From: =?iso-8859-1?Q?G=F6ran_Selander?= <goran.selander@ericsson.com>
To: Russ Housley <housley@vigilsec.com>, "gen-art@ietf.org" <gen-art@ietf.org>
Thread-Topic: draft-ietf-cose-cbor-encoded-cert-16 ietf last call Genart
 review
Thread-Index: AQHckJC+6aj8fvvLaUKvqd2faa4JL7W0mjwp
Date: Wed, 18 Mar 2026 14:05:54 +0000
Message-ID: 
 <PAXPR07MB88441C802B4ACB7F689D7D41F44EA@PAXPR07MB8844.eurprd07.prod.outlook.com>
References: 
 <176963042171.1420319.9012900800885499405@dt-datatracker-77f8b84995-z4hzn>
In-Reply-To: 
 <176963042171.1420319.9012900800885499405@dt-datatracker-77f8b84995-z4hzn>
Accept-Language: en-US
Content-Language: en-GB
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: 
 =?iso-8859-1?Q?9F+GpnXNe3YxHqd5BETDmwoFnBflEjY+vPYfKNE9/Nf53TdnxomJhCHe1q?=
 =?iso-8859-1?Q?DOXIp3iVYtNm6VqCGz25LlTRFMZ8HyqQmQ/l4G3tkS8N/ETiA5t1y4Tz+R?=
 =?iso-8859-1?Q?kdBO/hH/a/sc6wlbO79X236AKyynbTK4re+lEGeg9PTn4fywUzWWj491cU?=
 =?iso-8859-1?Q?6njZneBw09nuzJAxd44kfH25pRySruquRHLasbvvbyYVDcqN6wDX6YmxWz?=
 =?iso-8859-1?Q?EzDsiVh/YJseIVihcWN1h7PmqS5YeSdGTapIINEOgg/lu7ElkeyEwI6hp9?=
 =?iso-8859-1?Q?XwKQimL+m2Zsu1T8gzim4qovmuWHpp+uThfssK4emTgWksHDpXxK4tbApj?=
 =?iso-8859-1?Q?aXWZ2uGVNuKDugZKcfdq6+0IuFJ0k/UxVmx0eL145Qf8WD0CNXEAB4WpfK?=
 =?iso-8859-1?Q?6Jvy2lZnmsN1wAgqXqokdfhaK1NtYPw1uVwBnzCS0+vyvgnUzogSEwr4DQ?=
 =?iso-8859-1?Q?Y7zGD8TvMkMzsxYNUyrZ0fnVkyqmUt9RI/wuPnTzKXwy/WQalwbemQA1IC?=
 =?iso-8859-1?Q?AKVn48/nyn1BYHn1xLEYYhrflXQpuxkePA0A1VgWJMTsAw6aCWWNIyJIwT?=
 =?iso-8859-1?Q?A1ImKpDoAmLgsr7Ye6LSHIbkrlE14aMazyxz74wXEvWs5OKhTGiHnRdqI+?=
 =?iso-8859-1?Q?VzPm1P/MS8Jg+dzsP4ivLs2MAIuNgd0fhW/tOGMXuVBf2FnrohSYa2i20t?=
 =?iso-8859-1?Q?OSkWzMBgT8jnaSv68lul0J5HunuONoBkvoxa1yA1DozvbSjBcOriPifCCs?=
 =?iso-8859-1?Q?vnaielN71YgeT8bDeLOPoS/ZVixwLbeWxsnXs3lIkYl7RevhjpBrR3qy8h?=
 =?iso-8859-1?Q?i88GwIgCrAOP21w/D1mXqu9iINNgFc+mQdmgCdPMzt8yrMnu/4W3HNreRi?=
 =?iso-8859-1?Q?sPlNdxzOeH6CEYz9W9Rmbbf5lavoHYIekJUXycgo6KAbw4kVA+GHOGkuHE?=
 =?iso-8859-1?Q?R2/kXxWZ4lTJzBwI0AenohBDm7fJeJBgC5RrBqR/rhg0A6rAPyXKcayAIb?=
 =?iso-8859-1?Q?UiIj+ATG6ByCfv0vSWvfxYiDSBWEr43W7vS/dD4GdJg6ee+jG8syNmby/Y?=
 =?iso-8859-1?Q?xTbK61y0YLL81hdw8BSw8sumYe4DWNbYfFpH07kX+BvYPp1oY20aqCIJPa?=
 =?iso-8859-1?Q?6bIBDx4LHyy7yjl3aPTJL5NgHIF4PxarHob71LIqMAaciTzwt7Bj8VRx2v?=
 =?iso-8859-1?Q?5lrFEkQELGPyZZ+znTqMWF6qWIGzNbNmug3bFcdt7Rp5KIfk5stUp37CGq?=
 =?iso-8859-1?Q?oLBUK1601ttn9AupmHfaHg5uiYDskJ5OvGUTu2o5DxnJWxgb/IxqsJGTrC?=
 =?iso-8859-1?Q?vYaI6yS1Bsj/4dFS5dsOAQ+sAGuFo0HQooEZKMriPNtOxChGpCY0afBwQO?=
