Subject: [COSE] Concat or HKDF, please clarify!

From: Anders Rundgren <[email-masked]>
Date: Wed, 2 Jun 2021 20:43:27 +0200

This is Jim's reference code:
https://github.com/cose-wg/COSE-JAVA/blob/master/src/main/java/COSE/AlgorithmID.java#L54
https://github.com/cose-wg/COSE-JAVA/blob/master/src/main/java/COSE/Recipient.java#L258

This is the IANA registry line for the same algorithm (ECDH-ES+A256KW):
CDH-ES + A256KW    -31    ECDH ES w/ Concat KDF and AES Key Wrap w/ 256-bit key

And this is the RFC:
    | ECDH-ES + | -31   | HKDF -  | yes        | A256KW | ECDH ES w/    |
    | A256KW    |       | SHA-256 |            |        | Concat KDF    |
    |           |       |         |            |        | and AES Key   |
    |           |       |         |            |        | Wrap w/       |
    |           |       |         |            |        | 256-bit key   |

?

Being a developer, I tend to stick to code so I vote for HKDF as the "truth" :)

Thanx,
Anders