global namespace that is not specific to a particular application domain.  3.2. Applications may extend the Problem Details data item with additional

Add an example for an SPDe registration based on , also fulfilling the request in .
Just having run into a a Bad Option response that was hard to debug without attaching a literal debugger to the program under test (because for some reason all the communication on the net is nowadays encrypted), I'd like to suggest one option for inclusion in the original problem details set: Name: Unprocessed CoAP option CDDL type: uint | [+uint] Brief description: CoAP option number that was not understood Longer description: A CoAP option number present in the request that could not be processed by the server. It may be a critical option that the server is unaware of, or an option the server is aware of but could not process (and chose not to, or was not allowed to, ignore it). Several options may be given in a list (in no particular order), without any guarantee that the list is complete (as the server might have stopped processing already at the first problematic option). If an option with the given number was repeated, there is no indication which of the values caused the fault. Clients need to expect seeing options in there they did not send in the request; this can happen if the request traversed a proxy that added the option but did not act on the problem details response. Note that for a few special values of unprocessed CoAP options (such as Accept or Proxy-Uri), there are special response codes (4.06 Not Acceptable, 5.05 Proxying Not Supported, respectively) to be sent instead. For future compatibility, receivers should ignore values not matching the current CDDL type, as these might be used to indicate an option more precisely if the demand arises. A typical error response with this can be rather short -- just 4.02, 1+2 byte content format, and 3 bytes of CBOR data for option numbers up to 23.
CDDL type probably more like , where Should we throw this in now or add this registration later?
This case appears to be the only one where RFC 7252 explicitly recommends a diagnostic payload. The policy is specification required, so we could simply write this up as a document in this repo and register from there. Of course, including it in the RFC provides more visibility.
Comment by NAME It would be nice with an example in as well.
I’m not sure we actually need one (there are 5 predefined now). Inventing one always has this problem that people start using it from the example, so there is a threshold of usefulness before one includes an example that is not actually registered.
Actually, is an attempt to provide an example that is actually useful to register.

global namespace that is not specific to a particular application domain. <ins> 3.1.1. basic provides a number of generally applicable Standard Problem Detail Entries.  The present section both registers another useful Standard Problem Detail entry and serves as an example of a Standard Problem Detail Entry registration, in the registration template format that would be ready for registration. The specification of the Standard Problem Detail entry referenced by the above registration template follows: The Standard Problem Detail entry "unprocessed-coap-option" provides the option number(s) of CoAP option(s) present in the request that could not be processed by the server. This may be a critical option that the server is unaware of, or an option the server is aware of but could not process (and chose not to, or was not allowed to, ignore it). The Concise Problem Details data item including this Standard Problem Detail Entry can be used in fulfillment of the "SHOULD" requirement in RFC7252. Several option numbers may be given in a list (in no particular order), without any guarantee that the list is a complete representation of all the problems in the request (as the server might have stopped processing already at one of the problematic options).  If an option with the given number was repeated, there is no indication which of the values caused the error. Clients need to expect seeing options in the list they did not send in the request; this can happen if the request traversed a proxy that added the option but did not act on the problem details response being returned by the origin server. Note that for a few special values of unprocessed CoAP options (such as Accept or Proxy-Uri), there are special response codes (4.06 Not Acceptable, 5.05 Proxying Not Supported, respectively) to be sent instead of 4.02 Bad Option. </ins> 3.2. Applications may extend the Problem Details data item with additional


The term 'byte string' is used for sequences of bytes, while the term 'text string' is used for sequences of characters.  1.4. At the time that RFC8152 was initially published, the CBOR Data Examples> that contains a set of testing examples as well.  Each example is found in a JSON file that contains the inputs used to create the example, some of the intermediate values that can be used <del> in debugging the example and the output of the example presented in both a hex and a CBOR diagnostic notation format.  Some of the examples at the site are designed failure testing cases; these are </del>  clearly marked as such in the JSON file.  If errors in the examples in this document are found, the examples on GitHub will be updated, and a note to that effect will be placed in the JSON file. The algorithms defined in this document can be found in x-table-hmac. <del> Some recipient algorithms carry the key while others derive a key from secret data.  For those algorithms that carry the key (such as AES Key Wrap), the size of the HMAC key SHOULD be the same size as the underlying hash function.  For those algorithms that derive the key (such as ECDH), the derived key MUST be the same size as the underlying hash function. </del>  When using a COSE key for this algorithm, the following checks are made: IANA is rquested to add a new row to the "COSE Algorithms" registry.  10.3. IANA is requested to modify the description to "Public Key" for the line with "Key Type" of 2 and the "Name" of "x".  See x-table- ec1-keys which has been modified with this change.  11. There are a number of security considerations that need to be taken providing security services.  The use of COSE, like JOSE and CMS, is only in store and forward or offline protocols, different solutions would be appropriate for online protocols although one can use COSE <del> in and online protocol after having done some type of online key </del>  establishment process.  Any application which uses COSE for security services first needs to determine what security services are required and then select the appropriate COSE structures and cryptographic

Add in response for IANA review on all documents SecDir review by Nancy on -algs GenArt review on -struct

The term 'byte string' is used for sequences of bytes, while the term 'text string' is used for sequences of characters. <ins> The tables for algorithms contain the following columns: Additional columns may be present in the table depending on the algorithms. </ins> 1.4. At the time that RFC8152 was initially published, the CBOR Data Examples> that contains a set of testing examples as well.  Each example is found in a JSON file that contains the inputs used to create the example, some of the intermediate values that can be used  <ins> for debugging, and the output of the example.  The results are encoded using both hexadecimal and CBOR diagnostic notation format. Some of the examples are designed to test failure case; these are </ins> clearly marked as such in the JSON file.  If errors in the examples in this document are found, the examples on GitHub will be updated, and a note to that effect will be placed in the JSON file. The algorithms defined in this document can be found in x-table-hmac.  <ins> Some recipient algorithms transport the key, while others derive a key from secret data.  For those algorithms that transport the key (such as AES Key Wrap), the size of the HMAC key SHOULD be the same size as the underlying hash function.  For those algorithms that derive the key (such as ECDH), the derived key MUST be the same size as the underlying hash function. </ins> When using a COSE key for this algorithm, the following checks are made: IANA is rquested to add a new row to the "COSE Algorithms" registry. <ins> The capabilities column for this registration is to be empty. </ins> 10.3. IANA is requested to modify the description to "Public Key" for the line with "Key Type" of 2 and the "Name" of "x".  See x-table- ec1-keys which has been modified with this change. <ins> IANA is requested to update the references in the table from RFC8152 to [[This Document]]. </ins> 11. There are a number of security considerations that need to be taken providing security services.  The use of COSE, like JOSE and CMS, is only in store and forward or offline protocols, different solutions would be appropriate for online protocols although one can use COSE  <ins> in an online protocol after having done some type of online key </ins> establishment process.  Any application which uses COSE for security services first needs to determine what security services are required and then select the appropriate COSE structures and cryptographic


RFC8613 and I-D.ietf-core-groupcomm-bis.  However, COSE is not restricted to just these cases and can be used in any place where one would consider either JOSE or CMS RFC5652 for the purpose of <del> providing security services.  The use of COSE, like JOSE and CMS, is only for use in store and forward or offline protocols.  The use of COSE in online protocols needing encryption, require that an online key establishment process be done before sending objects back and forth.  Any application which uses COSE for security services first needs to determine what security services are required and then select the appropriate COSE structures and cryptographic algorithms based on those needs.  app-considerations provides additional information on what applications need to specify when using COSE. </del>  One feature that is present in CMS that is not present in this standard is a digest structure.  This omission is deliberate.  It is are going to be common to all applications, the two values may not always be adjacent as the algorithm could be defined once with multiple values.  Applications may additionally want to define <del> additional data fields as part of the structure.  A one such </del>  application-specific element would be to include a URI or other pointer to where the data that is being hashed can be obtained.  I- D.ietf-cose-hash-algs contains one such possible structure along with cryptographic key, we use the term "label" for this usage as a map key. <del> The presence a label that is neither a a text string or an integer, in a CBOR map, is an error.  Applications can either fail processing or process messages by ignoring incorrect labels; however, they MUST NOT create messages with incorrect labels. </del>  A CDDL grammar fragment defines the non-terminal 'label', as in the previous paragraph, and 'values', which permits any value to be used. different types of cryptographic concepts.  As an example of how this works, consider the COSE_Encrypt message (EnvelopedData).  This message type is broken into two layers: the content layer and the <del> recipient layer.  The content layer contains the plaintext is encrypted and information about the encrypted message.  The recipient layer contins the content encryption key (CEK) is encrypted and information about how it is encrypted for each recipient.  A single layer version of the encryption message COSE_Encrypt0 (EnvelopedData0) is provided for cases where the CEK is pre-shared. </del>  Identification of which type of message has been presented is done by the following methods: along with the signature itself.  These header parameters may be authenticated by the signature, or just present.  An example of a header parameter about the content is the content type header <del> parameter.  An examples of a header parameter about the signature </del>  would be the algorithm and key used to create the signature. RFC 5652 indicates that: message, all of the signature algorithms are going to be required to consume the same bytes of message content.  This means that the mixing of the signature with message recovery and signature with <del> appendix schemes in a single message is not supported, and if a recovery signature scheme is used. </del>  The signature functions for this scheme are: there is a high probability that additional issues will arise when integrating message recovery signature algorithms.  The first algorithm defined is going to need to make decisions about these <del> issues and those decisions re likely to be binding on any further </del>  algorithms defined. We use the following terms below: <del> Some of the issue2 that have already been identified are: </del>  Signature algorithms are used with the COSE_Signature and COSE_Sign1 structures.  At the time of this writing, only signatures with 11. The registries and registrations listed below were created during <del> processing of RFC 8152 RFC8152.  The majority of the actions are to update the references to point to this document. </del>  11.1. IANA created a registry titled "COSE Header Parameters" as part of processing RFC8152.  IANA is requested to update the reference for <del> all entries, except "counter signature" and "CounterSignature0", in the table from RFC8152 to this document.  The reference for "counter signature" and "CounterSignature0" are to be left alone. </del>  11.2. IANA created a registry titled "COSE Key Common Parameters" as part of the processing of RFC8152.  IANA is requested to update the <del> reference for entries in the table from RFC8152 to this document. </del>  11.3.

This PR addresses the remaining comments from Ben Kaduk. NAME do these changes match your expectations?
Ah, that's the one. Will add. I do note that Göran's name is still too "ASCII-ized"; how to include the unicode here is not immediately clear (it's not in an , it's not , etc). I suggest adding an RFC Editor's note about it?
NAME Looking again, there is a CBOR Tags section in this document, at the end of the IANA section instead of the beginning. I think we're good to go, once this is merged. This looks pretty good (some suggestions inline). Comparing against my ballot position (at URL), I don't see anything to match: incorporated still (and the report verified, presuming it is correct). but my recollection is that that one is already incorporated, just into -algs, and I should mark it verified and allocating a codepoint for COSE_Signature). I think we need to bring back a stub section with the directive to update the references from 8152 to this document. which may still be outstanding (I don't remember any other clarifications about that point having gone by).	 authentication check of the contents algorithm" -> "authentication check of the contents" ? How should I read this sentence about AE?  It seems to be copied from 8152, but I kinda feel like the 3rd (last) use of the word "algorithm" could be removed? Table 1, CBOR tag 17: "COSE Mac w/o" -> "COSE MAC w/o" "This is same" -> "This is the same" "That is the counter signature..." -> "That is, the counter signature..." Isn't #6.98 for COSE_Sign_Tagged?  I think the CDDL fragment needs to fixed temporarily to: COSE_CounterSignature_Tagged = #TBD0(COSE_CounterSignature) "of other than direct" -> "if other than direct"? #2: "COSE_MAC" -> "COSE_Mac"? "this new algorithms" -> "these new algorithms" "the key from next layer down" -> "the key from the next layer down" In the interests of brevity, my review focused on the diff between this document and RFC 8152. I agree with Benjamin's concern that we seem to be leaving the Designated Experts for the IANA registries described here with advice in RFC 8152, which this document renders obsolete.   I think that prose should be copied to this document so that it lives someplace current.  I was originally tempted to DISCUSS this but I'm hesitating, so I'll just say I hope this is resolved appropriately. "... structure for the CBOR objects which are ..." -- s/which/that/ "... or offline protocols, different solutions ..." -- "different" should start a new sentence "Any application which uses COSE for security ..." -- s/which/that/ The last sentence in the first paragraph: "This is same structure ..." -- s/same/the same/ "That is the counter signature ..." -- comma after "is" "... existence of the encrypted data is attested to." -- maybe "asserted" instead of "attested to"? "New algorithms will be created which will not fit ..." -- s/which/that/ In the final bullet, why aren't these MUSTs?  Or in the alternative, when would one legitimately deviate from those SHOULDs? I've only reviewed the diffs, not the historical approved text.  Everything looks okay to me.  A few minor comments/nits: I'm not familiar with the CDDL grammar, and specifically whether there is any tooling that can use the grammar to generate structures/etc.  If there is, then I think that it would be helpful if the CDDL grammar was also normative, in the sense that readers of the spec should be able to assume that the CDDL is correct.  I would still be okay with a statement that says that if there is any ambiguity between the two then the prose description should be taken as being definitive. This sentence was changed from the original formulation, but I find it slightly clunky.  Perhaps: The presence of a label, that is neither a text string nor an integer, in a CBOR map, is an error. Nit, this -> these Thanks for making an easy to read and compare bis document. Thank you for addressing my DISCUSS and COMMENT items around Counter Signatures. Thank you for the work put into this document. I really appreciate the section 1 with the detailed and clear introduction. My current workload prevented me to do a deep review, I will then rely mainly on the other Area Directors. Mostly just nits left, though the lingering errata report and the IANA updates seem somewhat significant.  (It would probably be fine to leave the nits for the RFC Editor.) It seems that https://www.rfc-editor.org/errata/eid5066 needs to be incorporated still (and the report verified, presuming it is correct). nit: we probably can just start the sentence with "COSE", since the "use in" has moved to later in the sentence. nit: s/A one/One/. nit: s/a a/a/ nit: s/plaintext is encrypted/encrypted plaintext/ (or similar?) nit: s/content encryption key (CEK) is encrypted/encrypted content encryption key (CEK)/. nit: s/An examples/An example/ I guess this is where the difficulty that Jim mentioned comes in -- the signature recovery scheme gives you the intended recovered content but also some of the other framing and such that was added as input to the signature algorithm, and you have to properly figure out where the end of the actual payload is.  (I'm not sure whether it would be useful to try to have text about the issue in this location, though.) nit: this sentence just trails off ....  I think it would be okay to just end the sentence after "is not supported", since we covered the "must recover the same [number of] bytes" previously. nit: s/ re / are / nit: s/issue2/issues/ I see that a bunch of things were changed from COSE_Encrypt to COSE_Recipient, apparently prompted by my earlier review.  I would feel more comfortable if someone confirmed that each change is correct, as I have lost some of the context here. nit: s/guidence/guidance/ We lost the section about the "CBOR Tags" registry (where we were previously allocating a codepoint for COSE_Signature).  I think we need to bring back a stub section with the directive to update the references from 8152 to this document. The references to the COSE registries should not be Normative. Thanks for addressing my issue with the IANA registration rules.
authentication check of the contents algorithm" -> "authentication check of the contents" ? How should I read this sentence about AE?  It seems to be copied from 8152, but I kinda feel like the 3rd (last) use of the word "algorithm" could be removed? Table 1, CBOR tag 17: "COSE Mac w/o" -> "COSE MAC w/o" "This is same" -> "This is the same" "That is the counter signature..." -> "That is, the counter signature..." Isn't #6.98 for COSE_Sign_Tagged?  I think the CDDL fragment needs to fixed temporarily to: COSE_CounterSignature_Tagged = #TBD0(COSE_CounterSignature) "of other than direct" -> "if other than direct"? #2: "COSE_MAC" -> "COSE_Mac"? "this new algorithms" -> "these new algorithms" "the key from next layer down" -> "the key from the next layer down" In the interests of brevity, my review focused on the diff between this document and RFC 8152. I agree with Benjamin's concern that we seem to be leaving the Designated Experts for the IANA registries described here with advice in RFC 8152, which this document renders obsolete.   I think that prose should be copied to this document so that it lives someplace current.  I was originally tempted to DISCUSS this but I'm hesitating, so I'll just say I hope this is resolved appropriately. "... structure for the CBOR objects which are ..." -- s/which/that/ "... or offline protocols, different solutions ..." -- "different" should start a new sentence "Any application which uses COSE for security ..." -- s/which/that/ The last sentence in the first paragraph: "This is same structure ..." -- s/same/the same/ "That is the counter signature ..." -- comma after "is" "... existence of the encrypted data is attested to." -- maybe "asserted" instead of "attested to"? "New algorithms will be created which will not fit ..." -- s/which/that/ In the final bullet, why aren't these MUSTs?  Or in the alternative, when would one legitimately deviate from those SHOULDs? I've only reviewed the diffs, not the historical approved text.  Everything looks okay to me.  A few minor comments/nits: I'm not familiar with the CDDL grammar, and specifically whether there is any tooling that can use the grammar to generate structures/etc.  If there is, then I think that it would be helpful if the CDDL grammar was also normative, in the sense that readers of the spec should be able to assume that the CDDL is correct.  I would still be okay with a statement that says that if there is any ambiguity between the two then the prose description should be taken as being definitive. This sentence was changed from the original formulation, but I find it slightly clunky.  Perhaps: The presence of a label, that is neither a text string nor an integer, in a CBOR map, is an error. Nit, this -> these Thanks for making an easy to read and compare bis document. Thank you for addressing my DISCUSS and COMMENT items around Counter Signatures. Thank you for the work put into this document. I really appreciate the section 1 with the detailed and clear introduction. My current workload prevented me to do a deep review, I will then rely mainly on the other Area Directors. Mostly just nits left, though the lingering errata report and the IANA updates seem somewhat significant.  (It would probably be fine to leave the nits for the RFC Editor.) It seems that https://www.rfc-editor.org/errata/eid5066 needs to be incorporated still (and the report verified, presuming it is correct). nit: we probably can just start the sentence with "COSE", since the "use in" has moved to later in the sentence. nit: s/A one/One/. nit: s/a a/a/ nit: s/plaintext is encrypted/encrypted plaintext/ (or similar?) nit: s/content encryption key (CEK) is encrypted/encrypted content encryption key (CEK)/. nit: s/An examples/An example/ I guess this is where the difficulty that Jim mentioned comes in -- the signature recovery scheme gives you the intended recovered content but also some of the other framing and such that was added as input to the signature algorithm, and you have to properly figure out where the end of the actual payload is.  (I'm not sure whether it would be useful to try to have text about the issue in this location, though.) nit: this sentence just trails off ....  I think it would be okay to just end the sentence after "is not supported", since we covered the "must recover the same [number of] bytes" previously. nit: s/ re / are / nit: s/issue2/issues/ I see that a bunch of things were changed from COSE_Encrypt to COSE_Recipient, apparently prompted by my earlier review.  I would feel more comfortable if someone confirmed that each change is correct, as I have lost some of the context here. nit: s/guidence/guidance/ We lost the section about the "CBOR Tags" registry (where we were previously allocating a codepoint for COSE_Signature).  I think we need to bring back a stub section with the directive to update the references from 8152 to this document. The references to the COSE registries should not be Normative. Thanks for addressing my issue with the IANA registration rules.

