Re: [Cbor] Deterministic CBOR as a possible DISPATCH item

[Laurence Lundblade <[e-mail]>]

> On Mar 6, 2023, at 1:54 PM, Christopher Allen <[e-mail]> wrote:
> 
> On Mon, Mar 6, 2023 at 1:41 PM Laurence Lundblade <[e-mail]> wrote:
>> Maybe the misunderstanding here is cleared by this distinction?
>> 
>> 1) Signing input to the final signing algorithm (e.g. ECDSA+Hash, EdDSA,...) — the Sig_structure. It is deterministically serialized because the sender and receiver serialize it independently. It is never transmitted. This is internal to the design of COSE, is all good and well and is only of consequence to implementors of COSE internals (like me).
>> 
>> 2) The COSE_Sign payload — This doesn’t have to be serialized in any particular way, doesn’t have to be well formed and doesn’t even have to be CBOR. It is transmitted so the receiver has exactly what the sender had. This is what my temperature sensor example was about.
>> 
>> Maybe you are talking about 1) and I’m talking about 2)?
>> 
>> To go further and kind of wrap the discussion around in a weird way, it seems to be the dCBOR folks are talking about payload as in 2), BUT they have situations where they payload bytes are not transmitted like 1).
> 
> This is an interesting distinction, and I should puzzle out how we can
> be more clear.

The things that convinced me about dCBOR being necessary for the use case were:
- data at rest
- very complicated protocol
- desire to byte-compare serialized data 
- independently (separate apps, servers and clients) encoding data to be compared and signed

I’m glad you’ve brought this up there.


> I'm not up-to-date on COSE as I should be because of the little active
> deployment of it, and because many of our community can't use it as
> they are using more modern cryptography. That being said, I've been
> talking with Mike Jones and others in the hope to ensure that Gordian
> Envelope can have some compatibility with it, or even possibly
> incorporate some Gordian Envelope's features into a future version of
> COSE (there is some pressure on them as ISO mDL/mDOC standard support
> a hash-list version of selective disclosure).

COSE use is of course a completely different issue and orthogonal to dCBOR. Discussion probably belongs on the COSE list.

LL