Re: [Cbor] To be signed with packed CBOR

Carsten Bormann <cabo@tzi.org> Mon, 03 August 2020 22:24 UTC

Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 13.4 $3608.120.23.2.1$)
From: Carsten Bormann <cabo@tzi.org>
In-Reply-To: <24290.1596475304@localhost>
Date: Tue, 04 Aug 2020 00:24:50 +0200
Cc: Jim Schaad <ietf@augustcellars.com>, Brendan Moran <Brendan.Moran@arm.com>, cbor@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <6E7FE97D-3333-43E7-8BD2-D1554796E774@tzi.org>
References: <04b501d6685b$932fbbe0$b98f33a0$@augustcellars.com> <24290.1596475304@localhost>
To: Michael Richardson <mcr+ietf@sandelman.ca>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cbor/Uxrs4kiuJv_YVzIN1gL_lCJzwBU>
Subject: Re: [Cbor] To be signed with packed CBOR
Precedence: list

On 2020-08-03, at 19:21, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
> 
> I really think one needs to sign the packed content.

Generally, we don’t sign the content (XMLDSig anyone?), but the message.  And that was packed.  (And the whole point about packed CBOR is that you may never need to fully unpack it.)

The signing input does not need to be limited to that.  So if there is an external context that provides, e.g., dictionary IDs, I would expect that to be part of the  signing input (where the “ID” needs to uniquely identify an immutable dictionary for a signature, either by hash, or by registry).

Grüße, Carsten

[Cbor] To be signed with packed CBOR Jim Schaad
Re: [Cbor] To be signed with packed CBOR Brendan Moran
Re: [Cbor] To be signed with packed CBOR Michael Richardson
Re: [Cbor] To be signed with packed CBOR Michael Richardson
Re: [Cbor] To be signed with packed CBOR Carsten Bormann
Re: [Cbor] To be signed with packed CBOR Michael Richardson
Re: [Cbor] To be signed with packed CBOR Carsten Bormann