[Cbor] Review of draft-ietf-cose-merkle-tree-proofs-05

[Felix Linker <[e-mail]>]

Hi everyone,

I just read draft-ietf-cose-merkle-tree-proofs-05 and have some thoughts. For one, I opened a fairly simple PR: https://github.com/cose-wg/draft-ietf-cose-merkle-tree-proofs/pull/21 (reasoning provided with PR).

In general, I think positively of the draft. I have mostly editorial comments. I was confused on some parts of Sections 5.(2|3).1:

I am confused about the first sentence in Section 5.2.1.
It says: "In a signed inclusion proof, the previous merkle tree root, maps to tree-size-1, and is a detached payload.“ This sentence doesn’t make sense grammatically. Either the sentence is missing a verb or there is a comma too many (after „root“).
Maybe it would also be clearer to replace „maps to“ with „corresponding to“? (If this is what you mean, of course.) „Mapping“ could be parsed as „takes the value of“ (in the same sense as in „a dictionary maps a key to a value“) whereas „corresponding“ clarifies that the connection is only logical.
I think it should be „tree-size“ and not „tree-size-1.“
Also, is it really the „previous“ merkle tree root? Wouldn’t a proof of inclusion be computed w.r.t. to the current merkle tree root?
Still in 5.2.1, it says: "Detaching the payload forces verifiers to recompute the root from the inclusion proof signature […].“ I don’t understand what „signature“ refers to here. The sentence would make perfect sense to me if we were to drop this word.
The first sentence of Section 5.3.1 exhibits the same problems as the one at the beginning of Section 5.2.1. Either a verb is missing or there is a comma too much.

Beyond that, I was only wondering why the payload of a receipt of inclusion is detached but attached for a receipt of consistency. The reasoning in Section 5.2.1 makes perfect sense to me, but it also seems to apply to 5.3.1.

I hope my comments are constructive!

All the best,
Felix