Subject: Re: [COSE] [cose-issues] make "alg" field optional (#51)

From: Mike Jones <[email-masked]>
Date: Mon, 15 Feb 2016 11:23:39 -0800

I am against making inclusion of the algorithm optional. Among other reasons, doing so would make support for crypto agility more problematic.

---
Reply to this email directly or view it on GitHub:
https://github.com/cose-wg/cose-issues/issues/51#issuecomment-184352968

---

From: Ludwig Seitz <[email-masked]>
Date: Tue, 16 Feb 2016 10:54:36 +0100

On 02/15/2016 08:23 PM, Mike Jones wrote:
> I am against making inclusion of the algorithm optional. Among other
> reasons, doing so would make support for crypto agility more problematic.
>

While I can sympathize with your position in general, in the constrained 
cases (and that's what COSE aims for) crypto agility is not really 
feasible, since you would typically only have one algorithm of every 
type needed implemented on a device.
Replacing a crypto algorithm would then typically require a firmware 
update, removing the old algorithm in the process (to save space).

Therefore I would argue that in those cases it is acceptable to assume 
that the algorithms are known by both communicating parties and that 
they don't need to be specified explicitly.
In the rare cases where a device would not know the algorithms used by 
its communication partner, external discovery mechanisms can provide 
this information, thus offloading the constrained devices from 
performing this task.

Regards,

Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70 349 9251
http://www.sics.se