 =?iso-8859-1?Q?Nis+OkRKNaQxHnondfBHrXtx4WpIP3yTRvIE7ZNc5uCX07sfgfWRWYBgtA?=
 =?iso-8859-1?Q?bCihikrr81qB+sLRfCG/UWI/gqYWP4BDs4g+Yiq4Ig4rR7rUgAEM6FCdPF?=
 =?iso-8859-1?Q?wm4o3lQllv/iW90EOTeUB4wt+GyDAecZBqsR9mUK/hu97bcI2IyhSKDljV?=
 =?iso-8859-1?Q?KWCUjqfFp51L8G2vL7DcMVbRR1VNab19cpylSufzrecr5L6njrGtFYeLRt?=
 =?iso-8859-1?Q?e1p68YP5rIH8jAmqNOFwmWxjePQZb5RWQS3LNzUefOKkB8TaFwN7bDbll0?=
 =?iso-8859-1?Q?aPtvE6lSISLW2Pey9WcQm4kNO3TJpXd9Z2do6/QH8HSnHTa7n27YPhJbpU?=
 =?iso-8859-1?Q?YwhVJAWsdMDqxbqZbNfW2TvpW5o/bX3Q/mB0iZfQWrRRAeNjHydcxznXBR?=
 =?iso-8859-1?Q?vtyKgNi1Jx+guBnN6rPbHLMWVuutakplEBiUsnFKuOdutc5jeEwjRZaTGx?=
 =?iso-8859-1?Q?+z?=
x-ms-exchange-antispam-messagedata-1: 
 MfE1K9qwiFEUTb2cH8gcpYaExdgTeC3mOE4DJJ4PYfjaiiaxx9Ds2ngb
Content-Type: multipart/alternative;
	boundary="_000_PAXPR07MB88441C802B4ACB7F689D7D41F44EAPAXPR07MB8844eurp_"
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PAXPR07MB8844.eurprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 0c471e5e-583c-494a-f48b-08de84f77838
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Mar 2026 14:05:54.1314
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
 EzNdWQgrSWX0hWxzLd1BegXtNfJ+c/TGkEaCHrB7hZhWxutnmotzPcvVj4FrnDsknIPM07KAE33hyGvFEaj0aq/ko0vE6q5Rn5rItyebJZk=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4PR07MB11768
Message-ID-Hash: 3JT42ZULKJ33FNKDPLCTFVR3OGLIF2T4
X-Message-ID-Hash: 3JT42ZULKJ33FNKDPLCTFVR3OGLIF2T4
X-MailFrom: goran.selander@ericsson.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency;
 loop; banned-address; member-moderation; header-match-gen-art.ietf.org-0;
 header-match-gen-art.ietf.org-1; header-match-gen-art.ietf.org-2;
 nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size;
 news-moderation; no-subject; digests; suspicious-header
CC: "cose@ietf.org" <cose@ietf.org>,
 "draft-ietf-cose-cbor-encoded-cert.all@ietf.org"
 <draft-ietf-cose-cbor-encoded-cert.all@ietf.org>,
 "last-call@ietf.org" <last-call@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: =?utf-8?q?=5BGen-art=5D_Re=3A_draft-ietf-cose-cbor-encoded-cert-16_ietf_last?=
	=?utf-8?q?_call_Genart_review?=
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/gen-art/1Jk4taPcKnzNoex7ot0eD3aNJQU>
List-Archive: <https://mailarchive.ietf.org/arch/browse/gen-art>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Owner: <mailto:gen-art-owner@ietf.org>
List-Post: <mailto:gen-art@ietf.org>
List-Subscribe: <mailto:gen-art-join@ietf.org>
List-Unsubscribe: <mailto:gen-art-leave@ietf.org>

