Subject: [COSE] Removing the MUST for alg being in the COSE protected bucket

From: Jim Schaad <[email-masked]>
Date: Tue, 15 Nov 2016 11:20:02 +0900

I have been having conversations with the IESG trying to get the last
discuss cleared.  I have come up with a change to the text that reduces the
requirement of the algorithm being required to be in the protected header
bucket where it can be protected to a slightly looser requirement.  The
proposed edits can be found here
https://github.com/cose-wg/cose-spec/pull/187. Based on this, I need to know
if there are any objections in the working group.

I debated making changes to Appendix A, but I think we can get away with
just changing the title and leave the text alone.

<no hat>
I am unhappy with this change, but I can live with it.
</no hat>

Jim

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 15 Nov 2016 11:25:51 +0900

Hi Jim,

I believe the new text captures the combined view of the various interested parties very well.

It is harder to test for this new MUST, but it can now be universally required without weird dispensations.  It is also very clear as to what is actually required.

Grüße, Carsten

> On 15 Nov 2016, at 11:20, Jim Schaad <[email-masked]> wrote:
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose
>

---

From: Göran Selander <[email-masked]>
Date: Tue, 15 Nov 2016 05:45:11 +0000

On 2016-11-15 03:25, "COSE on behalf of Carsten Bormann"
<[email-masked] on behalf of [email-masked]> wrote:

>It is harder to test for this new MUST, but it can now be universally
>required without weird dispensations.  It is also very clear as to what
>is actually required.

+1

Göran

---

From: Mike Jones <[email-masked]>
Date: Tue, 15 Nov 2016 06:54:23 +0000

It's not clear to me what this new text means: " This parameter MUST be authenticiated when support is provided by the algorithm (AEAD algorithms) or construction (sign and mac). ".  What kind of support is being referred to?  I think this needs to be clarified.

Nits:
	authenticiated -> authenticated
	isused -> is used
	applications -> application's

				-- Mike

-----Original Message-----
From: COSE [mailto:[email-masked]] On Behalf Of Göran Selander
Sent: Tuesday, November 15, 2016 2:45 PM
To: Carsten Bormann <[email-masked]>; Jim Schaad <[email-masked]>
Cc: Kathleen Moriarty <[email-masked]>; [email-masked]; Stephen Farrell <[email-masked]>
Subject: Re: [COSE] Removing the MUST for alg being in the COSE protected bucket

+1

Göran

>>discuss cleared.  I have come up with a change to the text that 
>>reduces the  requirement of the algorithm being required to be in the 
>>protected header  bucket where it can be protected to a slightly 
>>looser requirement.  The  proposed edits can be found here  
>>https://github.com/cose-wg/cose-spec/pull/187. Based on this, I need 
>>to know  if there are any objections in the working group.
>> 
>> I debated making changes to Appendix A, but I think we can get away 
>> with just changing the title and leave the text alone.
>> 
>> <no hat>