We’re having a discussion on signing/hashing in the CBOR WG. See [Hashing non-wrapped CBOR]. COSE byte-string wraps hashed/signed data. Bundle and C509 don't.
I believe hashing non-wrapped CBOR affects which CBOR libraries you can use. Or stated differently, it puts a new requirement on CBOR libraries. My personal view has been that byte string wrapping is the proper practice as described in [Appendix G] because simple CBOR libraries don’t provide access to the undecoded CBOR of sub-parts, but maybe that turns out not to be the case. Can you comment on implementations that have been done of C509 native signatures and which CBOR libraries they used? LL [Appendix G]: https://www.ietf.org/archive/id/draft-ietf-cbor-serialization-07.html#name-cbor-byte-string-wrapping [Hashing non-wrapped CBOR]: https://mailarchive.ietf.org/arch/msg/cbor/BZ6GiQ2B69K4Nv0jmuDGBvFhlEw/ _______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
