Subject: Re: [COSE] AD review of draft-ietf-cose-hash-sig-03

From: Russ Housley <[email-masked]>
Date: Thu, 10 Oct 2019 16:24:07 -0400

Roman:

I just posted draft-ietf-cose-hash-sig-04 to handle these comments.
> The following is my AD review of draft-ietf-cose-hash-sig-03:
> 
> ** Section 3.  Per "The signature value is a large byte string.  The byte string is designed for easy parsing, and it includes a counter and type codes that indirectly provide all of the information that is needed to parse the byte string during signature validation."
> -- please propagate the clarifying edits of the form made on the related sentence of Section 3.0 in draft-ietf-lamps-cms-hash-sig (to clarify the exact parameters in the byte string and where this byte string is defined)
Here is the updated text:

   The signature value is a large byte string as described in Section 2.
   The byte string is designed for easy parsing.  The HSS, LMS, and
   LMOTS components of the signature value format include counters and
   type codes that indirectly provide all of the information that is
   needed to parse the byte string during signature validation.
> -- the examples in Appendix A seem to imply a particular formatting (e.g., using the | to separate parameters), this should be clarified in this text
I suggest:

   This appendix provides an example of a COSE full message signature
   and an example of a COSE_Sign0 message.  The display format includes
   "\" to indicate that the same field continues on the next line, and it
   includes "|" to separate items within a field.

>  ** This draft (COSE) and draft-ietf-lamps-cms-hash-sig (CMS) share common text.  A number of changes were made to draft-lamps-cms-hash-sig in response to AD feedback and the IESG review (version -09 and -10).  Please propagate these changes (where they are appropriate):
> 
> -- Abstract and Section 1.  Expand "HSS/LMS".
Done.
> -- from CMS Section 1.0 to COSE Section 1.0
Done.
> -- from CMS Section 1.3 to COSE Section 1.1
Done, but it preserves the pointer to the SUIT WG, which was not appropriate for the CMS document because SUIT has chosen to use CBOR.
> -- from CMS Section 2.0 to COSE Section 2.0
Done.
> -- from CMS Section 2.1 to COSE Section 2.1
Done.
> -- from CMS Section 2.2 to COSE Section 2.2
Done.
> -- from CMS Section 2.3 to COSE Section 2.3
Done.
> -- from CMS Section 6.0 to COSE Section 6.0
Done, assuming that you mean the Implementation Security Considerations in the draft-ietf-cose-hash-sig document.

Russ

---

From: Laurence Lundblade <[email-masked]>
Date: Thu, 10 Oct 2019 16:04:43 -0700

> On Oct 10, 2019, at 1:24 PM, Russ Housley <[email-masked]> wrote:
> 

Doesn’t COSE only have a COSE_Sign1?  COSE_Sign0 is mentioned as wrong in errata.

The example in A.2 doesn’t look like a COSE_Sign1 at all.

LL

---

From: Jim Schaad <[email-masked]>
Date: Thu, 10 Oct 2019 17:23:33 -0700

No that would be the format that I use in the examples with all of the inputs as well.  You should just use the cbor_diag field, and read section 8 of the CBOR draft for how multiple lies are done.

From: COSE <[email-masked]> On Behalf Of Laurence Lundblade
Sent: Thursday, October 10, 2019 4:05 PM
To: Russ Housley <[email-masked]>
Cc: Roman D. Danyliw <[email-masked]>; Ivaylo Petrov <[email-masked]>; Ben Kaduk <[email-masked]>; cose <[email-masked]>
Subject: Re: [COSE] AD review of draft-ietf-cose-hash-sig-03

On Oct 10, 2019, at 1:24 PM, Russ Housley <[email-masked] <mailto:[email-masked]> > wrote:

LL

---

From: Laurence Lundblade <[email-masked]>
Date: Thu, 10 Oct 2019 21:13:02 -0700

Well I understand better — this is JSON formatted inputs / outputs for a test suite used by COSE-C?

But still…

What is a COSE_Sign0? Everywhere I look, I see it is a deprecated name for a COSE_SIgn1.

Shouldn’t the examples here look like the examples in RFC 8152? Should this use a new style for examples?

LL

> On Oct 10, 2019, at 5:23 PM, Jim Schaad <[email-masked]> wrote:
> 
> From: COSE <[email-masked] <mailto:[email-masked]>> On Behalf Of Laurence Lundblade
> To: Russ Housley <[email-masked] <mailto:[email-masked]>>
> Cc: Roman D. Danyliw <[email-masked] <mailto:[email-masked]>>; Ivaylo Petrov <[email-masked] <mailto:[email-masked]>>; Ben Kaduk <[email-masked] <mailto:[email-masked]>>; cose <[email-masked] <mailto:[email-masked]>>
>> On Oct 10, 2019, at 1:24 PM, Russ Housley <[email-masked] <mailto:[email-masked]>> wrote:
>>  
> _______________________________________________
> COSE mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/cose <https://www.ietf.org/mailman/listinfo/cose>

---

From: Laurence Lundblade <[email-masked]>
Date: Tue, 15 Oct 2019 09:41:43 -0700

Hi

Didn’t see any response to this. I also understand bette and can comment more clearly.

