Subject: [COSE] Issue: Use CBOR array rather than concatenation to build strings to hash/MAC

From: "Jim Schaad" <[email-masked]>
Date: Mon, 3 Aug 2015 08:22:04 -0700

JOSE concatenates the fields together that are used for doing integrity
protection.  The current document uses a CBOR array to do the same thing.

The use of CBOR array does require a small amount of canonical encoding.
However the only thing that is required is minimum length encoding of
fields.  This  should be simple for people to implement.
Everything else is just binary wrapped.  The method used does enforce fences
between the different fields to prevent data bleeding between fields.

Are there any objections to this approach?

---

From: Mike Jones <[email-masked]>
Date: Mon, 3 Aug 2015 18:33:35 +0000

I think it's a good idea to concatenate all the integrity protected fields together in the COSE representation.  That saves having to create a separate concatenation for input to the signature or MAC function.

				-- Mike

-----Original Message-----
From: COSE [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Monday, August 03, 2015 8:22 AM
To: [email-masked]
Subject: [COSE] Issue: Use CBOR array rather than concatenation to build strings to hash/MAC

JOSE concatenates the fields together that are used for doing integrity protection.  The current document uses a CBOR array to do the same thing.

The use of CBOR array does require a small amount of canonical encoding.
However the only thing that is required is minimum length encoding of fields.  This  should be simple for people to implement.
Everything else is just binary wrapped.  The method used does enforce fences between the different fields to prevent data bleeding between fields.

_______________________________________________
COSE mailing list
[email-masked]
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40microsoft.com%7c55a34eae7c8a4cb8790008d29c173f31%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=5g2kakSMDHHdFR2Bm09ezMFIR0tC%2fLlG8QrqNLRtB8g%3d

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 3 Aug 2015 12:14:55 -0700

I am unable to process your position.

> From: Mike Jones [mailto:[email-masked]]
> Sent: Monday, August 03, 2015 11:34 AM
> To: Jim Schaad; [email-masked]
> Subject: RE: [COSE] Issue: Use CBOR array rather than concatenation to
build
> strings to hash/MAC
> 
> I think it's a good idea to concatenate all the integrity protected fields
together
> in the COSE representation.  That saves having to create a separate
> concatenation for input to the signature or MAC function.
> 
> 				-- Mike
> 
> Subject: [COSE] Issue: Use CBOR array rather than concatenation to build
strings
> to hash/MAC
fields.
> This  should be simple for people to implement.
> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.
> org%2fmailman%2flistinfo%2fcose&data=01%7c01%7cMichael.Jones%40micro
> soft.com%7c55a34eae7c8a4cb8790008d29c173f31%7c72f988bf86f141af91ab2
> d7cd011db47%7c1&sdata=5g2kakSMDHHdFR2Bm09ezMFIR0tC%2fLlG8QrqNLRt
> B8g%3d

---

From: Derek Atkins <[email-masked]>
Date: Mon, 03 Aug 2015 15:47:48 -0400

> Are there any objections to this approach?

No objection from me.

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Mike Jones <[email-masked]>
Date: Mon, 3 Aug 2015 21:11:10 +0000

If I correctly understood your statement "The current document uses a CBOR array to do the same thing", to mean that COSE now concatenates all the integrity protected fields, then I was writing to support your position.

				-- Mike

-----Original Message-----
From: Jim Schaad [mailto:[email-masked]] 
Sent: Monday, August 03, 2015 12:15 PM
To: Mike Jones; [email-masked]
Subject: RE: [COSE] Issue: Use CBOR array rather than concatenation to build strings to hash/MAC

build
together
strings
> to hash/MAC
> 
> JOSE concatenates the fields together that are used for doing 
> integrity protection.  The current document uses a CBOR array to do the same thing.
> 
fields.

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 3 Aug 2015 16:37:14 -0700

Ok - I was not sure if you were saying that it should be a CBOR array or
just concatenate things together.  The sentence was not clear.  Thanks for
doing the clarification.

> Sent: Monday, August 03, 2015 2:11 PM
build
> strings to hash/MAC
> 
> If I correctly understood your statement "The current document uses a CBOR
> array to do the same thing", to mean that COSE now concatenates all the
> integrity protected fields, then I was writing to support your position.
> 
> 				-- Mike
> 
build
> > integrity protection.  The current document uses a CBOR array to do the
same
> thing.