Laurence, One other interesting example of needing "part of a CBOR sequence" for hashing is in the EDHOC protocol when using (the transport-specific equivalent of) the media type "application/cid-edhoc+cbor-seq" as opposed to the basic "application/edhoc+cbor-seq". The difference is that the content is "... an EDHOC message prepended by a connection identifier ..." which is just CBOR sequence concatenation CID + edhoc_msg. For the decoder though, the CID is _not_ part of the message and needs to be excluded from the transcript hash of the message!
So this is another case of non-trivial (maybe "special") access to the encoded CBOR data of part of a larger structure. Similarly to BPv7 CRC evaluation, the EDHOC message hash could be taken from a re-encoding of just the message (without CID prefix) or through extra information about in which part of the encoded data the message resides. To your original question here: I did some naive experimentation of C509 creation and validation with Python cbor2 library and cryptography library (and it all worked). Brian S. On Wed, Jul 15, 2026 at 4:05 PM Laurence Lundblade <[email protected]> wrote: > We’re having a discussion on signing/hashing in the CBOR WG. See [Hashing > non-wrapped CBOR]. COSE byte-string wraps hashed/signed data. Bundle and > C509 don't. > > I believe hashing non-wrapped CBOR affects which CBOR libraries you can > use. Or stated differently, it puts a new requirement on CBOR libraries. My > personal view has been that byte string wrapping is the proper practice as > described in [Appendix G] because simple CBOR libraries don’t provide > access to the undecoded CBOR of sub-parts, but maybe that turns out not to > be the case. > > Can you comment on implementations that have been done of C509 native > signatures and which CBOR libraries they used? > > LL > > > [Appendix G]: > https://www.ietf.org/archive/id/draft-ietf-cbor-serialization-07.html#name-cbor-byte-string-wrapping > [Hashing non-wrapped CBOR]: > https://mailarchive.ietf.org/arch/msg/cbor/BZ6GiQ2B69K4Nv0jmuDGBvFhlEw/ > > > > > _______________________________________________ > COSE mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
