Date: Sun, 06 Sep 2026 11:14:29 +0000
To: Nicholas Templeman <nicholas@csoai.org>
From: Henri Sirkkavaara <hello@vaara.io>
Message-ID: 
 <2JUHvi5yKlM6eew-jlJdy5FjrjDV8igRuIm0OIPZkjl9rEgnMbyf6fLx0AOi_F_X2gRpVtTl9Yka_FPh11842XCXOMNQtruqMN5CwSEbNV0=@vaara.io>
In-Reply-To: <e41f6328-fc26-4a5f-998a-d121d4e22db9@csoai.org>
References: 
 <Y6yqZIoHnmxUHakB-MQWgEM5hvK5JZMv4ycu04O1zh4I3hdI276Wm3Qi-XZrFAjz0bR_BvB2zDSKNEumECSFTRtA2UVcd-h8Lp5VKPuvVoU=@b7n0de.com>
 <e41f6328-fc26-4a5f-998a-d121d4e22db9@csoai.org>
Feedback-ID: 189084408:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Message-ID-Hash: YH5GPS7IGYGB2JFSY3CFGL2QV4DN4GR2
CC: last-call@ietf.org, scitt@ietf.org, kontakt@b7n0de.com, hello@vaara.io,
 vernon@sigilcore.com, pki@varwof.com
Precedence: list
Subject: =?utf-8?q?=5BSCITT=5D_Re=3A_Last_Call=3A_=3Cdraft-ietf-scitt-receipts-ccf-pr?=
	=?utf-8?q?ofile-04=2Etxt=3E_=28CCF_Profile_for_COSE_Receipts=29_to_Proposed?=
	=?utf-8?q?_Standard?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/scitt/FPlCcySdqzIXov2bHQBjcYUkYf0>

All,

A correction to my own review of 4 September first. In finding 1 I listed n=
 =3D 3, 5, 6, 7 and 11 as the sizes where the path bits decode to the wrong=
 index. That enumeration is incomplete: 9 and 10 fail as well. Rechecking 2=
 through 11 against the definitions as written, every non-power-of-two size=
 has at least one leaf that decodes wrong, and 2, 4 and 8 decode exactly. S=
o the condition is that index recovery holds when the number of transaction=
s is a power of two, and not otherwise.

Then one ask, and it sits where the thread already is rather than off to th=
e side. This week has settled that the document's defect class is unnamed p=
reimages: Nicholas on internal-evidence, Konrad's sentence binding the octe=
ts of the Signed Statement as registered, Anton's as-transmitted registerin=
g the same rule.

Finding 4 in my review is that defect one layer further out, and it is the =
largest instance in the document. Section 2.1 defines MTH over "a list of s=
erialized transactions (as byte strings)" and gives MTH({d[0]}) =3D HASH(d[=
0]). Section 3.2 computes the leaf as HASH(internal-transaction-hash || HAS=
H(internal-evidence) || data-hash). Nothing in the document says that d[i] =
is that concatenation. A builder working from 2.1 and a verifier working fr=
om 3.2 can produce different roots, and 2.1 is the definition that looks au=
thoritative, because it is the one labelled Merkle Tree Hash.

If the group is naming preimages before this document leaves, that is the o=
ne to name.

On finding 1, I left the choice of remedy to the authors and will now say w=
hich I would take. Make the path length part of the decoding rule, or carry=
 the index in the proof. Attaching the power-of-two condition to the senten=
ce documents the hazard and leaves it in place, and an application whose au=
thor does not read that sentence still gets a wrong index and no error.

Still non-blocking, and my support for -04 as Proposed Standard stands.


On Saturday, September 5th, 2026 at 06:32, Nicholas Templeman <nicholas@cso=
ai.org> wrote:

> Chairs, all,
>=20
> Support for -04 as Proposed Standard, and one wording recommendation.
>=20
> Konrad Gruszka's proposed sentence should replace the one I posted on 3 S=
eptember,
> rather than sit alongside it:
>=20
>   data-hash is HASH over the octets of the Signed Statement as registered=
, with the
>   unprotected header set to the empty map per RFC 9943 Section 6.3, over =
those octets as
>   registered, not over any re-serialisation of them.
>=20
> Mine named the COSE_Sign1 tag because the tag was the axis in front of me=
. His binds the
> octets, which closes the tag, the outer array, and the next framing axis =
nobody has found.
> That matters because the space is combinatorial, not a list: re-emitting =
one Signed Statement
> under six CBOR encoding freedoms yields 64 legal encodings, 64 distinct d=
ata-hash values,
> none rejected by a stock parser, and 31 silently normalised back to the c=
anonical form by the
> act of reading them. Enumerating framings cannot close that; binding the =
octets does.
>=20
> Measurement, vectors and the script that recomputes them are published ra=
ther than restated
> here: https://councilof.ai/interop/scrapi-ccf/data-hash-framing-space.jso=
n
>=20
> One note for the authors, no reply needed on-list: prior art exists for t=
his rule.
> draft-mih-sokolov-scitt-payload-binding-02 =C2=A74.4 defines `as-transmit=
ted` =E2=80=94 "applies no
> canonicalization. The digest pre-image is the exact octet sequence alread=
y fixed by the
> container format or cryptographic envelope carrying the payload" =
=E2=80=94 and marks both `jcs-n`
> (=C2=A74.2) and `cde-n` (=C2=A74.3) Withdrawn. That is Konrad's sentence =
as a registered algorithm, and
> it is worth the two not drifting.
>=20
> Not blocking, and I was not blocking before.
>=20
> Nicholas Templeman
> Council of AI (CSOAI Ltd)
>=20
> --
> SCITT mailing list -- scitt@ietf.org
> To unsubscribe send an email to scitt-leave@ietf.org
>=20

Henri Sirkkavaara
Vaara -=C2=A0Runtime execution layer for AI agents
Built to see over the noise.
vaara.io
Helsinki, Finland