[COSE] Re: AD review of draft-ietf-cose-hash-envelope

Paul Wouters <paul.wouters@aiven.io> Wed, 01 October 2025 03:18 UTC

Return-Path: <paul.wouters@aiven.io>
X-Original-To: cose@mail2.ietf.org
Delivered-To: cose@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 440536B9A8F3 for <cose@mail2.ietf.org>; Tue, 30 Sep 2025 20:18:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=aiven.io
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YnU50tjEpErw for <cose@mail2.ietf.org>; Tue, 30 Sep 2025 20:18:54 -0700 (PDT)
Received: from mail-ed1-x535.google.com (mail-ed1-x535.google.com [IPv6:2a00:1450:4864:20::535]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id BAA156B9A8EC for <cose@ietf.org>; Tue, 30 Sep 2025 20:18:54 -0700 (PDT)
Received: by mail-ed1-x535.google.com with SMTP id 4fb4d7f45d1cf-62fb48315ddso12185601a12.2 for <cose@ietf.org>; Tue, 30 Sep 2025 20:18:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aiven.io; s=google; t=1759288728; x=1759893528; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=PWeh0gIlbRBQYu3pzjKuiYMzghT2EiCfrr500fcNISU=; b=VDBEN0RuBKlmNdgRej5h9aUcvkVljF9MI4NxWJolzhwBGGbiSsUmHOTRAtaOPB2DT3 41SNKJrhlkb1FgrSlKc0ke7EaorKm3Zycog1OcMCM0I5Ze/hX0gq/yvYxggZMcANP9qL E/urnf1++4FWmOSQeP51qyLNF/zzZsWqLKGec=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1759288728; x=1759893528; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=PWeh0gIlbRBQYu3pzjKuiYMzghT2EiCfrr500fcNISU=; b=Cu7DwlG/f21DkGs6dWbn+DgkfRzWi7uwf7NZuim85btVm810P+RUdOHR2bK+eYkHgU RJ88Eb7FbGtrk2GtwzbFxOMNWeASkYILrhbIWsSudg2gIolo1CrTnSE1GstLxe9fdnLk zYgWM3SQodClbWIGY6/51pYmtITnREzfzco+Kr+TREbgoEk1wjdzsBwWPBwkxGTeY1l4 3czY5uP6pRH2qK2yQihQWVvkBUriTFDOY+TD0kGJlPiIuuM0BoTGxrVyyshfgIqXXBum VRvWtV+p4Ynmb1UV6mkUAZVP6zcLGKVdOTnsHF7WxR5cStaxinJQ09mPLihFiLf2qDMa fI8g==
X-Gm-Message-State: AOJu0Yxs66hW0WeQBFs9QR8S9hTLOTU6bCu006UrPJi5n+pg0g7G3w6n 8KrJ+TXHTM6DvT4oC08/HUNxkvt1Z0F0Fs3s+YrXqi9kcJT1Om1w2Bq66nuKNzTScyvzp+PVY+q hB3wXKEw+67+3mw2ws9qwGcdcMfSgUpKEC/PGPgCOoUtgJ7ICUmdclqA=
X-Gm-Gg: ASbGncvj+E5MzpIUIotpO7nZ4V1S/zELn40NfA+YvArfnaBrBWMYd4Y3cD1aFhVqd2w DssavIflH1u/X90hFloCaIdseqeLneT09w/7sCoVH2RWSgxlUxI+t2ks8cUdglBpvWYvOT/F95S cEpWHFpvjm7a6aDk32x+jryYPi89cl0gNl4OIf1UCegkjjJsy1nSJMYwxz79DLMTfxEaHQQlust xk7qWRXMG3IWBetyLUtt+xVT+OT2KMeiQ71Hvey
X-Google-Smtp-Source: AGHT+IHNjECPACxgq6rZWw/mmn9H9Ql9lKRHtYkFdOs2d+0wVWwy9/nBpc3X+lwOKV2g6zf36ZZ/gnWDJV5LBYgjNKc=
X-Received: by 2002:a05:6402:848:b0:636:67de:3c4c with SMTP id 4fb4d7f45d1cf-63678d21f33mr2206145a12.31.1759288727889; Tue, 30 Sep 2025 20:18:47 -0700 (PDT)
MIME-Version: 1.0
References: <CAGL5yWZPB3MTv1KWyTDX3Km9dGyyxdO+L45Xum4LfAW0H9YC3g@mail.gmail.com> <642d7f74-5b0c-e6fa-9285-5c4ebade2e8b@ietf.contact>
In-Reply-To: <642d7f74-5b0c-e6fa-9285-5c4ebade2e8b@ietf.contact>
From: Paul Wouters <paul.wouters@aiven.io>
Date: Tue, 30 Sep 2025 23:18:36 -0400
X-Gm-Features: AS18NWDH7ZAcl0m3TOcgYpydmSuYQCHa4AvFTTZloeZTQ8kkQA_XzXIr1wzitJk
Message-ID: <CAGL5yWZ+4voHQwA+_RNki91BFOObANMLWH-nKaNvQ8tusfTxXQ@mail.gmail.com>
To: Henk Birkholz <henk.birkholz@ietf.contact>
Content-Type: multipart/alternative; boundary="000000000000af07e5064010538a"
Message-ID-Hash: 6GRARETX5SHUU4HMRUHSRCV4IFUESASG
X-Message-ID-Hash: 6GRARETX5SHUU4HMRUHSRCV4IFUESASG
X-MailFrom: paul.wouters@aiven.io
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-cose.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: cose <cose@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [COSE] Re: AD review of draft-ietf-cose-hash-envelope
List-Id: CBOR Object Signing and Encryption <cose.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cose/NY353Y3uTpqBFI9yxPw5bTzldD4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cose>
List-Help: <mailto:cose-request@ietf.org?subject=help>
List-Owner: <mailto:cose-owner@ietf.org>
List-Post: <mailto:cose@ietf.org>
List-Subscribe: <mailto:cose-join@ietf.org>
List-Unsubscribe: <mailto:cose-leave@ietf.org>

The second issue of the unparsable sentence is not yet resolved in the
referrences 2 PRs

Paul

On Tue, Sep 30, 2025 at 10:20 AM Henk Birkholz <henk.birkholz@ietf.contact>
wrote:

> Hi Paul,
>
> thanks for the feedback! Both issues have been addressed in:
>
> > https://github.com/cose-wg/draft-ietf-cose-hash-envelope/pull/54
>
> and
>
> > https://github.com/cose-wg/draft-ietf-cose-hash-envelope/pull/55
>
> We'll submit a new version after the IETF Last Call, if that is okay
> with you.
>
>
> Viele Grüße,
>
> Henk
>
> On 26.09.25 19:32, Paul Wouters wrote:
> > Hi all,
> >
> > This document looks good and I have issued the IETF Last Call.
> >
> > Two comments:
> >
> > this doesn't parse:
> >
> > This hash becomes the payload of a COSE-Sign1. When signed with a
> > signature algorithm that is parameterized via a hash function, such as
> > ECDSA with SHA384, the to be signed structure as described in Section
> > 4.4 of RFC9052.
> >
> >
> > probably this was meant: as described -> is as described
> >
> > I don't think [I-D.draft-ietf-cbor-edn-literals] can be infornative if
> > you use it in a section called "Terminology". I think it should be
> > normative.
> >
> > Paul
> >
> > _______________________________________________
> > COSE mailing list -- cose@ietf.org
> > To unsubscribe send an email to cose-leave@ietf.org
>