RFC8613 and I-D.ietf-core-groupcomm-bis.  However, COSE is not restricted to just these cases and can be used in any place where one would consider either JOSE or CMS RFC5652 for the purpose of  <ins> providing security services.  COSE, like JOSE and CMS, is only for use in store and forward or offline protocols.  The use of COSE in online protocols needing encryption, require that an online key establishment process be done before sending objects back and forth. Any application which uses COSE for security services first needs to determine what security services are required and then select the appropriate COSE structures and cryptographic algorithms based on those needs.  app-considerations provides additional information on what applications need to specify when using COSE. </ins> One feature that is present in CMS that is not present in this standard is a digest structure.  This omission is deliberate.  It is are going to be common to all applications, the two values may not always be adjacent as the algorithm could be defined once with multiple values.  Applications may additionally want to define  <ins> additional data fields as part of the structure.  One such </ins> application-specific element would be to include a URI or other pointer to where the data that is being hashed can be obtained.  I- D.ietf-cose-hash-algs contains one such possible structure along with cryptographic key, we use the term "label" for this usage as a map key.  <ins> The presence a label that is neither a text string or an integer, in a CBOR map, is an error.  Applications can either fail processing or process messages by ignoring incorrect labels; however, they MUST NOT create messages with incorrect labels. </ins> A CDDL grammar fragment defines the non-terminal 'label', as in the previous paragraph, and 'values', which permits any value to be used. different types of cryptographic concepts.  As an example of how this works, consider the COSE_Encrypt message (EnvelopedData).  This message type is broken into two layers: the content layer and the  <ins> recipient layer.  The content layer contains the encrypted plaintext and information about the encrypted message.  The recipient layer contains the encrypted content encryption key (CEK) and information about how it is encrypted for each recipient.  A single layer version of the encryption message COSE_Encrypt0 (EnvelopedData0) is provided for cases where the CEK is pre-shared. </ins> Identification of which type of message has been presented is done by the following methods: along with the signature itself.  These header parameters may be authenticated by the signature, or just present.  An example of a header parameter about the content is the content type header  <ins> parameter.  An example of a header parameter about the signature </ins> would be the algorithm and key used to create the signature. RFC 5652 indicates that: message, all of the signature algorithms are going to be required to consume the same bytes of message content.  This means that the mixing of the signature with message recovery and signature with  <ins> appendix schemes in a single message is not supported. </ins> The signature functions for this scheme are: there is a high probability that additional issues will arise when integrating message recovery signature algorithms.  The first algorithm defined is going to need to make decisions about these  <ins> issues and those decisions are likely to be binding on any further </ins> algorithms defined. We use the following terms below:  <ins> Some of the issues that have already been identified are: </ins> Signature algorithms are used with the COSE_Signature and COSE_Sign1 structures.  At the time of this writing, only signatures with 11. The registries and registrations listed below were created during  <ins> processing of RFC 8152 RFC8152.  The majority of the following actions are to update the references to point to this document. Note that while I-D.ietf-cose-rfc8152bis-algs also updates the registries and registrations originally established by RFC8152, the requested updates are mutually exclusive.  The updates requested in this document do not conflict or overlap with the updates requested in I-D.ietf-cose-rfc8152bis-algs, and vice versa. </ins> 11.1. IANA created a registry titled "COSE Header Parameters" as part of processing RFC8152.  IANA is requested to update the reference for  <ins> this registry from RFC8152 to this document.  IANA is also requested to update the reference for all entries, except "counter signature" and "CounterSignature0", in the table from RFC8152 to this document. The reference for "counter signature" and "CounterSignature0" are to be left as-is. </ins> 11.2. IANA created a registry titled "COSE Key Common Parameters" as part of the processing of RFC8152.  IANA is requested to update the  <ins> reference for this registry from RFC8152 to this document.  IANA is also requested to update the reference for entries in the table from RFC8152 to this document. </ins> 11.3.


private curves can be used as well. contains the x coordinate for the EC point.  The integer is <del> converted to an octet string as defined in SEC1.  Zero octets MUST NOT be removed from the front of the octet string. </del>  contains either the sign bit or the value of y coordinate for the EC point.  When encoding the value y, the integer is converted to an octet string (as defined in SEC1) and encoded as a CBOR bstr. <del> Leading zero octets MUST be preserved.  When encoding the sign of y, the expression 'y > 0' is evaluated and encoded a CBOR boolean. </del>  contains the private key.

The sign encoding function should deal with other types of curves as well. Make the text refer to the SEC1 encoding function.

private curves can be used as well. contains the x coordinate for the EC point.  The integer is  <ins> converted to an octet string as defined in SEC1.  Leading zero octets MUST be preserved. </ins> contains either the sign bit or the value of y coordinate for the EC point.  When encoding the value y, the integer is converted to an octet string (as defined in SEC1) and encoded as a CBOR bstr.  <ins> Leading zero octets MUST be preserved.  The compressed point encoding is also supported.  Compute the sign bit as laid out in the Elliptic-Curve-Point-to-Octet-String Conversion function of SEC1.  If the sign bit is zero, then encode y as a CBOR false value, otherwise encode y as a CBOR true value.  The encoding of the infinity point is not supported. </ins> contains the private key.


6.  In this section we describe the structure and methods to be used when doing MAC authentication in COSE.  This document allows for the use of all of the same classes of recipient algorithms as are allowed for The CDDL fragment which represents the above text for COSE_Mac follows. <del> 6.1. </del>  In order to get a consistent encoding of the data to be authenticated, the MAC_structure is used to have a canonical form. in order are: A text string that identifies the structure that is being encoded. <del> This string is "MAC" for the COSE_Mac struture. </del>  The protected attributes from the COSE_MAC structure.  If there are no protected attributes, a zero length binary string is to be

Everybody but me wants a MAC w/o recipients.
There also needs to be an equivalent no-recipient signature version. Thanks.
That string does not even parse.
Should the kid attribute be a binary value rather than a string value?
No arguments that binary should not be the only type for this, some questions that binary is useful based on Jose experience. Definite arguement that binary is required. Doing two types is probably a bad idea.

6. <ins> COSE supports two different MAC structures.  COSE_MAC is used when the key needs to be explicitly identified.  The structure supports the use of recipient structures to allow for random content encryption keys to be used.  COSE_MAC0 is used when the a recipient structure is not needed because the key to be used is implicitly known. 6.1. </ins> In this section we describe the structure and methods to be used when doing MAC authentication in COSE.  This document allows for the use of all of the same classes of recipient algorithms as are allowed for The CDDL fragment which represents the above text for COSE_Mac follows.  <ins> 6.2. In this section we describe the structure and methods to be used when doing MAC authentication for those cases where the recipient is implicitly known. The MAC message uses the COSE_Mac0 structure defined in this section for carrying the body. The MAC structure can be encoded either withor without a tag depending on the context it will be used in.  The MAC structure is identified by the CBOR tag TBD6.  The CDDL fragment that represents this is: The COSE_Mac0 structure is a CBOR array.  The fields of the array in order are: is described in header-parameters. is described in header-parameters. contains the serialized content to be MACed.  If the payload is not present in the message, the application is required to supply the payload separately.  The payload is wrapped in a bstr to ensure that it is transported without changes.  If the payload is transported separately, then a null CBOR object is placed in this location and it is the responsibility of the application to ensure that it will be transported without changes. contains the MAC value. The CDDL fragment which corresponds to the above text is: 6.3. </ins> In order to get a consistent encoding of the data to be authenticated, the MAC_structure is used to have a canonical form. in order are: A text string that identifies the structure that is being encoded.  <ins> This string is "MAC" for the COSE_Mac structure.  This string is "MAC0" for the COSE_Mac0 structure. </ins> The protected attributes from the COSE_MAC structure.  If there are no protected attributes, a zero length binary string is to be


