Subject: [COSE] Comments on draft-jones-cose-additional-algorithms-00

From: John Mattsson <[email-masked]>
Date: Thu, 21 Mar 2019 16:38:34 +0000

Hi,

The document motivates why these not recommended and deprecated algorithms need to be registered. Well-written.

- "Additional Algorithm Registrations for COSE and JOSE"
Maybe the title could include "WebAuthn", "FIDO2", and/or CTAP

- "These algorithms are registered in the IANA "COSE Algorithms" registry"
The title abstract and intro only mentions algorithms and the algorithms registries. The document also registers a curve in the "IANA "COSE Elliptic Curves" and ""JSON Web Key Elliptic Curve" registries.

- "parameterized with a hash function (h)."
I think the abbreviation h is never use.

- I think the document should do as draft-ietf-cose-hash-algs-00 and have a recommended column in the tables.

- "P-256K"
Do we really need a new name for secp256k1? I would suggest not. Most of the document talks about secp256k1 anyway. Giving secp256k1 the alias P-256K gives the impression that it is a curve standardized by NIST, which it is not.

- "of this document" vs. of [[ this specification ]]

Cheers,
John

---

From: Mike Jones <[email-masked]>
Date: Mon, 25 Mar 2019 16:38:24 +0000

Thanks for the review, John.  Replies are inline below, prefixed by "Mike>".

-----Original Message-----
From: COSE <[email-masked]> On Behalf Of John Mattsson
Sent: Thursday, March 21, 2019 5:39 PM
To: [email-masked]
Subject: [COSE] Comments on draft-jones-cose-additional-algorithms-00

Hi,

Mike> Yes, we could.  There's other feedback on the title from Jim.  We'll discuss what the right title is during the working group meeting in Prague tomorrow.

Mike> Yes, we can say "and associated curves" or something along those lines.

Mike> I'm fine with deleting "(h)".

Mike> Agreed

- "P-256K"

Mike> Others have also suggested simply using the name "secp256k1".  I'm fine with that.

Mike> Thanks - I'll make that change.

Cheers,
John

_______________________________________________
COSE mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cose

Thanks again for the detailed read!

				-- Mike