[COSE] Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: (with COMMENT)

[Warren Kumari via Datatracker <[e-mail]>]

Warren Kumari has entered the following ballot position for
draft-ietf-cose-hash-algs-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cose-hash-algs/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for writing this - it was an interesting read.

I do have one issue, which I cannot tell if it is simply me being dumb, or if
the text needs more work.

“ Doing indirect signing allows for a signature to be validated without first
downloading all of the  content associated with the signature.  This capability
can be of   even greater importance in a constrained environment as not all of 
 the content signed may be needed by the device.”

I’m unclear how this works —  itseems clear enough that I can verify that the
signature matches the hash, but doesn’t the device need to still download and
compute the hash over all of the content?

Otherwise I could take a hash and signature from content A, and claim that it
is for content B. Sure, if the signature **doens’t** match the hash I know not
to bother downloading the content at all, but if the sig does match the hash I
still need to download the content to check that the hash is for this
content....

Please help educate me!

Nit: “ A pointer to the value that was hashed.  this could” — s/this/This/