signature can be computed.  Details on computing counter signatures are found in counter_signature. <del> This parameter provides the time the content cryptographic operation is performed.  For signatures and recipient structures, this would be the time that the signature or recipient key object was created.  For content structures, this would be the time that the content structure was created.  The unsigned integer value is the number of seconds, excluding leap seconds, after midnight UTC, January 1, 1970.  The field is primarily intended to be to be used for counter signatures, however it can additionally be used for replay detection as well. </del> The CDDL fragment that represents the set of headers defined in this section is given below.  Each of the headers is tagged as optional because they do not need to be in every map, headers required in authenticated by the signature, or just present.  An example of a parameter about the content is the content type.  Examples of parameters about the signature would be the algorithm and key used to <del> create the signature, when the signature was created, and counter signatures. </del>  When more than one signature is present, the successful validation of one signature associated with a given signer is usually treated as a COSE supports two different encryption structures.  COSE_Encrypted is used when a recipient structure is not needed because the key to be <del> used is known implicitly.  COSE_Enveloped is used the rest of time time.  This includes cases where there are multiple recipients, a recipient algorithm other than direct is to be used, or the key to be used is not known. </del>  5.1. mitigated by including the signature algorithm identifier in the data to be signed.  9. Message Authentication Codes (MACs) provide data authentication and 12.4.1. The mathematics for Elliptic Curve Diffie-Hellman can be found in <del> RFC6090. </del>  ECDH is parameterized by the following: When using a COSE key for this algorithm, the following checks are made: <del> The 'kty' field MUST be present and it MUST be 'EC2'. </del>  If the 'alg' field present, it MUST match the Key Agreement algorithm being used. 13.2.  Occasionally it is required that a symmetric key be transported between entities.  This key structure allows for that to happen. 17.  There are a number of security considerations that need to be taken into account by implementers of this specification.  The security considerations that are specific to an individual algorithm are to prevent or discourage such analysis.  (For example the strings could be defined as 'YES' and 'NO '.) <del> 18. </del>  This document is a product of the COSE working group of the IETF. [CREF1] JLS: I have not gone through the document to determine what needs to be here yet.  We mostly want to grab terms that are used in unusual ways or are not generally understood.

Deemed not used in enough locations - counter signatures suffer because of this but the group did not care.

signature can be computed.  Details on computing counter signatures are found in counter_signature.  The CDDL fragment that represents the set of headers defined in this section is given below.  Each of the headers is tagged as optional because they do not need to be in every map, headers required in authenticated by the signature, or just present.  An example of a parameter about the content is the content type.  Examples of parameters about the signature would be the algorithm and key used to  <ins> create the signature and counter signatures. </ins> When more than one signature is present, the successful validation of one signature associated with a given signer is usually treated as a COSE supports two different encryption structures.  COSE_Encrypted is used when a recipient structure is not needed because the key to be  <ins> used is known implicitly.  COSE_Enveloped is used the rest of time. This includes cases where there are multiple recipients, a recipient algorithm other than direct is to be used, or the key to be used is not known. </ins> 5.1. mitigated by including the signature algorithm identifier in the data to be signed. <ins> 8.2. I-D.irtf-cfrg-eddsa describes the elliptic curve signature scheme Edwards-curve Digital Signature Algorithm (EdDSA).  In that document, the signature algorithm is instantiated using parameters for edwards25519 and edwards448 curves.  The document additionally describes two variants of the EdDSA algorithm: Pure EdDSA, where no hash function is applied to the content before signing and, HashEdDSA where a hash function is applied to the content before signing and the result of that hash function is signed.  For use with COSE, on the pure EdDSA version is used.  This is because it is not expected that extremely large contents are going to be needed and, based on the arrangement of the message structure, the entire message is going to need to be held in memory in order to create or verify a signature.  Thus, the use of an incremental update process would not be useful.  Applications can provide the same features by defining the content of the message as a hash value and transporting the COSE message and the content as separate items. The algorithms defined in this document can be found in table-eddsa- algs.  A single signature algorithm is defined which can be used for multiple curves. I-D.irtf-cfrg-eddsa describes the method of encoding the signature value. When using a COSE key for this algorithm the following checks are made: The 'kty' field MUST be present and it MUST be 'OKP'. The 'crv' field MUST be present, and it MUST be a curve defined for this signature algorithm. If the 'alg' field is present, it MUST match 'EdDSA'. If the 'key_ops' field is present, it MUST include 'sign' when creating an EdDSA signature. If the 'key_ops' field is present, it MUST include 'verify' when verifying an EdDSA signature. </ins> 9. Message Authentication Codes (MACs) provide data authentication and 12.4.1. The mathematics for Elliptic Curve Diffie-Hellman can be found in  <ins> RFC6090.  In this document the algorithm is extended to be used with the two curves defined in I-D.irtf-cfrg-curves. </ins> ECDH is parameterized by the following: When using a COSE key for this algorithm, the following checks are made:  <ins> The 'kty' field MUST be present and it MUST be 'EC2' or 'OKP'. </ins> If the 'alg' field present, it MUST match the Key Agreement algorithm being used. 13.2. <ins> A new key type is defined for Octet Key Pairs (OKP).  Do not assume that keys using this type are elliptic curves.  This key type could be used for other curve types (for example mathematics based on hyper-elliptic surfaces). The key parameters defined in this section are summarized in table- ec1-keys.  The members that are defined for this key type are: contains an identifier of the curve to be used with the key. [CREF2] The curves defined in this document for this key type can be found in table-ec-curves.  Other curves may be registered in the future and private curves can be used as well. contains the x coordinate for the EC point.  The octet string represents a little-endian encoding of x. contains the private key. For public keys, it is REQUIRED that 'crv' and 'x' be present in the structure.  For private keys, it is REQUIRED that 'crv' and 'd' be present in the structure.  For private keys, it is RECOMMENDED that 'x' also be present, but it can be recomputed from the required elements and omitting it saves on space. 13.3. </ins> Occasionally it is required that a symmetric key be transported between entities.  This key structure allows for that to happen. 17. <ins> This section records the status of known implementations of the protocol defined by this specification at the time of posting of this Internet-Draft, and is based on a proposal described in RFC6982.  The description of implementations in this section is intended to assist the IETF in its decision processes in progressing drafts to RFCs. Please note that the listing of any individual implementation here does not imply endorsement by the IETF.  Furthermore, no effort has been spent to verify the information presented here that was supplied by IETF contributors.  This is not intended as, and must not be construed to be, a catalog of available implementations or their features.  Readers are advised to note that other implementations may exist. According to RFC6982, "this will allow reviewers and working groups to assign due consideration to documents that have the benefit of running code, which may serve as evidence of valuable experimentation and feedback that have made the implemented protocols more mature. It is up to the individual working groups to use this information as they see fit". 17.1. Implemenation Location: https://github.com/cose-wg/COSE-JAVA Primary Maintainer: Jim Schaad Description: A JAVA library version of the COSE message specification.  The cryptography for the library is the Bouncy Castle JAVA implementation. Coverage: The library does not currently implement counter signatures.  The library includes some self testing both internally and againist the examples library Licensing: Revised BSD License 17.2. Implemenation Location: https://github.com/cose-wg/COSE-C Primary Maintainer: Jim Schaad Description: A C library version of the COSE message specification.  The cryptography for the library is currently OPENSSL version 1.0. Coverage: The library does not currently implement counter signatures.  The library includes some self testing both internally and againist the examples library. Licensing: Revised BSD License 17.3. Implemenation Location: https://github.com/cose-wg/cose- implementations Primary Maintainer: Jim Schaad Description: A C# library version of the COSE message specification.  The cryptography for the library is the Bouncy Castle C# implementation. Coverage: The library does only partially implements counter signatures.  The library includes some self testing both internally and againist the examples library Licensing: Revised BSD License 17.4. Implemenation Location: https://github.com/cose-wg/Examples Primary Maintainer: Jim Schaad Description: A set of tests for the COSE library is provided as part of the implementation effort.  Both success and fail tests has been provided.  All of the examples in this document are are part of this example set. Coverage: The attempt has been to have test cases for every message type and algorithm in the document.  Current examples dealing with counter signatures, EdDSA and ECDH with Curve24459 and Goldilocks are missing. Licensing: Public Domain 18. </ins> There are a number of security considerations that need to be taken into account by implementers of this specification.  The security considerations that are specific to an individual algorithm are to prevent or discourage such analysis.  (For example the strings could be defined as 'YES' and 'NO '.)  <ins> 19. </ins> This document is a product of the COSE working group of the IETF. [CREF1] JLS: I have not gone through the document to determine what needs to be here yet.  We mostly want to grab terms that are used in unusual ways or are not generally understood. <ins> [CREF2] JLS: Is is the same registry for both OKP and EC2? </ins>


Since the only the math is changed by changing the curve, the curve is not fixed for any of the algorithm identifiers we define.  Ephemeral-static or static-static: The key agreement process may be done using either a static or an ephemeral key for the sender's side.  When using ephemeral keys, the sender MUST generate a new If the 'key_ops' field is present, it MUST be empty for the public key.  12.5. Key Agreement with Key Wrapping uses a randomly generated CEK.  The applications to document how content padding is to be done in order to prevent or discourage such analysis.  (For example the strings could be defined as 'YES' and 'NO '.) <del> Timing Issues - TBD </del>

Response to note from Göran Selander 1) we need to say where the secret is derived from 2) how it is formatted, and 3) why we are not using KA and KB in the KDF step.

