[SCITT] Re: SCITT Working Group adoption call for MMR Receipt Profile

Konrad Gruszka <kontakt@b7n0de.com> Wed, 30 September 2026 08:54 UTC

Received: from mail-244118.protonmail.ch (mail-244118.protonmail.ch [109.224.244.118]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mx.ietf.org (Postfix) with ESMTPS id 04A5842 for <scitt@ietf.org>; Wed, 30 Sep 2026 08:54:29 +0000 (UTC)
Authentication-Results: mx.ietf.org; dkim=pass header.d=b7n0de.com header.s=protonmail header.b=lEwW5OKE; dmarc=pass (policy=quarantine) header.from=b7n0de.com; spf=pass (mx.ietf.org: domain of kontakt@b7n0de.com designates 109.224.244.118 as permitted sender) smtp.mailfrom=kontakt@b7n0de.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=b7n0de.com; s=protonmail; t=1790758461; x=1791017661; bh=ctY4BGB9zJqISTnc6mmyMX00tKLBgeZGfKK25gKY5IY=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=lEwW5OKEk1iDqSTRoq8x3M1PV4/0EuEjnMqmtz0MUGuhuilbO9oZ4PEkc8pHqaQh9 g/XzRSOb2loM7cbTMWOZfdrOn0wv/zYa5bXM0YHc9krqQ+SkYyMb5S5lGrn99EILks j1vIECMe5hkeFRjLbpt1WYVGVgoYQoFxXSLosABUsVzyVDad2Zuzfd7jympAIFyCqw NVfXfdb3xlBVfTlzL0fvVsNt3RMpY1Z2UTb5Oj8t7AfdCn0KjB+3Xos4SevPuu+YBq Ts5XKAOk3kh6s7Q6Nqsu6LXlcLKvTFf1Y1+MSvI9OaNYML1GRt3FWIgcLfvy22uVNT yt/RSOfdMaZbw==
Date: Wed, 30 Sep 2026 08:54:16 +0000
To: Nicole Bates <nicolebates@microsoft.com>
From: Konrad Gruszka <kontakt@b7n0de.com>
Message-ID: <flyazf-pw7NMczfjTpvaC4lOIcO4G88DXI_TgRGxMC54tbKoJeaJlVMC-nH23N1gJEcm55xVWRjH7Gacc7pR7sxomfa1svL_DscOILjSlhU=@b7n0de.com>
In-Reply-To: <SA1PR21MB610482988B1337566E65BED8A2802@SA1PR21MB6104.namprd21.prod.outlook.com>
References: <SA1PR21MB610482988B1337566E65BED8A2802@SA1PR21MB6104.namprd21.prod.outlook.com>
Feedback-ID: 210251687:user:proton
X-Pm-Message-ID: 0221d311c77428e2089e994074f3544995bb17bc
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="b1=_v8s7l2bzM3oZgRPx7XQwhTJjh0e0mH71FRmhDdpVkhk"
X-Spamd-Bar: -
X-MailFrom: kontakt@b7n0de.com
X-Mailman-Rule-Hits: header-match-scitt.ietf.org-3
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-scitt.ietf.org-0; header-match-scitt.ietf.org-1; header-match-scitt.ietf.org-2
Message-ID-Hash: I6KL6MEELSMYWUPK2XZUFKEL4TRHVG22
X-Message-ID-Hash: I6KL6MEELSMYWUPK2XZUFKEL4TRHVG22
X-Mailman-Approved-At: Wed, 30 Sep 2026 16:35:45 +0000
CC: 'scitt' <scitt@ietf.org>, "scitt-chairs@ietf.org" <scitt-chairs@ietf.org>
X-Mailman-Version: 3.3.10
Precedence: list
Subject: [SCITT] Re: SCITT Working Group adoption call for MMR Receipt Profile
List-Id: "Supply Chain Integrity, Transparency, and Trust" <scitt.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/scitt/dHh3G3ZIDvlcLED9vYH1SsXUhNo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/scitt>
List-Help: <mailto:scitt-request@ietf.org?subject=help>
List-Owner: <mailto:scitt-owner@ietf.org>
List-Post: <mailto:scitt@ietf.org>
List-Subscribe: <mailto:scitt-join@ietf.org>
List-Unsubscribe: <mailto:scitt-leave@ietf.org>

Nicole, all,

We support adoption of draft-bryce-cose-receipts-mmr-profile-03 and are willing to review it. Two initial review notes follow.

Reasoning

it adds another verifiable data structure alongside CCF, designed for append-only logs on commodity storage
it reuses the COSE Receipts conventions we use for CCF, with vds 395, vdp 396 and a detached payload

Note 1, all_ones in Appendix A.4

as written, all_ones returns false for 1, 3, 7 and 15, because most_sig_bit returns a mask and is then used as a shift
index_height in Section 9.1 hit our iteration guard for all 127 tested nodes
with pos == (1 << bit_length(pos)) - 1, all 127 heights match the post-order layout, including the MMR(8) figure in Section 1
Should A.4 use that expression?

Note 2, an empty inclusion path

Section 4 defines inclusion-path as [ + bstr ]
Section 5 allows an empty path, where the node is itself the peak
Should the CDDL read [ * bstr ]?

Limits

heights compared with our own reconstruction of the post-order layout, not with an existing MMR implementation
no receipt was built or verified

Best regards,

Konrad Gruszka
b7n0de · Verified AI Work
https://b7n0de.com

Created with AI assistance. Reviewed and published by me.
https://b7n0de.com

Nicole Bates <nicolebates=40microsoft.com@dmarc.ietf.org> schrieb am Freitag, 25. September 2026 um 18:26:

> SCITT Working Group,
>
> The chairs are issuing a formal Working Group adoption call for [COSE Receipts for MMRs](https://www.ietf.org/archive/id/draft-bryce-cose-receipts-mmr-profile-03.html). The draft defines a COSE Receipt profile for ledgers based on post order traversal binary Merkle trees, commonly known as Merkle Mountain Ranges. (datatracker.ietf.org)
>
> The profile has been presented to the Working Group, received comments and review, and was updated in response to that feedback. The Working Group also discussed bringing the profile into SCITT during the IETF 126 session. (datatracker.ietf.org)
>
> This call is to determine whether the Working Group agrees that the document is in scope and should be adopted as the basis for continued SCITT work. Adoption does not indicate that the document is complete or ready for publication. Technical issues and design questions may continue to be addressed after adoption.
>
> Please respond to the mailing list by Friday, October 9, 2026, indicating:
>
> • Whether you support or oppose adoption
> • The reasoning for your position
> • Whether you are willing to review, contribute to, or implement the specification
>
> Technical comments are also welcome, but do not need to be resolved before expressing support for adoption.
>
> Thank you,
>
> Nicole Bates
>
> SCITT Working Group Cochair