Re: [Cbor] Deterministic CBOR as a possible DISPATCH item

[Christopher Allen <[e-mail]>]

On Mon, Mar 6, 2023 at 1:41 PM Laurence Lundblade <[e-mail]> wrote:
> Maybe the misunderstanding here is cleared by this distinction?
>
> 1) Signing input to the final signing algorithm (e.g. ECDSA+Hash, EdDSA,...) — the Sig_structure. It is deterministically serialized because the sender and receiver serialize it independently. It is never transmitted. This is internal to the design of COSE, is all good and well and is only of consequence to implementors of COSE internals (like me).
>
> 2) The COSE_Sign payload — This doesn’t have to be serialized in any particular way, doesn’t have to be well formed and doesn’t even have to be CBOR. It is transmitted so the receiver has exactly what the sender had. This is what my temperature sensor example was about.
>
> Maybe you are talking about 1) and I’m talking about 2)?
>
> To go further and kind of wrap the discussion around in a weird way, it seems to be the dCBOR folks are talking about payload as in 2), BUT they have situations where they payload bytes are not transmitted like 1).

This is an interesting distinction, and I should puzzle out how we can
be more clear.

I'm not up-to-date on COSE as I should be because of the little active
deployment of it, and because many of our community can't use it as
they are using more modern cryptography. That being said, I've been
talking with Mike Jones and others in the hope to ensure that Gordian
Envelope can have some compatibility with it, or even possibly
incorporate some Gordian Envelope's features into a future version of
COSE (there is some pressure on them as ISO mDL/mDOC standard support
a hash-list version of selective disclosure).

-- Christopher Allen