Since the only the math is changed by changing the curve, the curve is not fixed for any of the algorithm identifiers we define. <ins> Shared Secret to Byte String: Once the shared secret is computed using the correct mathematics, the resulting value needs to be converted to a byte string to run the KDF function.  The X coordinate is used for all of the curves defined in this document. For curves X25519 and X448, the resulting value is used directly as it is a byte string of a known length.  For the P-256, P-384 and P-521 curves, the X coordinate is run through the I2OSP function defined in RFC3447 using the same computation for n as is defined in ECDSA. </ins> Ephemeral-static or static-static: The key agreement process may be done using either a static or an ephemeral key for the sender's side.  When using ephemeral keys, the sender MUST generate a new If the 'key_ops' field is present, it MUST be empty for the public key. <ins> 12.4.2. Some method of checking that points provided from external entities are valid.  For the 'EC2' key format, this can be done by checking that the x and y values form a point on the curve.  For the 'OKP' format, there is no simple way to do point validation. Consideration was given to requiring that the public keys of both entities be provided as part of the key derivation process.  (As recommended in section 6.1 of RFC7748.)  This was not done as COSE is used in a store and forward format rather than in on line key exchange.  In order for this to be a problem, either the receiver public key has to be chosen maliciously or the sender has to be malicious.  In either case, all security evaporates anyway. A proof of possession of the private key associated with the public key is recommended when a key is moved from untrusted to trusted. (Either by the end user or by the entity that is responsible for making trust statements on keys.) </ins> 12.5. Key Agreement with Key Wrapping uses a randomly generated CEK.  The applications to document how content padding is to be done in order to prevent or discourage such analysis.  (For example the strings could be defined as 'YES' and 'NO '.)


contains the value of the key. <del> This key structure contains only private key information; care must be taken that it is never transmitted accidentally.  For public keys, there are no required fields.  For private keys, it is REQUIRED that </del>  'k' be present in the structure. 14.

This is basically the text that Ludwig agreed to. Will seek second confirmation for issue
In Section 13.2. there is the following text: "This key structure contains only private key information, care must be taken that it is never transmitted accidentally. For public keys, there are no required fields. For private keys, it is REQUIRED that 'k' be present in the structure." This should probably read something like this: "This key structure only contains secret (or symmetric) key information, care must be taken that it is never transmitted accidentally. For symmetric keys, it is REQUIRED that 'k' be present in the structure."
What if we change it to be This key structure does not have a form that contains only public members. For symmetric keys, it is REQUIRED that 'k' be present in the structure.
I really have nothing against the "care must be taken ..." part. I'd actually tend to leave it in, but feel free to rephrase that as you see fit.

contains the value of the key.  <ins> This key structure does not have a form which contains only public members.  As it is expected that this key structure is going to be transmitted, care must be taking that it is never transmitted accidentally or insecurely.  For symmetric keys, it is REQUIRED that </ins> 'k' be present in the structure. 14.


<del> CBOR Encoded Message Syntax </del>  draft-ietf-cose-msg-latest Abstract Concise Binary Object Representation (CBOR) is data format designed for small code size and small message size.  There is a need for the ability to have the basic security services defined for this data <del> format.  This document specifies processing for signatures, message authentication codes, and encryption using CBOR.  This document also specifies a representation for cryptographic keys using CBOR. </del>  Contributing to this document can thus be inferred rather than made explicit.  If identity information is carried in the message, applications SHOULD have a way of validating the supplied identity information.  The <del> identity information does not need to be specified and can be left as absent. </del>  This contains a nonce value.  The nonce can either be implicit from the protocol or carried as a value in the unprotected used to carry this value in the message However, the nonce value could be determined by the application and the value determined from elsewhere. <del> This item is optional and can be absent. </del>  This contains other information that is defined by the protocol. <del> This item is optional and can be absent. </del>  This field holds information about party V.  The content of the structure are the same as for the PartyUInfo but for partyV.

We change the title of the document Implement the suggested change from Carsten that we put nils in to unused elements in the ParytInfo structure. I was a bit more complete than the original suggestion but it is probably simpler to get right that way.
It may be better to use the CBOR tag 24 rather than a bstr wrapper for the protected attributes field. The major question that needs to be addressed is how this is treated by existing parsers - will they try and decode it anyway or will the wait to decode them later. It is going to be required that they are both decode later and immutable to changes if they run through an intermediary which will decode, modify and re-encode any of the top level information. I don't believe that there is any benefits to using this rather than bstr for the payload field on signatures and macs since they could be any data type inside rather than a fixed one.
Did not correctly read the spec.

<ins> COSE: A Message Based Security Solution for CBOR </ins> draft-ietf-cose-msg-latest Abstract Concise Binary Object Representation (CBOR) is data format designed for small code size and small message size.  There is a need for the ability to have the basic security services defined for this data  <ins> format.  This document defines the CBOR Object Signing and Encyption (COSE) specification.  This specification describes how to create and process signature, message authentication codes and encryption using CBOR for serialization.  This specifiction additionally specifies how to representat cryptographic keys using CBOR. </ins> Contributing to this document can thus be inferred rather than made explicit.  If identity information is carried in the message, applications SHOULD have a way of validating the supplied identity information.  The  <ins> identity information does not need to be specified and is set to nil in that case. </ins> This contains a nonce value.  The nonce can either be implicit from the protocol or carried as a value in the unprotected used to carry this value in the message However, the nonce value could be determined by the application and the value determined from elsewhere.  <ins> This option does not need to be specified and is set to nil in that case </ins> This contains other information that is defined by the protocol.  <ins> This option does not need to be specified and is set to nil in that case </ins> This field holds information about party V.  The content of the structure are the same as for the PartyUInfo but for partyV.


Have any security considerations that are part of the message been enforced (as specified by the application or crit parameter)? <del> This document defines several algorithms where the computed authentication tag can be truncated to a shorter value than the default value.  Doing this truncation affects the authentication service provided by this value.  In general, [CREF3] </del> There are a large number of algorithms presented in this document that use nonce values.  For all of the nonces defined in this document, there is some type of restriction on the nonce being a appropriate table when we defined what a 'kty' is so they have had a chance to find out what 'OKP' is.  If we did this we would need to do it for all of the different values that show up here. <del> [CREF3] GS: Include a birthday attack note on tag size? </del>

Started a birthday attack consideration, but it is not valid as far as I can tell so remove it.

Have any security considerations that are part of the message been enforced (as specified by the application or crit parameter)?  There are a large number of algorithms presented in this document that use nonce values.  For all of the nonces defined in this document, there is some type of restriction on the nonce being a appropriate table when we defined what a 'kty' is so they have had a chance to find out what 'OKP' is.  If we did this we would need to do it for all of the different values that show up here.


Elements after this point are dependent on the specific message type.  Identification of which type of message has been presented is done by the following method: not going to be included in a cryptographic computation.  This bucket is encoded in the message as a binary object.  This value is obtained by CBOR encoding the protected map and wrapping it in <del> a bstr object.  Senders SHOULD encode an empty protected map as a zero length binary object (i.e., the byte string h'a0').  This encoding is used because it is both shorter and the version used in the serialization structures for cryptographic computation. Recipients MUST accept both a zero length binary value and a zero length map encoded in the binary value.  The wrapping allows for the encoding of the protected map to be transported with a greater chance that it will not be altered in transit.  (Badly behaved intermediates could decode and re-encode, but this will result in a failure to verify unless the re-encoded byte string is identical to the decoded byte string.)  This avoids the problem of all parties needing to be able to do a common canonical encoding. </del>  Contains parameters about the current layer that are not cryptographically protected. Integer labels in the range of 0 to 8 SHOULD be omitted. <del> Integer labels in the range -1 to -255 can be omitted as they </del>  are algorithm dependent.  If an application can correctly process an algorithm, it can be assumed that it will correctly process all of the common parameters associated with that <del> algorithm.  (The algorithm range is -1 to -65536; the higher end is for more optional algorithm specific items.) </del>  Labels for parameters required for an application MAY be omitted.  Applications should have a statement if the label can find the correct one.  The internal structure of 'kid' values is not defined and cannot be relied on by applications.  Key identifier values are hints about which key to use.  This is not a <del> security critical field.  For this reason, it SHOULD be placed in the unprotected headers bucket. </del>  This parameter holds the Initialization Vector (IV) value.  For some symmetric encryption algorithms this may be referred to as a nonce.  As the IV is authenticated by the encryption process, it <del> SHOULD be placed in the unprotected header bucket. </del>  This parameter holds a part of the IV value.  When using the COSE_Encrypt0 structure, a portion of the IV can be part of the as described in header-parameters. <del> contains the encrypted key encoded as a bstr.  If there is not an encrypted key, then this field is encoded as a nil value. </del>  contains an array of recipient information structures.  The type for the recipient information structure is a COSE_recipient.  (An

Some more edits in response to the review. Does not include one item that was proposed for clarification

