[COSE] Comments on draft-ietf-cose-rfc8152bis-struct-07 and draft-ietf-cose-rfc8152bis-algs-06

[John Mattsson <[e-mail]>]

Comments on draft-ietf-cose-rfc8152bis-struct-07 and draft-ietf-cose-rfc8152bis-algs-06

General:

 - Minor note: The abstracts of the documents have minor differences and the subsections in the introductions have differ orders.

 - As RFC 8610 is published now, shouldn’t the documents be updated to match the final CDDL grammar?

draft-ietf-cose-rfc8152bis-struct-07:

 - "There has been an increased focus on small, constrained devices"

   I think the document should mention constrained radio technologies as well

- "strings" are used in in various places. Should be changed to "byte string" or "text string" as CBOR has two types of strings

- "3.  The content of the message.  The content is either the plaintext or the ciphertext as appropriate."

  This seems to only describe encryption. For signatures and MACs it would be payload, signature/tag.

- "structure", "message", "object", "map", "array", "object structure", "message structure", "data object", "structure object", "map object", "array object", "data structure", "data item", "CBOR structures", "COSE structure", "COSE map", "CBOR map", "CBOR object", "COSE object"

  There is a large amount of terms used in the documents. I feel that they could be defined a bit more. Also, are all of them really needed?

- OLD "The set of protected header parameters wrapped in a bstr."
  NEW "The set of protected header parameters as a map wrapped in a bstr."

- The draft has quite a lot of text on different types of signatures like signatures with message recovery. Would be good to have some sentences on signatures with and without state. The text on signatures is also missing that they provide data authentication, integrity protection, and provides non-repudiation.

- "They provide either no or very limited data origination."
  This sentence occurs in several places. The term "data origination" seems to not be used very much and also have different meanings.
  E.g. the book "Information Security:   Dictionary of Concepts, Standards and Terms" defines it as
     "data origination. In computing, the translation of information from its original form into machine readable form or directly into electrical signals."

Could we replace "data origination" with "non-repudiation"?

- "digesst"
- "stucture"

draft-ietf-cose-rfc8152bis-algs-06

- "the the"

Cheers,
John