Subject: Re: [COSE] x5chain & co. + COSE_Key

From: Benjamin Kaduk <[email-masked]>
Date: Sat, 17 Jul 2021 10:04:47 -0700

On Mon, Jun 21, 2021 at 12:46:08PM +0000, Thomas Fossati wrote:
> Hi all,
> 
> Reading draft-ietf-cose-x509 I understand x5chain & co are only found in
> COSE_Signature, COSE_Sign1 and COSE_recipient objects.
> 
> Is there any reason not to allow them in COSE_Keys - similar to JWK (*)?

There is a reason to not modify draft-ietf-cose-x509 to specify this
behavior, namely that that draft is overdue for publication and has
external consumers waiting on it.

Offhand, I'm not sure that there's a generic reason why this information
would not be appropriate in a COSE_Key.  You should probably write up a
draft to talk about doing it and why it's useful, which would hopefully
then elicit feedback about it.

-Ben