Elements after this point are dependent on the specific message type. <ins> COSE messages are also built using the concept of using layers to separate different types of cryptographic concepts.  As an example of how this works consider the COSE_Encrypt message (EnvelopedData). This message type is broken into two layers: the content layer and the recipient layer.  In the content layer, the plain text is encrypted and information about the encrypted message are placed.  In the recipient layer, the content encryption key (CEK) is encrypted and information about how it is encrypted for each recipient is placed.  A single layer version of the encryption message COSE_Encrypt0 (EnvelopedData0) is provided for cases where the CEK is pre-shared. </ins> Identification of which type of message has been presented is done by the following method: not going to be included in a cryptographic computation.  This bucket is encoded in the message as a binary object.  This value is obtained by CBOR encoding the protected map and wrapping it in  <ins> a bstr object.  Senders SHOULD encode an zero length map as a zero length string rather than as a zero length map (encoded as h'a0'). The zero length binary encoding is preferred because it is both shorter and the version used in the serialization structures for cryptographic computation.  After encoding the map the value is wrapped in the binary object.  Recipients MUST accept both a zero length binary value and a zero length map encoded in the binary value.  The wrapping allows for the encoding of the protected map to be transported with a greater chance that it will not be altered in transit.  (Badly behaved intermediates could decode and re-encode, but this will result in a failure to verify unless the re-encoded byte string is identical to the decoded byte string.) This avoids the problem of all parties needing to be able to do a common canonical encoding. </ins> Contains parameters about the current layer that are not cryptographically protected. Integer labels in the range of 0 to 8 SHOULD be omitted.  <ins> Integer labels in the range -1 to -128 can be omitted as they </ins> are algorithm dependent.  If an application can correctly process an algorithm, it can be assumed that it will correctly process all of the common parameters associated with that  <ins> algorithm.  Integer labels in the range -129 to -65536 SHOULD be included as these would be less common parameters that might not be generally supported. </ins> Labels for parameters required for an application MAY be omitted.  Applications should have a statement if the label can find the correct one.  The internal structure of 'kid' values is not defined and cannot be relied on by applications.  Key identifier values are hints about which key to use.  This is not a  <ins> security critical field.  For this reason, it can be placed in the unprotected headers bucket. </ins> This parameter holds the Initialization Vector (IV) value.  For some symmetric encryption algorithms this may be referred to as a nonce.  As the IV is authenticated by the encryption process, it  <ins> can be placed in the unprotected header bucket. </ins> This parameter holds a part of the IV value.  When using the COSE_Encrypt0 structure, a portion of the IV can be part of the as described in header-parameters.  <ins> contains the encrypted key encoded as a bstr.  All encoded keys are symetric keys, the binary value of the key is the content.  If there is not an encrypted key, then this field is encoded as a nil value. </ins> contains an array of recipient information structures.  The type for the recipient information structure is a COSE_recipient.  (An


3. The signature structure allows for one or more signatures to be <del> applied to a message payload.  There are provisions for there to be attributes about the content and about the signature to be carried </del>  along with the signature itself.  These attributes may be authenticated by the signature, or just present.  Examples of attributes about the content would be the type of content, when the include signatures generated with the RSA signature algorithm and with the Elliptic Curve Digital Signature Algorithm (ECDSA) signature algorithm.  This allows recipients to verify the signature associated <del> with one algorithm or the other.  (Source of text is RFC5652.) More detailed information on multiple signature evaluation can be found in RFC5752. </del>  <del> The CDDL grammar structure for a signature is: ~~~~ COSE_Sign : { protected : bstr | null; unprotected : map(tstr) | null; payload : bstr | null; signatures: COSE_signature_a* | COSE_signature; } ~~~~ </del>  The fields is the structure have the following semantics: transported without changes. is either a single signature or an array of signature values. <del> It is legal to use the array of signature values for a single signature. Implementations MUST be able to parse both layouts. </del>  The fields is the structure have the following semantics: contains the computed signature value.  How to compute a signature: Create a Sig_structure object and populate it with the appropriate fields. <del> Create the value to be hashed by encode the Sig_structure to a </del>  byte string. Sign the hash encoding both the content and the keys using the various key management techniques, is a requirement that all of the key management techniques use an Authenticated Encryption (AE) algorithm. <del> When encrypting the plain text, it is normal to use an Authenticated Encryption with Additional Data (AEAD) algorithm.  For key management, either AE or AEAD algorithms can be used.  See AE-algo for more details about the different types of algorithms. The structure has two maps where data about the content can be placed.  The data placed here is also the data which is used to control how the decryption is to be done for this object.  When data is placed in these two structures, it is extremely poor practice to have data which is applicable to a different level.  For example, the unprotected field at the level of a key management decryption should not contain information either about how to interpret the plain text (i.e. content type) or how to convert the cipher text back to plain text (i.e. the kid for the recipient). </del>  Description of the fields: in CBOR as a 'bstr' if present and the value 'null' if there is no data.  The contents of the protected field is a CBOR map of the protected data names and values.  The map is CBOR encoded before <del> placing it into the bstr. </del>  contains information about the plain text that is not integrity protected.  If there are no field, then the value 'null' is used.  contains the initialization vector (IV), or it's equivalent, if one is needed by the encryption algorithm.  If there is no IV, is encoded here. contains the recipient information.  The field can have one of <del> three values.  * An array of COSE_Encrypt elements, one for each recipient.  * A single COSE_Element, encoded as an extension to the containing COSE_element, for a single recipient.  Single recipients can be encoded either this way or as a single array element.  * A 'null' value if there are no recipients. </del>  4.1. Any item which is integer encoded in JWK, is int encoded for COSE. <del> Any item which is string (but not base64) encoded in JWK, is tstr encoded for COSE. </del> 9. <del> There are security considertions: </del>  Protect private keys Use of direcct ECDH direct encryption is easy for people to leak information on if there are other recipients in the message.  Editorial Comments [CREF3] JLS: Do we defined a cku as well?

Add new tables to the end of the document about parameters which talk about types and possible column for integer indexes in the future

3. The signature structure allows for one or more signatures to be  <ins> applied to a message payload.  There are provisions for attributes about the content and attributes about the signature to be carried </ins> along with the signature itself.  These attributes may be authenticated by the signature, or just present.  Examples of attributes about the content would be the type of content, when the include signatures generated with the RSA signature algorithm and with the Elliptic Curve Digital Signature Algorithm (ECDSA) signature algorithm.  This allows recipients to verify the signature associated  <ins> with one algorithm or the other.  (Source of text is RFC5652.)  More detailed information on multiple signature evaluation can be found in RFC5752. </ins>  <ins> The CDDL grammar structure for a signature message is: </ins> The fields is the structure have the following semantics: transported without changes. is either a single signature or an array of signature values.  <ins> A single signature value can be represented using either data type.  Implementations MUST be able to parse both data types. The CDDL grammar structure for a signature is: </ins> The fields is the structure have the following semantics: contains the computed signature value. <ins> The COSE structure used to create the byte stream to be signed uses the following CDDL grammar structure: </ins> How to compute a signature: Create a Sig_structure object and populate it with the appropriate fields.  <ins> Create the value to be hashed by encoding the Sig_structure to a </ins> byte string. Sign the hash encoding both the content and the keys using the various key management techniques, is a requirement that all of the key management techniques use an Authenticated Encryption (AE) algorithm.  <ins> (For the purpose of this document we use a slightly loose definition of AE algorithms.)  When encrypting the plain text, it is normal to use an Authenticated Encryption with Additional Data (AEAD) algorithm.  For key management, either AE or AEAD algorithms can be used.  See AE-algo for more details about the different types of algorithms. The CDDL grammar structure for encryption is: </ins> Description of the fields: in CBOR as a 'bstr' if present and the value 'null' if there is no data.  The contents of the protected field is a CBOR map of the protected data names and values.  The map is CBOR encoded before  <ins> placing it into the bstr.  Only values associated with the current cipher text are to be placed in this location even if the value would apply to multiple recipient structures. </ins> contains information about the plain text that is not integrity protected.  If there are no field, then the value 'null' is used. <ins> Only values associated with the current cipher text are to be placed in this location even if the value would apply to multiple recipient structures. </ins> contains the initialization vector (IV), or it's equivalent, if one is needed by the encryption algorithm.  If there is no IV, is encoded here. contains the recipient information.  The field can have one of  <ins> three types: An array of COSE_Encrypt elements, one for each recipient. A single COSE_Element, encoded as an extension to the containing COSE_element, for a single recipient.  Single recipients can be encoded either this way or as a single array element. A 'null' value if there are no recipients. </ins> 4.1. Any item which is integer encoded in JWK, is int encoded for COSE.  9.  <ins> There are security considerations: </ins> Protect private keys Use of direcct ECDH direct encryption is easy for people to leak information on if there are other recipients in the message. <ins> Considerations about protected vs unprotected header fields. </ins> Editorial Comments [CREF3] JLS: Do we defined a cku as well?


view. Switch from using a map to using an array at the message level. <del> While this change means that it is no longer possible to new named parameters to the top level message, it also means that there is not a need to define how older implementations are defined to behave when new fields are present.  Most of the reasons that a new field would need to be defined are adequately addressed by defining a new parameter instead. </del>  Signed messages separate the concept of protected and unprotected attributes that are for the content and the signature. structures are used for the plain text and for the different key management techniques. <del> One of the by products of using the same technique for encrypting and </del>  encoding both the content and the keys using the various key management techniques, is a requirement that all of the key management techniques use an Authenticated Encryption (AE) algorithm. and place in the protected field of the Enc_structure and the COSE_Encrypt structure. <del> Copy the add field from the COSE_Encrypt structure to the </del>  Enc_Structure. Encode the Enc_structure using a CBOR Canonical encoding CBOR- Canonical to get the AAD value. <del> Encrypt the plain text and place it in the ciphertext field.  The AAD value is passed in as part of the encryption process. </del>  For recipient of the message, recursively perform the encryption algorithm for that recipient using the encryption key as the plain 4.3. <del> Verify that the protected field is empty. </del>  <del> Verify that the aad field is empty. </del>  <del> Encrypt the plain text and place in the ciphertext field. </del>  5.

