[COSE] Re: C509 Native signature calculation

[Brian Sipos <[e-mail]>]

Laurence,
One other interesting example of needing "part of a CBOR sequence" for
hashing is in the EDHOC protocol when using (the transport-specific
equivalent of) the media type "application/cid-edhoc+cbor-seq" as opposed
to the basic "application/edhoc+cbor-seq". The difference is that the
content is "... an EDHOC message prepended by a connection identifier ..."
which is just CBOR sequence concatenation CID + edhoc_msg. For the decoder
though, the CID is _not_ part of the message and needs to be excluded from
the transcript hash of the message!

So this is another case of non-trivial (maybe "special") access to the
encoded CBOR data of part of a larger structure. Similarly to BPv7 CRC
evaluation, the EDHOC message hash could be taken from a re-encoding of
just the message (without CID prefix) or through extra information about in
which part of the encoded data the message resides.

To your original question here: I did some naive experimentation of C509
creation and validation with Python cbor2 library and cryptography library
(and it all worked).

Brian S.

On Wed, Jul 15, 2026 at 4:05 PM Laurence Lundblade <[e-mail]>
wrote:

> We’re having a discussion on signing/hashing in the CBOR WG. See [Hashing
> non-wrapped CBOR]. COSE byte-string wraps hashed/signed data. Bundle and
> C509 don't.
>
> I believe hashing non-wrapped CBOR affects which CBOR libraries you can
> use. Or stated differently, it puts a new requirement on CBOR libraries. My
> personal view has been that byte string wrapping is the proper practice as
> described in [Appendix G] because simple CBOR libraries don’t provide
> access to the undecoded CBOR of sub-parts, but maybe that turns out not to
> be the case.
>
> Can you comment on implementations that have been done of C509 native
> signatures and which CBOR libraries they used?
>
> LL
>
>
> [Appendix G]:
> https://www.ietf.org/archive/id/draft-ietf-cbor-serialization-07.html#name-cbor-byte-string-wrapping
> [Hashing non-wrapped CBOR]:
> https://mailarchive.ietf.org/arch/msg/cbor/BZ6GiQ2B69K4Nv0jmuDGBvFhlEw/
>
>
>
>
> _______________________________________________
> COSE mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>