This text in 5.1 would seem to require nil:
ciphertext:
This field contains the encrypted key, encoded as a bstr. All encoded keys are
symmetric keys; the binary value of the key is the content. If there is not an
encrypted key, then this field is encoded as a nil value.
But examples C.3.1 and C.3.2, which don’t have an encrypted key, show:
/ ciphertext / h''
Probably if we look at Jim Schaad’s code that generated the examples we’ll find
h’’.
This is the problem, right? Seems like a problem to me.
LL
> On Jul 8, 2026, at 8:53 AM, Sipos, Brian J. <[email protected]> wrote:
>
> COSE WG,
> Within the COSE_Sign/COSE_Sign1 messages the “payload” is optionally
> nil-valued and within COSE_Encrypt/COSE_Encrypt0 messages the “ciphertext” is
> optionally nil-valued, in both cases these nil values convey that the payload
> or ciphertext is “detached” and held elsewhere.
>
> There is a similar type union for COSE_recipient structure “ciphertext”
> field, but less explanation about the semantics or uses of the nil value
> here. All of the examples in RFC 9052 make use of empty-bstr recipient
> ciphertext when the algorithm doesn’t make use of one, search for “/
> ciphertext / h''” to see these examples. This seems a little backward to me
> (the KDF-based recipient algs do not have ciphertext) but these already exist.
>
> So for the question of the semantics of this recipient field:
> Is there a meaningful distinction between empty-bstr and nil value?
> Is there a reason why a generator-encoder would use one over the other?
> Should a decoder-processor treat them differently?
> Is it okay for a general purpose codec to treat them as equivalent and
> normalize to one form?
>
> Finally, it seems like this deserves some errata discussion for Section 5.1.
> I can write one if there is some consensus about what the “right” answers are.
>
> Thoughts on this are welcome,
> Brian S.
> _______________________________________________
> COSE mailing list -- [email protected] <mailto:[email protected]>
> To unsubscribe send an email to [email protected]
> <mailto:[email protected]>
_______________________________________________
COSE mailing list -- [email protected]
To unsubscribe send an email to [email protected]
