Subject: [COSE] tstr values for kty, alg, crv, etc.

From: AJITOMI Daisuke <[email-masked]>
Date: Wed, 28 Jul 2021 20:45:21 +0900

Hi folks,

I am an open source CWT/COSE library (Python CWT:
https://github.com/dajiaji/python-cwt) implementer.
I've already implemented most of the functionality of COSE and CWT, but
there are a few things I would like to clarify.

One of the questions I have is the 'tstr' values for 'kty', 'alg', 'crv',
or 'key_ops' which have the type definition "tstr / int".

At first, I thought "Name" values defined in the IANA registries should be
used, but for example, RFC8152 (Section 16.2) says as follows:

"Name: The name is present to make it easier to refer to and discuss the
registration entry. The value is not used in the protocol."

In my opinion, the tstr type for 'kty', 'alg', 'crv' or 'key_ops' is not
necessary because I think the major advantage of COSE is its
compactness,but I would like to know what you are assuming as the value of
tstr.

I apologize if this topic has already been discussed.

Regards,
Daisuke

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 28 Jul 2021 14:47:33 +0200

Hi Daisuke,

> On 2021-07-28, at 13:45, AJITOMI Daisuke <[email-masked]> wrote:
> 
> In my opinion, the tstr type for 'kty', 'alg', 'crv' or 'key_ops' is not necessary because I think the major advantage of COSE is its compactness,but I would like to know what you are assuming as the value of tstr.

The registrant gets the choice between a text string and an integer.

https://www.iana.org/assignments/cose/cose.xhtml lists the registration procedures for certain ranges, e.g.:

https://www.iana.org/assignments/cose/cose.xhtml#algorithms

Range 	Registration Procedures 
Strings of length 1	Standards Action With Expert Review
Integer values between -256 and 255	Standards Action With Expert Review
Strings of length 2	Specification Required
Integer values from 256 to 65535	Specification Required
Integer values from -65536 to -257	Specification Required
Strings of length greater than 2	Expert Review
Integer values greater than 65535	Expert Review

So labels the representations of which would be 1+0 and 1+1 bytes long require standards action, 1+2, specification required, and 1+>2, expert review.

It doesn’t look like anyone has felt a need to register a text string label for an algorithm ID yet; there are still quite a few 1+1 (and even a few 1+0!) values available for registration.

I would expect that, until we run out of codepoints, the registration of text labels will remain an occurrence for special circumstances (which means we might not be prepared for text labels when we finally actually need them).

Grüße, Carsten

---

From: AJITOMI Daisuke <[email-masked]>
Date: Thu, 29 Jul 2021 05:06:48 +0900

Hi Carsten,

Thanks for your quick reply.

> Strings of length greater than 2 Expert Review

I overlooked the above part of the IANA registry.
As for alg, my question was solved and I understood that tstr type values
are not the aliases of int type values but I doubt the necessity to support
tstr type values for alg, etc.
For a specific length value, the number of tstr-type values is much smaller
than that of int type values and I think the merit of introducing the tstr
type is relatively small (compared to the demerit of that).

> (which means we might not be prepared for text labels when we finally
actually need them).

At least my implementation supports only 'int' type and I don't know the
implementations which support tstr type alg. Considering the
interoperability, we'd better update the spec from "tstr / int" to "int"...

By the way, are kty, crv and key_ops the same as alg? At least for kty and
crv, there is no mention about text string in the IANA registry like the
above alg.

2021年7月28日(水) 21:47 Carsten Bormann <[email-masked]>:

> So labels the representations of which would be 1+0 and 1+1 bytes long
> require standards action, 1+2, specification required, and 1+>2, expert
> review.
>
> It doesn’t look like anyone has felt a need to register a text string
> label for an algorithm ID yet; there are still quite a few 1+1 (and even a
> few 1+0!) values available for registration.
>
> I would expect that, until we run out of codepoints, the registration of
> text labels will remain an occurrence for special circumstances (which
> means we might not be prepared for text labels when we finally actually
> need them).
>
> Grüße, Carsten
>
>

---

From: Laurence Lundblade <[email-masked]>
Date: Wed, 28 Jul 2021 13:50:20 -0700

Yes, I much prefer int labels for a small C implementation. Adding support for tstr labels would noticeably increase code size. I hope no one registers a tstr label.  It seems unlikely because algorithms are relatively hard to invent and vet.

LL

> On Jul 28, 2021, at 5:47 AM, Carsten Bormann <[email-masked]> wrote:
> 
> Hi Daisuke,
> 
>> On 2021-07-28, at 13:45, AJITOMI Daisuke <[email-masked] <mailto:[email-masked]>> wrote:
>> 
> https://www.iana.org/assignments/cose/cose.xhtml <https://www.iana.org/assignments/cose/cose.xhtml> lists the registration procedures for certain ranges, e.g.:
> 
> https://www.iana.org/assignments/cose/cose.xhtml#algorithms <https://www.iana.org/assignments/cose/cose.xhtml#algorithms>
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose