[SCITT] Re: Last Call: <draft-ietf-scitt-receipts-ccf-profile-04.txt> (CCF Profile for COSE Receipts) to Proposed Standard

[Nicholas Templeman <[e-mail]>]

Vernon, Joel, all,

Support for -04 as Proposed Standard, with item 1 as the substantive change.

On the preimage. Vernon's framing of Emek's second point is the right one: if
§3.2 states an equality, the bytes it applies to have to be named, and §2.2 does
not name them. I raised the same gap on this list on 29 August and put two
vectors behind it, so I am restating them here rather than the argument, because
what the document needs is a test case and not another agreement.

The same statement hashed two defensible ways gives two different roots:

  UTF-8 value
    61559291e6170046108b09f6c203287e55cb8aaf0dba173b9b10c9f201e2f71a

  CBOR tstr item, including the head 0x78 0x1d
    278395300090d12385e20ca87070f8afa772f20484cc9637f30edb6852a95822

Both were recomputed independently, not read off an implementation. §3.2 as
written does not choose between them, which is the concrete form of "a
conforming implementation cannot perform the check". Two verifiers can each
follow the text exactly and disagree, and neither is wrong.

What I would ask the authors to add, unchanged from 29 August:

  1. State that the hash inputs are the member values.
  2. For internal-evidence, state that it is the UTF-8 octets of the text,
     excluding the CBOR head.
  3. Put one vector of this shape in the document. A named preimage without a
     test case is still checkable only by argument.

This is the same class of issue as the detached-root MUST, and I said so then: a
second verifier must not be able to succeed by picking a reading the first
verifier did not. It does not block publication.

I have no view to add on items 2 through 5 beyond what Vernon has written.

Nicholas Templeman
Council of AI · CSOAI Ltd, UK 16939677
[e-mail]