[SCITT] Re: Last Call: <draft-ietf-scitt-receipts-ccf-profile-04.txt> (CCF Profile for COSE Receipts) to Proposed Standard

[Nicholas Templeman <[e-mail]>]

Chairs, all,

Support for -04 as Proposed Standard, and one wording recommendation.

Konrad Gruszka's proposed sentence should replace the one I posted on 3 September,
rather than sit alongside it:

  data-hash is HASH over the octets of the Signed Statement as registered, with the
  unprotected header set to the empty map per RFC 9943 Section 6.3, over those octets as
  registered, not over any re-serialisation of them.

Mine named the COSE_Sign1 tag because the tag was the axis in front of me. His binds the
octets, which closes the tag, the outer array, and the next framing axis nobody has found.
That matters because the space is combinatorial, not a list: re-emitting one Signed Statement
under six CBOR encoding freedoms yields 64 legal encodings, 64 distinct data-hash values,
none rejected by a stock parser, and 31 silently normalised back to the canonical form by the
act of reading them. Enumerating framings cannot close that; binding the octets does.

Measurement, vectors and the script that recomputes them are published rather than restated
here: https://councilof.ai/interop/scrapi-ccf/data-hash-framing-space.json

One note for the authors, no reply needed on-list: prior art exists for this rule.
draft-mih-sokolov-scitt-payload-binding-02 §4.4 defines `as-transmitted` — "applies no
canonicalization. The digest pre-image is the exact octet sequence already fixed by the
container format or cryptographic envelope carrying the payload" — and marks both `jcs-n`
(§4.2) and `cde-n` (§4.3) Withdrawn. That is Konrad's sentence as a registered algorithm, and
it is worth the two not drifting.

Not blocking, and I was not blocking before.

Nicholas Templeman
Council of AI (CSOAI Ltd)