt; (side<br>
&gt;=C2=A0 =C2=A0 =C2=A0by side)<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Tracking progress<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; -----------------<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; The details of the AUTH48 status of your=
 document are here:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; <a href=3D"https://www.rfc-editor.org/au=
th48/rfc9995" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.o=
rg/auth48/rfc9995</a><br>
&gt;=C2=A0 =C2=A0 =C2=A0&lt;<a href=3D"https://www.rfc-editor.org/auth48/rf=
c9995" rel=3D"noreferrer" target=3D"_blank">https://www.rfc-editor.org/auth=
48/rfc9995</a>&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Please let us know if you have any quest=
ions.<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Thank you for your cooperation,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; RFC Editor<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; --------------------------------------<b=
r>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; RFC 9995 (draft-ietf-cose-hash-envelope)=
<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 : COSE Hash Envelope<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Author(s)=C2=A0 =C2=A0 =C2=A0 =C2=A0 : O=
. Steele,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 S. Lasker,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 H. Birkholz<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; WG Chair(s)=C2=A0 =C2=A0 =C2=A0 : Ivaylo=
 Petrov, Michael Jones<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt; Area Director(s) : Deb Cooley, Christoph=
er Inacio<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt; &gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 &gt;<br>
&gt; <br>
</blockquote></div>

--000000000000c5d19406536d0f79--