I really do think that s/COSE_Sign0/COSE_Sign1/ is necessary for the document to be correct.

I also think the Appendix A examples should be like the examples in RFC 8152 Appendix C. The examples should be just in CBOR diag, not in the JSON-format test framework input format. Is the reference to https://github.com/cose-wg/Examples <https://github.com/cose-wg/Examples> in the Appendix considered normative?

LL

> On Oct 10, 2019, at 9:13 PM, Laurence Lundblade <[email-masked]> wrote:
> 
>> On Oct 10, 2019, at 5:23 PM, Jim Schaad <[email-masked] <mailto:[email-masked]>> wrote:
>>

---

From: Russ Housley <[email-masked]>
Date: Tue, 15 Oct 2019 15:15:32 -0400

Laurence:

I'll let Jim respond to the format question, but I think the reference to GitHub in informative,

Russ

> On Oct 15, 2019, at 12:41 PM, Laurence Lundblade <[email-masked]> wrote:
> 
> Hi
> 
>> On Oct 10, 2019, at 9:13 PM, Laurence Lundblade <[email-masked] <mailto:[email-masked]>> wrote:
>> 
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose

---

From: Roman Danyliw <[email-masked]>
Date: Tue, 15 Oct 2019 19:22:25 +0000

From: COSE [mailto:[email-masked]] On Behalf Of Russ Housley
Sent: Tuesday, October 15, 2019 3:16 PM
To: Laurence Lundblade <[email-masked]>
Cc: Roman Danyliw <[email-masked]>; Jim Schaad <[email-masked]>; cose <[email-masked]>; Ben Kaduk <[email-masked]>; Ivaylo Petrov <[email-masked]>
Subject: Re: [COSE] AD review of draft-ietf-cose-hash-sig-03

Laurence:

[Roman] Irrespective of the Sign0 vs. 1 formatting.  This highlights a good point -- I don’t think the text explicitly says these examples are non-normative.  It probably should.

Roman

Russ

On Oct 15, 2019, at 12:41 PM, Laurence Lundblade <[email-masked]<mailto:[email-masked]>> wrote:

Hi

I also think the Appendix A examples should be like the examples in RFC 8152 Appendix C. The examples should be just in CBOR diag, not in the JSON-format test framework input format. Is the reference to https://github.com/cose-wg/Examples in the Appendix considered normative?

LL

On Oct 10, 2019, at 9:13 PM, Laurence Lundblade <[email-masked]<mailto:[email-masked]>> wrote:

But still…

LL

On Oct 10, 2019, at 5:23 PM, Jim Schaad <[email-masked]<mailto:[email-masked]>> wrote:

From: COSE <[email-masked]<mailto:[email-masked]>> On Behalf Of Laurence Lundblade
Sent: Thursday, October 10, 2019 4:05 PM
To: Russ Housley <[email-masked]<mailto:[email-masked]>>
Cc: Roman D. Danyliw <[email-masked]<mailto:[email-masked]>>; Ivaylo Petrov <[email-masked]<mailto:[email-masked]>>; Ben Kaduk <[email-masked]<mailto:[email-masked]>>; cose <[email-masked]<mailto:[email-masked]>>
Subject: Re: [COSE] AD review of draft-ietf-cose-hash-sig-03

On Oct 10, 2019, at 1:24 PM, Russ Housley <[email-masked]<mailto:[email-masked]>> wrote:

LL

_______________________________________________
COSE mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/cose

_______________________________________________
COSE mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/cose

---

From: Russ Housley <[email-masked]>
Date: Tue, 15 Oct 2019 15:33:27 -0400

I have added this to the introduction to the Examples:

   This appendix provides a non-normative example ...

I will post it after resolving any other Last Call comments that come along.

Russ

> On Oct 15, 2019, at 3:22 PM, Roman Danyliw <[email-masked]> wrote:
> 
>  
> From: COSE [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Russ Housley
> To: Laurence Lundblade <[email-masked] <mailto:[email-masked]>>
> Cc: Roman Danyliw <[email-masked] <mailto:[email-masked]>>; Jim Schaad <[email-masked] <mailto:[email-masked]>>; cose <[email-masked] <mailto:[email-masked]>>; Ben Kaduk <[email-masked] <mailto:[email-masked]>>; Ivaylo Petrov <[email-masked] <mailto:[email-masked]>>
> On Oct 15, 2019, at 12:41 PM, Laurence Lundblade <[email-masked] <mailto:[email-masked]>> wrote:
>  
> Hi
>

---

From: Roman Danyliw <[email-masked]>
Date: Tue, 15 Oct 2019 20:00:13 +0000

Hi Russ!

This new text (and timing after the LC) works for me.  Thanks.

