Hi all, I am posting this as a complete outsider to any of the IETF stuff. Apologies if that is not appropriate.
I recently wrote a specification for a new CBOR tag for flagging sensitive values such as password, encryption keys, credit card information or GDPR information, so that generic decoders may treat them differently. This is intentionally unpublished right now: https://gist.github.com/nakedible/fa872f5a59d30d9fbf39d7b26342d54c I think this might be of special interest to COSE in general. Right now the situation is that in all the messages and key formats, the information on which values are critical to keep confidential and which values are not requires full semantic understanding of the messages. As a concrete example, a COSE symmetric key is a map with keys 1, 2 and -1, and the -1 key contains the symmetric secret that should be kept confidential. Without understanding the full semantics of the message, it's impossible to know that the value for -1 is confidential and the value for 1 is not. This means it is impossible to use any generic CBOR decoders to read keys or any other messages that might contain something confidential - as the confidential value gets already exposed to a non-confidential data buffer during decoding time. The "sensitive data" tag would allow a generic decoder to place such values in a data structure that automatically prevents logging of the value and which zeroizes the memory when unallocating it, allowing more specific processing to take over on the semantic side from there. If this were to get a low tag value allocation from IETF, the increase in message length might be just one byte per sensitive data element, or two bytes. Also, even if in theory adding such a tag should be backward compatible, I believe in practice it's likely not - so I'm not sure if there's any sensitive way to introduce this for existing messages. In any case, I just wanted to quickly pitch the idea and see if you think it might be interesting to promote to an actual RFC or something. But if not, I will just publish the specification myself and get a tag allocated to it through the normal channels. Thank you in advance, -- Naked
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
