Subject: [COSE] Roman Danyliw's Discuss on draft-ietf-cose-rfc8152bis-struct-10: (with DISCUSS and COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Mon, 08 Jun 2020 19:08:06 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-cose-rfc8152bis-struct-10: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cose-rfc8152bis-struct/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Are the wrong data structures being referenced or did I misunderstand something?

** Section 5.  Per “Abbreviated counter signatures use the structure
COSE_Countersign1”, this doesn’t seem consistent with the more detailed
write-up in Section 5.2 which says that “The byte string representing the
signature value is placed in the CounterSignature0 attribute”.  The document
makes no other reference to COSE_Countersign1.

The shepherd write-up notes that ‘one item to note is the decision to keep the
context string "COSE_Countersign1" for abbreviated countersignatures’. 
However, I found no such reference in Step 1 of Section 4.4 (page 22) which
enumerated the possible strings.

** What is the intended name of the structure for the Counter Signature -- is
it COSE_Countersignature or COSE_Countersign?

-- Table 1, Section 2, Section 4.4 and Section 5.1 (to include the CDDL)
reference COSE_Countersignature

but
-- Section 5. Per “Full counter signatures use the structure COSE_Countersign …”

-- Section 5.1.  Per “A tagged COSE_Countersign structure …”

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for making an easy to read and compare bis document.

** Section 4.4.  Per the the following item in the list, ‘"CounterSignature"
for signatures used as counter signature attributes.’, can this be more
precisely stated as to reference the particular COSE_* data type?  The other
items in this list are more precise in naming the corresponding
structure/attributes.

---

From: Jim Schaad <[email-masked]>
Date: Mon, 8 Jun 2020 21:17:13 -0700

-----Original Message-----
From: Roman Danyliw via Datatracker <[email-masked]> 
Sent: Monday, June 8, 2020 7:08 PM
To: The IESG <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; Matthew Miller <[email-masked]>; [email-masked]
Subject: Roman Danyliw's Discuss on draft-ietf-cose-rfc8152bis-struct-10: (with DISCUSS and COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

** Section 5.  Per “Abbreviated counter signatures use the structure COSE_Countersign1”, this doesn’t seem consistent with the more detailed write-up in Section 5.2 which says that “The byte string representing the signature value is placed in the CounterSignature0 attribute”.  The document makes no other reference to COSE_Countersign1.
[JLS] I added a CDDL type of COSE_CounterSignature0 and refer to it now.

The shepherd write-up notes that ‘one item to note is the decision to keep the context string "COSE_Countersign1" for abbreviated countersignatures’. 
However, I found no such reference in Step 1 of Section 4.4 (page 22) which enumerated the possible strings.
[JLS] The write-up has it backwards.  The question was change '0' to '1' and the decision was made not to do so.

** What is the intended name of the structure for the Counter Signature -- is it COSE_Countersignature or COSE_Countersign?

-- Table 1, Section 2, Section 4.4 and Section 5.1 (to include the CDDL) reference COSE_Countersignature

but

[JLS] All is now made consistent to COSE_Countersignature and COSE_Countersignature0

** Section 4.4.  Per the the following item in the list, ‘"CounterSignature"
for signatures used as counter signature attributes.’, can this be more precisely stated as to reference the particular COSE_* data type?  The other items in this list are more precise in naming the corresponding structure/attributes.

[JLS] Both of the countersignature now refer to CDDL types and a new type is defined for COSE_Countersignature0 so that it can be referred to here and in the attribute table.  

Additionally, I update the IANA considerations to reflect the change in the type of the CounterSignature0 attribute.

---

From: Roman Danyliw <[email-masked]>
Date: Tue, 9 Jun 2020 13:03:25 +0000

Hi Jim!

> From: Jim Schaad <[email-masked]>
> Sent: Tuesday, June 9, 2020 12:17 AM
> To: Roman Danyliw <[email-masked]>; 'The IESG' <[email-masked]>
> Cc: [email-masked]; [email-masked];
> [email-masked]; 'Matthew Miller' <[email-masked]>
> Subject: RE: Roman Danyliw's Discuss on draft-ietf-cose-rfc8152bis-struct-10:
> (with DISCUSS and COMMENT)
> 
> 
> 
> Cc: [email-masked]; [email-masked];
> [email-masked]; Matthew Miller <[email-masked]>;
> [email-masked]
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 

Thanks for this update.  That's what I thought it should say based on the details in Section 5.2

> ** What is the intended name of the structure for the Counter Signature -- is it
> COSE_Countersignature or COSE_Countersign?
> 

Makes sense.  Thanks for making this update.

> for signatures used as counter signature attributes.’, can this be more precisely
> stated as to reference the particular COSE_* data type?  The other items in this
> list are more precise in naming the corresponding structure/attributes.
> 
> [JLS] Both of the countersignature now refer to CDDL types and a new type is
> defined for COSE_Countersignature0 so that it can be referred to here and in
> the attribute table.

Thanks.

> of the CounterSignature0 attribute.

Good catch.  That needed to be done too.  

Regards,
Roman