Roman

From: Russ Housley [mailto:[email-masked]]
Sent: Tuesday, October 15, 2019 3:33 PM
To: Roman Danyliw <[email-masked]>
Cc: Laurence Lundblade <[email-masked]>; Jim Schaad <[email-masked]>; cose <[email-masked]>; Ben Kaduk <[email-masked]>; Ivaylo Petrov <[email-masked]>
Subject: Re: [COSE] AD review of draft-ietf-cose-hash-sig-03

Russ

On Oct 15, 2019, at 3:22 PM, Roman Danyliw <[email-masked]<mailto:[email-masked]>> wrote:

From: COSE [mailto:[email-masked]] On Behalf Of Russ Housley
Sent: Tuesday, October 15, 2019 3:16 PM
To: Laurence Lundblade <[email-masked]<mailto:[email-masked]>>
Cc: Roman Danyliw <[email-masked]<mailto:[email-masked]>>; Jim Schaad <[email-masked]<mailto:[email-masked]>>; cose <[email-masked]<mailto:[email-masked]>>; Ben Kaduk <[email-masked]<mailto:[email-masked]>>; Ivaylo Petrov <[email-masked]<mailto:[email-masked]>>
Subject: Re: [COSE] AD review of draft-ietf-cose-hash-sig-03

Laurence:

Roman

Russ

Hi

LL

But still…

LL

LL

---

From: Jim Schaad <[email-masked]>
Date: Tue, 15 Oct 2019 14:32:49 -0700

Will take care of the sample after the final assignment of the algorithm identifier by IANA

From: Roman Danyliw <[email-masked]> 
Sent: Tuesday, October 15, 2019 1:00 PM
To: Russ Housley <[email-masked]>
Cc: Laurence Lundblade <[email-masked]>; Jim Schaad <[email-masked]>; cose <[email-masked]>; Ben Kaduk <[email-masked]>; Ivaylo Petrov <[email-masked]>
Subject: RE: [COSE] AD review of draft-ietf-cose-hash-sig-03

Hi Russ!

Roman

From: Russ Housley [mailto:[email-masked]] 
Sent: Tuesday, October 15, 2019 3:33 PM
To: Roman Danyliw <[email-masked] <mailto:[email-masked]> >
Cc: Laurence Lundblade <[email-masked] <mailto:[email-masked]> >; Jim Schaad <[email-masked] <mailto:[email-masked]> >; cose <[email-masked] <mailto:[email-masked]> >; Ben Kaduk <[email-masked] <mailto:[email-masked]> >; Ivaylo Petrov <[email-masked] <mailto:[email-masked]> >
Subject: Re: [COSE] AD review of draft-ietf-cose-hash-sig-03

Russ

On Oct 15, 2019, at 3:22 PM, Roman Danyliw <[email-masked] <mailto:[email-masked]> > wrote:

From: COSE [ <mailto:[email-masked]> mailto:[email-masked]] On Behalf Of Russ Housley
Sent: Tuesday, October 15, 2019 3:16 PM
To: Laurence Lundblade < <mailto:[email-masked]> [email-masked]>
Cc: Roman Danyliw < <mailto:[email-masked]> [email-masked]>; Jim Schaad < <mailto:[email-masked]> [email-masked]>; cose < <mailto:[email-masked]> [email-masked]>; Ben Kaduk < <mailto:[email-masked]> [email-masked]>; Ivaylo Petrov < <mailto:[email-masked]> [email-masked]>
Subject: Re: [COSE] AD review of draft-ietf-cose-hash-sig-03

Laurence:

Roman

Russ

On Oct 15, 2019, at 12:41 PM, Laurence Lundblade < <mailto:[email-masked]> [email-masked]> wrote:

Hi

I also think the Appendix A examples should be like the examples in RFC 8152 Appendix C. The examples should be just in CBOR diag, not in the JSON-format test framework input format. Is the reference to  <https://github.com/cose-wg/Examples> https://github.com/cose-wg/Examples in the Appendix considered normative?

LL

On Oct 10, 2019, at 9:13 PM, Laurence Lundblade < <mailto:[email-masked]> [email-masked]> wrote:

But still…

LL

On Oct 10, 2019, at 5:23 PM, Jim Schaad < <mailto:[email-masked]> [email-masked]> wrote:

From: COSE < <mailto:[email-masked]> [email-masked]> On Behalf Of Laurence Lundblade
Sent: Thursday, October 10, 2019 4:05 PM
To: Russ Housley < <mailto:[email-masked]> [email-masked]>
Cc: Roman D. Danyliw < <mailto:[email-masked]> [email-masked]>; Ivaylo Petrov < <mailto:[email-masked]> [email-masked]>; Ben Kaduk < <mailto:[email-masked]> [email-masked]>; cose < <mailto:[email-masked]> [email-masked]>
Subject: Re: [COSE] AD review of draft-ietf-cose-hash-sig-03

On Oct 10, 2019, at 1:24 PM, Russ Housley < <mailto:[email-masked]> [email-masked]> wrote:

LL

_______________________________________________
COSE mailing list
 <mailto:[email-masked]> [email-masked]
 <https://www.ietf.org/mailman/listinfo/cose> https://www.ietf.org/mailman/listinfo/cose

_______________________________________________
COSE mailing list
 <mailto:[email-masked]> [email-masked]
 <https://www.ietf.org/mailman/listinfo/cose> https://www.ietf.org/mailman/listinfo/cose