Warren Kumari has entered the following ballot position for draft-ietf-cose-hash-algs-04: No Objection
When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-cose-hash-algs/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thank you for writing this - it was an interesting read. I do have one issue, which I cannot tell if it is simply me being dumb, or if the text needs more work. “ Doing indirect signing allows for a signature to be validated without first downloading all of the content associated with the signature. This capability can be of even greater importance in a constrained environment as not all of the content signed may be needed by the device.” I’m unclear how this works — itseems clear enough that I can verify that the signature matches the hash, but doesn’t the device need to still download and compute the hash over all of the content? Otherwise I could take a hash and signature from content A, and claim that it is for content B. Sure, if the signature **doens’t** match the hash I know not to bother downloading the content at all, but if the sig does match the hash I still need to download the content to check that the hash is for this content.... Please help educate me! Nit: “ A pointer to the value that was hashed. this could” — s/this/This/ _______________________________________________ COSE mailing list [email protected] https://www.ietf.org/mailman/listinfo/cose