--_000_PAXPR07MB88441C802B4ACB7F689D7D41F44EAPAXPR07MB8844eurp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Russ,

Thanks for your review. We incorporated all comments, as well as the two "a=
dditional thoughts" in -17.

G=F6ran

From: Russ Housley via Datatracker <noreply@ietf.org>
Date: Wednesday, 28 January 2026 at 21:00
To: gen-art@ietf.org <gen-art@ietf.org>
Cc: cose@ietf.org <cose@ietf.org>, draft-ietf-cose-cbor-encoded-cert.all@ie=
tf.org <draft-ietf-cose-cbor-encoded-cert.all@ietf.org>, last-call@ietf.org=
 <last-call@ietf.org>
Subject: draft-ietf-cose-cbor-encoded-cert-16 ietf last call Genart review

Document: draft-ietf-cose-cbor-encoded-cert
Title: CBOR Encoded X.509 Certificates (C509 Certificates)
Reviewer: Russ Housley
Review result: Ready with Nits

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair. Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at
<https://eur02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwiki.i=
etf.org%2Fen%2Fgroup%2Fgen%2FGenArtFAQ&data=3D05%7C02%7Cgoran.selander%40er=
icsson.com%7C21973145df00487d5d9308de5ea7dfcf%7C92e84cebfbfd47abbe52080c6b8=
7953f%7C0%7C0%7C639052272266748447%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGki=
OnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3=
D%7C0%7C%7C%7C&sdata=3DnWWxhCJLzjc%2FyoLz38307yxnykCdytrq0ylfq2kihDI%3D&res=
erved=3D0<https://wiki.ietf.org/en/group/gen/GenArtFAQ>>.

Document: draft-ietf-cose-cbor-encoded-cert-16
Reviewer: Russ Housley
Review Date: 2026-01-28
IETF LC End Date: 2026-02-10
IESG Telechat date: unknown


Summary: Ready with Nits


Major Concerns:  None


Minor Concerns:

Section 1: The two types of C509 certificates (CBOR encoding of DER-
encoded X.509 certificates and natively signed C509 certificates) is
discussed at the beginning of the introduction and the end of the
introduction.  It would be more desirable to talk about this in only
one spot.

Section 1 says:

   The use of CBOR also reduces code complexity, code
   size, memory usage, and CPU usage.

This is not true for the case where C509 carries a signature on the
X.509 certificate.  Please add some qualification.

Figure 5: It would be good to see an ML-DSA certificate in this table.
The public key and signature will not compress, so the comparison will
help implementeres determine whether C509 is worth the time to write
the code.


Nits:

General: s/DER encoded/DER-encoded/ (many places)

General: s/Weierstra=DF/Weierstrass/ (for string search in other RFCs)

Section 1: s/We recommend implementors to get used/Implementors can get use=
d/

Section 3: s/DER encoded [RFC5280] X.509 certificates/
            /DER-encoded X.509 certificates [RFC5280]/

Section 6: s/DER encoded RFC 2986 CertificationRequestInfo/
            /DER-encoded CertificationRequestInfo [RFC2986]/


Additional Thoughts:

1.  Section 4: It would be easy to add support for the attribute
specified in RFC 9883.  If ML-DSA and ML-KEM achieve wide deployment
outside the Web PKI, support for this CSR attribute will be needed.  I do
not want to delay approval of this document, bit is looks like this would
be a straightforward addition.

2.  There is an Internet-Draft for otherName that contains a MAC address
going through the LAMPS WG.  Based on Section 3.1.4 that has special logic
for EUI-64, this may be of value to some implementers.  We can get an early
assignment of the OID is there is interest in adding support for this new
otherName form to this document.  If so, it may deserve some language in
Section 3.3.



--_000_PAXPR07MB88441C802B4ACB7F689D7D41F44EAPAXPR07MB8844eurp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
</head>
<body>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
Russ,</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; font-size: =
12pt; color: rgb(0, 0, 0);">
Thanks for your review. We incorporated all comments, as well as the two &q=
uot;additional thoughts&quot; in -17.</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; font-size: =
12pt; color: rgb(0, 0, 0);">
G=F6ran</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id=3D"mail-editor-reference-message-container" style=3D"color: inherit=
; background-color: inherit;">
<div class=3D"ms-outlook-mobile-reference-message skipProofing">
<meta name=3D"Generator" content=3D"Microsoft Exchange Server" style=3D"col=
or: inherit; background-color: inherit;">
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"te=
xt-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; bord=
er-style: solid none none; border-color: rgb(181, 196, 223) currentcolor cu=
rrentcolor; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>Russ Housley via Datatracker &lt;noreply@ietf.org&gt;<br>
<b>Date: </b>Wednesday, 28 January 2026 at 21:00<br>
<b>To: </b>gen-art@ietf.org &lt;gen-art@ietf.org&gt;<br>
<b>Cc: </b>cose@ietf.org &lt;cose@ietf.org&gt;, draft-ietf-cose-cbor-encode=
d-cert.all@ietf.org &lt;draft-ietf-cose-cbor-encoded-cert.all@ietf.org&gt;,=
 last-call@ietf.org &lt;last-call@ietf.org&gt;<br>
<b>Subject: </b>draft-ietf-cose-cbor-encoded-cert-16 ietf last call Genart =
review<br>
<br>
</div>
<div class=3D"PlainText" style=3D"font-size: 11pt;">Document: draft-ietf-co=
se-cbor-encoded-cert<br>
Title: CBOR Encoded X.509 Certificates (C509 Certificates)<br>
Reviewer: Russ Housley<br>
Review result: Ready with Nits<br>
<br>
I am the assigned Gen-ART reviewer for this draft. The General Area<br>
Review Team (Gen-ART) reviews all IETF documents being processed<br>
by the IESG for the IETF Chair. Please treat these comments just<br>
like any other last call comments.<br>
<br>
For more information, please see the FAQ at<br>
&lt;<a href=3D"https://wiki.ietf.org/en/group/gen/GenArtFAQ" data-outlook-i=
d=3D"1bc5348d-308c-4612-ad0c-64e09a88018d">https://eur02.safelinks.protecti=
on.outlook.com/?url=3Dhttps%3A%2F%2Fwiki.ietf.org%2Fen%2Fgroup%2Fgen%2FGenA=
rtFAQ&amp;data=3D05%7C02%7Cgoran.selander%40ericsson.com%7C21973145df00487d=
5d9308de5ea7dfcf%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C6390522722667=
48447%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsI=
lAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=3DnW=
WxhCJLzjc%2FyoLz38307yxnykCdytrq0ylfq2kihDI%3D&amp;reserved=3D0</a>&gt;.<br=
>
<br>
Document: draft-ietf-cose-cbor-encoded-cert-16<br>
Reviewer: Russ Housley<br>
Review Date: 2026-01-28<br>
IETF LC End Date: 2026-02-10<br>
IESG Telechat date: unknown<br>
<br>
<br>
Summary: Ready with Nits<br>
<br>
<br>
Major Concerns:&nbsp; None<br>
<br>
<br>
Minor Concerns:<br>
<br>
Section 1: The two types of C509 certificates (CBOR encoding of DER-<br>
encoded X.509 certificates and natively signed C509 certificates) is<br>
discussed at the beginning of the introduction and the end of the<br>
introduction.&nbsp; It would be more desirable to talk about this in only<b=
r>
one spot.<br>
<br>
Section 1 says:<br>
<br>
&nbsp;&nbsp; The use of CBOR also reduces code complexity, code<br>
&nbsp;&nbsp; size, memory usage, and CPU usage.<br>
<br>
This is not true for the case where C509 carries a signature on the<br>
X.509 certificate.&nbsp; Please add some qualification.<br>
<br>
Figure 5: It would be good to see an ML-DSA certificate in this table.<br>
The public key and signature will not compress, so the comparison will<br>
help implementeres determine whether C509 is worth the time to write<br>
the code.<br>
<br>
<br>
Nits:<br>
<br>
General: s/DER encoded/DER-encoded/ (many places)<br>
<br>
General: s/Weierstra=DF/Weierstrass/ (for string search in other RFCs)<br>
<br>
Section 1: s/We recommend implementors to get used/Implementors can get use=
d/<br>
<br>
Section 3: s/DER encoded [RFC5280] X.509 certificates/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /DER-enc=
oded X.509 certificates [RFC5280]/<br>
<br>
Section 6: s/DER encoded RFC 2986 CertificationRequestInfo/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /DER-enc=
oded CertificationRequestInfo [RFC2986]/<br>
<br>
<br>
Additional Thoughts:<br>
<br>
1.&nbsp; Section 4: It would be easy to add support for the attribute<br>
specified in RFC 9883.&nbsp; If ML-DSA and ML-KEM achieve wide deployment<b=
r>
outside the Web PKI, support for this CSR attribute will be needed.&nbsp; I=
 do<br>
not want to delay approval of this document, bit is looks like this would<b=
r>
be a straightforward addition.<br>
<br>
2.&nbsp; There is an Internet-Draft for otherName that contains a MAC addre=
ss<br>
going through the LAMPS WG.&nbsp; Based on Section 3.1.4 that has special l=
ogic<br>
for EUI-64, this may be of value to some implementers.&nbsp; We can get an =
early<br>
assignment of the OID is there is interest in adding support for this new<b=
r>
otherName form to this document.&nbsp; If so, it may deserve some language =
in<br>
Section 3.3.<br>
<br>
<br>
</div>
</div>
</body>
</html>

--_000_PAXPR07MB88441C802B4ACB7F689D7D41F44EAPAXPR07MB8844eurp_--