The majority of changes prior to the examples section are to address typos or what I saw as inconsistencies. I will admit I wasn't as diligent as I should have been on those, but I need to take another pass on the document. The examples were reformatted to minimize side scrolling -- and likely fit within the TXT representation.

view. Switch from using a map to using an array at the message level.  <ins> While this change means that it is no longer possible to add new named parameters to the top level message, it also means that there is not a need to define how older implementations are defined to behave when new fields are present.  Most of the reasons that a new field would need to be defined are adequately addressed by defining a new parameter instead. </ins> Signed messages separate the concept of protected and unprotected attributes that are for the content and the signature. structures are used for the plain text and for the different key management techniques.  <ins> One of the byproducts of using the same technique for encrypting and </ins> encoding both the content and the keys using the various key management techniques, is a requirement that all of the key management techniques use an Authenticated Encryption (AE) algorithm. and place in the protected field of the Enc_structure and the COSE_Encrypt structure.  <ins> Copy the 'aad' field from the COSE_Encrypt structure to the </ins> Enc_Structure. Encode the Enc_structure using a CBOR Canonical encoding CBOR- Canonical to get the AAD value.  <ins> Encrypt the plain text and place it in the 'ciphertext' field. The AAD value is passed in as part of the encryption process. </ins> For recipient of the message, recursively perform the encryption algorithm for that recipient using the encryption key as the plain 4.3.  <ins> Verify that the 'protected' field is empty. </ins>  <ins> Verify that the 'aad' field is empty. </ins>  <ins> Encrypt the plain text and place in the 'ciphertext' field. </ins> 5.


this structure does not preclude a protocol to use one of the individual structures as a stand alone component. <del> This structure is encoded as an array by CBOR.  Descriptions of the fields: indicates which of the security structures is in this block. contains the top level fields for the security service provided. The type in this field is based on the value of the field msg_type. msg_type 1 is used for COSE_sign msg_type 2 is used for COSE_encrypt msg_type 3 is used for COSE_mac </del>  3.

Fix some additional errors found in the CDDL descriptions. It is still not completely correct so automatic testing is not turned on yet. Also some of the examples were out of date to the expected syntax so they got some updates.

this structure does not preclude a protocol to use one of the individual structures as a stand alone component.  <ins> The top level of each of the COSE message structures are encoded as arrays. We use an integer to distingish bettwen the different security message types.  By looking at the integer in the first element, one can determine which security message is being used and thus what the syntax is for the rest of the elements in the array. Implementations SHOULD be prepared to find an integer in the location which does not correspond to the values 0 to 2.  If this is found then the client MUST stop attempting to parse the structure and fail. Clients need to recognize that the set of values could be extended at a later date, but should not provide a security service based on guesses of what is there. NOTE: Alternative syntax with tags would be Where we would need to define the latter two as tagged arrays like is currently done for COSE_SignedMessage. There is no space savings in CBOR, this is strictly about using CBOR paradymes.  It is not clear what would happen if a JOSE serialization appeared, but that is probably not interesting.  If this path is used, then there is no extensibility for new messages types.  They would need to be defined on their own. </ins> 3.


Remove the authentiction tag for encryption algorithms as a separate item.  1.2. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", the responsibility of the application to ensure that it will be transported without changes. <del> is either a single signature or an array of signature values. A single signature value can be represented using either data type.  Implementations MUST be able to parse both data types. </del>  The CDDL grammar structure for a signature is: encryption process (i.e. detached content) then the value 'nil' is encoded here. <del> contains the recipient information.  The field can have one of three data types: </del>  An array of COSE_encrypt elements, one for each recipient. <del> A single COSE_encrypt element, encoded as an extension to the containing COSE_encrypt element, for a single recipient.  Single recipients can be encoded either this way or as a single array element. </del> A 'nil' value if there are no recipients. 4.1.

Following discussions on the mailing list. Removing the ability to have flattened encoding for signers and recipients.
Closes issue
JOSE now allows for a single recipient to be encoded at the same level as the content. While COSE does not allow for quite the same way of encoding this it would be possible to do something similar. Current syntax is "recipients : COSEencrypta null;" Do so would allow for a single recipient to be appended to the end of the current array of values rather than creating two array sub-encodings in CBOR. This encoding saves 2 bytes in the event of a single recipient at the expense of needing to pass in an offset in the array structure when parsing it. Not really that hard to do from a programmers point of view.
Open for group discussion
Based on the messages, there seems to be no support for combining the two maps together into a single map. I have therefore removed that from my working copy of the draft. There was one request for allowing option b (where a single recipient can be represented as a single map entry rather than as an array of a single map). I have looked at code size, and there does not seem to be a lot of code associated with this option, but as there was no outcry for this option I have not included it. Unless others have opinions that they believe need to be expressed, I am closing this issue.

Remove the authentiction tag for encryption algorithms as a separate item. <ins> Remove the flattened mode of encoding.  Forcing the use of an array of recipients at all times forces the message size to be two bytes larger, but one gets a corresponding decrease in the implementation size that should compenstate for this. </ins> 1.2. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", the responsibility of the application to ensure that it will be transported without changes.  <ins> is an array of signature items.  Each of these items uses the COSE_signature structure for its representation. </ins> The CDDL grammar structure for a signature is: encryption process (i.e. detached content) then the value 'nil' is encoded here.  <ins> contains the recipient information.  The field can have one of two data types: </ins> An array of COSE_encrypt elements, one for each recipient.  A 'nil' value if there are no recipients. 4.1.


a later date, but should not provide a security service based on guesses of what is there. <del> NOTE: Alternative syntax with tags would be Where we would need to define the latter two as tagged arrays like is currently done for COSE_SignedMessage. There is no space savings in CBOR, this is strictly about using CBOR paradymes.  It is not clear what would happen if a JOSE serialization appeared, but that is probably not interesting.  If this path is used, then there is no extensibility for new messages types.  They would need to be defined on their own. </del> 3. The signature structure allows for one or more signatures to be 8. <del> There are IANA considerations to be filled in. </del>  9.

Fix install instructions in the README for kramdown-xml2rfc Update COSE spec for tagging discussion Update Issues document for closed and newly opened discussion issues.
Carsten has suggested that we could eliminate the need for the COSE_MSG structure if we were to get tags assigned from CBOR for these structures. Should this be done?
a) CBOR Tag - either general or specific to each type b) Required Identifier c) Use the same techniques as JOSE There was no support for option C. There was support for Option B There was some support for Option A, but only if it was optional. Mike Jones suggested that we should use the header parameter 'typ', I responded to this message saying that it was not clear that this was a correct use of the field based on the description in the JWS document. At this point I will keep the field as mandatory and outside of the headers field. I am planning on doing the IANA request for a CBOR Tag and to keep the tag as being optional in the grammar and text.
Closed in Pull request

a later date, but should not provide a security service based on guesses of what is there.  3. The signature structure allows for one or more signatures to be 8.  <ins> 8.1. It is requested that IANA assign a new tag from the "Concise Binary Object Represetion (CBOR) Tags" registry.  It is requested that the tag be assigned in the 0 to 23 value range. Tag Value: TBD1 Data Item: CBOR map Semantics: COSE security message. </ins> 9.


not going to be included in a cryptographic computation.  This bucket is encoded in the message as a binary object.  This value is obtained by CBOR encoding the protected map and wrapping it in <del> a bstr object.  This wrapping allows for the encoding of the </del>  protected map to be transported with a greater chance that it will not be altered in transit.  (Badly behaved intermediates could decode and re-encode, but this will result in a failure to verify origination.  (One cannot, for example, be used to prove the identity of the sender to a third party.)  MAC algorithms can be based on either a block cipher algorithm (i.e. AES-MAC) or a hash algorithm (i.e.  HMAC).  This document defines a MAC algorithm for each of these two constructions. 10.  10.1. The GCM mode is is a generic authenticated encryption block cipher 11.  11.1. The HKDF key derivation algorithm is defined in RFC5869.

