Re: [COSE] MAC with no recipient structures

[Olaf Bergmann <[e-mail]>]

"Jim Schaad" <[e-mail]> writes:

> People keep telling me that they want to have a version of MACs that do not
> have a set of recipient information attached so that they can do direct
> MACs.  I keep asking for a use case where this makes sense.  In all of the
> use cases that I have been presented so far, a better answer is going to be
> to do an AEAD encrypted item rather than a MACed item.

An example where this is useful is given in Section 3.7 of
draft-bergmann-ace-dcaf-cose [1]. Here, the recipient structure is empty
because CAM and C must be able to read the payload. Technically, you can
make this work with an encrypted AEAD item as well but then, the payload
information entirely goes into the AAD part because CAM and C must not
know the secret that is being used for generating the MAC tag (they just
forward the data to S).

Of course, this is a requirement only in the cross-domain authorization
scenario where C and S can be constrained and can have distinct owners.
Where this is not considered an issue, you can easily go with
COSE_encryptData and AEAD.

[1] https://tools.ietf.org/html/draft-bergmann-ace-dcaf-cose-00#section-3.7

Grüße
Olaf