Subject: [COSE] Security Considerations

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 31 Aug 2015 09:51:35 +0200

Hi Jim, Hi Brian,

In Section 8 "Signature Algorithms", Section 9 "Message Authentication
(MAC) Algorithms", and Section 10 "Content Encryption Algorithms"
contain algorithm descriptions. Each algorithm description comes with a
security consideration section.

Since the COSE specification is just a consumer of already standardized
cryptographic algorithms I am wondering whether the security
considerations are needed since their content should already be
available with the documents that specify the algorithm.

Ciao
Hannes

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 31 Aug 2015 11:07:01 -0700

> -----Original Message-----
> From: COSE [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
> Sent: Monday, August 31, 2015 12:52 AM
> To: [email-masked]
> Subject: [COSE] Security Considerations
> 
> Hi Jim, Hi Brian,
> 
> contain algorithm descriptions. Each algorithm description comes with a security
> consideration section.
> 
> cryptographic algorithms I am wondering whether the security considerations
> are needed since their content should already be available with the documents
> that specify the algorithm.

Strictly speaking, no it does not need to be there.  However, I believe that it serves a useful purpose as it summarizes some of the security considerations that need to be taken into account when choosing which algorithm is going to be used by an application.  I think that putting it into a per algorithm, rather than doing a big summary of some type at the bottom, makes it clearer which items are applicable to those items.

I believe that it should be kept.

Jim