Add more intro text to algorithms Put in a note about the fact that a zero length map is not the preferred encoding for the protected field, but is a legal one.

not going to be included in a cryptographic computation.  This bucket is encoded in the message as a binary object.  This value is obtained by CBOR encoding the protected map and wrapping it in  <ins> a bstr object.  Senders SHOULD encode an empty protected map as a zero length binary object (it is shorter).  Recipients MUST accept both a zero length binary value and a zero length map encoded in the binary value.  The wrapping allows for the encoding of the </ins> protected map to be transported with a greater chance that it will not be altered in transit.  (Badly behaved intermediates could decode and re-encode, but this will result in a failure to verify origination.  (One cannot, for example, be used to prove the identity of the sender to a third party.) <ins> MACs are designed in the same basic structure as signature with appendix algorithms.  The message content is processed and an authentication code is produced, the authentication code is frequently called a tag.  The basic structure becomes: </ins> MAC algorithms can be based on either a block cipher algorithm (i.e. AES-MAC) or a hash algorithm (i.e.  HMAC).  This document defines a MAC algorithm for each of these two constructions. 10. <ins> Content Encryption Algorithms provide data confidentialty for potentially large blocks of data using a symmetric key.  They provide either no or very limited data origination.  (One cannot, for example, be used to prove the identity of the sender to a third party.)  The ability to provide data origination is linked to how the symmetric key is obtained. We restrict the set of legal content encryption algorithms to those which support authentication both of the content and additional data. The encryption process will generate some type of authentication value, but that value may be either explicit or implicit in terms of the algorithm definition.  For simplicity sake, the authentication code will normally be defined as being appended to the cipher text stream.  The basic structure becomes: Most AEAD algorithms are logically defined as returning the message content only if the decryption is valid.  Many but not all implementations will follow this convention.  The message content MUST NOT be used if the decryption does not validate. </ins> 10.1. The GCM mode is is a generic authenticated encryption block cipher 11. <ins> Key Derivation Functions (KDFs) are used to take some secret value and generate a different one.  The original secret values come in three basic flavors: Secrets which are uniformly random: This is the type of secret which is created by a good random number generator. Secrets which are not uniformly random: This is type of secret which is created by operations like key agreement. Secrets which are not random: This is the type of secret that people generate for things like passwords. General KDF functions work well with the first type of secret, can do reasonable well with the second type of secret and generally do poorly with the last type of secret.  None of the KDF functions in this section are designed to deal with the type of secrets that are used for passwords.  Functions like PBSE2 RFC2898 need to be used for that type of secret. Many functions are going to handle the first two type of secrets differently.  The KDF function defined in HKDF can use different underlying constructions if the secret is uniformly random than if the secret is not uniformly random.  This is reflected in the set of algorithms defined for HKDF. When using KDF functions, one component that is generally included is context information.  Context information is used to allow for different keying information to be derived from the same secret.  The use of context based keying material is considered to be a good security practice.  This document defines a single context structure and a single KDF function. </ins> 11.1. The HKDF key derivation algorithm is defined in RFC5869.


12.4.1. The basic mathematics for Elliptic Curve Diffie-Hellman can be found <del> in RFC6090.  Two new curves have been defined in I-D.irtf-cfrg- curves. </del>  ECDH is parameterized by the following: in table-ecdh-es-table. This document defines these algorithms to be used with the curves <del> P-256, P-384, P-521, X25519 and X448.  Implementations MUST verify that the key type and curve are correct, different curves are restricted to different key types.  Implementations MUST verify that the curve and algorithm are appropriate for the entities involved. </del>  12.5. 13.1. <del> Two different key structures are being defined for Elliptic Curve </del>  keys.  One version uses both an x and a y coordinate, potentially with point compression.  This is the traditional EC point representation that is used in RFC5480.  The other version uses only the x coordinate as the y coordinate is either to be recomputed or <del> not needed for the key agreement operation.  An example of this is Curve25519 I-D.irtf-cfrg-curves.  [CREF13] </del>  13.1.1. <del> One class of Elliptic Curve mathematics allows for a point to be completely defined using the curve and the x coordinate of the point on the curve.  The two curves that are initially setup to use is point format are Curve 25519 and Curve 448 which are defined in I- D.irtf-cfrg-curves. For EC keys with only the x coordinates, the 'kty' member is set to 1 (EC1).  The key parameters defined in this section are summarized in table-ec1-keys.  The members that are defined for this key type are: contains an identifier of the curve to be used with the key. [CREF14] The curves defined in this document for this key type can be found in table-ec-curves.  Other curves may be registered in the future and private curves can be used as well. contains the x coordinate for the EC point.  The octet string represents a little-endian encoding of x. contains the private key. For public keys, it is REQUIRED that 'crv' and 'x' be present in the structure.  For private keys, it is REQUIRED that 'crv' and 'd' be present in the structure.  For private keys, it is RECOMMENDED that 'x' also be present, but it can be recomputed from the required elements and omitting it saves on space. 13.1.2. </del> The traditional way of sending EC curves has been to send either both the x and y coordinates, or the x coordinate and a sign bit for the y coordinate.  The latter encoding has not been recommend in the IETF contains the x coordinate for the EC point.  The integer is converted to an octet string as defined in SEC1.  Zero octets MUST <del> NOT be removed from the front of the octet string.  [CREF15] </del>  contains either the sign bit or the value of y coordinate for the EC point.  For the value, the integer is converted to an octet This document defines a key structure for both the public and private halves of RSA keys.  Together, an RSA public key and an RSA private <del> key form an RSA key pair.  [CREF16] </del>  The document also provides support for the so-called "multi-prime" RSA where the modulus may have more than two prime factors.  The if one exists This registry will be initially populated by the values in table- <del> ec1-keys, table-ec2-keys, table-rsa-keys, and table-symmetric-keys. The specification column for all of these entries will be this document. </del>  15.7. 15.8.1. This section registers the "application/cose" and "application/ <del> cose+cbor" media types in the "Media Types" registry.  [CREF17] These </del>  media types are used to indicate that the content is a COSE_MSG. Type name: application fields defined in the table are transported and thus why they have labels. <del> [CREF13] Ilari: Check to see what the curves are renamed to during final publishing.  It appears to be X25519 now. [CREF14] JLS: Do we create a registry for curves?  Is is the same registry for both EC1 and EC2? [CREF15] JLS: Should we use the bignum encoding for x, y and d instead </del>  of bstr? <del> [CREF16] JLS: Looking at the CBOR specification, the bstr that we are </del>  looking in our table below should most likely be specified as big numbers rather than as binary strings.  This means that we would use the tag 6.2 instead.  From my reading of the the resulting output.  The specification of bignum does explicitly allow for integers encoded with leading zeros. <del> [CREF17] JLS: Should we register both or just the cose+cbor one? </del>

The CFRG EC algorithms are currently too far in the future to keep. Remove the ad put in the to be done later document.

12.4.1. The basic mathematics for Elliptic Curve Diffie-Hellman can be found  <ins> in RFC6090. </ins> ECDH is parameterized by the following: in table-ecdh-es-table. This document defines these algorithms to be used with the curves  <ins> P-256, P-384, P-521.  Implementations MUST verify that the key type and curve are correct, different curves are restricted to different key types.  Implementations MUST verify that the curve and algorithm are appropriate for the entities involved. </ins> 12.5. 13.1.  <ins> Two different key structures could be defined for Elliptic Curve </ins> keys.  One version uses both an x and a y coordinate, potentially with point compression.  This is the traditional EC point representation that is used in RFC5480.  The other version uses only the x coordinate as the y coordinate is either to be recomputed or  <ins> not needed for the key agreement operation Currently no algorithms are defined using this key structure. </ins> 13.1.1.  The traditional way of sending EC curves has been to send either both the x and y coordinates, or the x coordinate and a sign bit for the y coordinate.  The latter encoding has not been recommend in the IETF contains the x coordinate for the EC point.  The integer is converted to an octet string as defined in SEC1.  Zero octets MUST  <ins> NOT be removed from the front of the octet string.  [CREF13] </ins> contains either the sign bit or the value of y coordinate for the EC point.  For the value, the integer is converted to an octet This document defines a key structure for both the public and private halves of RSA keys.  Together, an RSA public key and an RSA private  <ins> key form an RSA key pair.  [CREF14] </ins> The document also provides support for the so-called "multi-prime" RSA where the modulus may have more than two prime factors.  The if one exists This registry will be initially populated by the values in table-  <ins> ec2-keys, table-rsa-keys, and table-symmetric-keys.  The specification column for all of these entries will be this document. </ins> 15.7. 15.8.1. This section registers the "application/cose" and "application/  <ins> cose+cbor" media types in the "Media Types" registry.  [CREF15] These </ins> media types are used to indicate that the content is a COSE_MSG. Type name: application fields defined in the table are transported and thus why they have labels.  <ins> [CREF13] JLS: Should we use the bignum encoding for x, y and d instead </ins> of bstr?  <ins> [CREF14] JLS: Looking at the CBOR specification, the bstr that we are </ins> looking in our table below should most likely be specified as big numbers rather than as binary strings.  This means that we would use the tag 6.2 instead.  From my reading of the the resulting output.  The specification of bignum does explicitly allow for integers encoded with leading zeros.  <ins> [CREF15] JLS: Should we register both or just the cose+cbor one? </ins>


This section registers the "application/cose" and "application/ cose+cbor" media types in the "Media Types" registry.  [CREF11] These media types are used to indicate that the content is a COSE_MSG.  Type name: application Provisional registration?  No  16. There are security considerations: explicitly allow for integers encoded with leading zeros. [CREF11] JLS: Should we register both or just the cose+cbor one?

Create IANA considerations for: 1) key and keyset CBOR tags 2) COAP Content Format registrations

This section registers the "application/cose" and "application/ cose+cbor" media types in the "Media Types" registry.  [CREF11] These media types are used to indicate that the content is a COSE_MSG. <ins> [CREF12] </ins> Type name: application Provisional registration?  No <ins> 15.9. This section registers a set of content formats for CoAP.  ID assignment in the 24-255 range requested. </ins> 16. There are security considerations: explicitly allow for integers encoded with leading zeros. [CREF11] JLS: Should we register both or just the cose+cbor one? <ins> [CREF12] JLS: Should we create the equivalent of the smime-type parameter to identify the inner content type? </ins>