On Mon, Jul 20, 2026 at 09:09:14PM -0400, Brian Sipos wrote: > Ilari, > Thank you, I now better understand the relationship to RFC 9180. It might > be helpful to give an aside somewhere (intro section?) to explain that the > mechanism of this document is not compatible with strict minimal RFC 9180 > implementations and requires the API of the bis document.
It is compatible. RFC 9180 talks about using both, which COSE HPKE does not do (unless using SuppPrivInfo, which is non-interoperable anyway). The KE stuff uses info, but that is on layer >0, so should be small. The problem is libraries that do not implement single-shot aad at all, which is something RFC 9180 does not talk about. However, the text could be interpretted to encourage not supporting aad for single-shot. Note that if library supports multi-shot, you can emulate single-shot by creating a context and then using it once (since that is how single- shot internally works). > I will continue to track this with Py cryptography library authors for > eventual compatibility with the 9180bis spec. Do you have a feeling on the > stability of the current version of that draft? Where the specifications overlap (and not hitting any implementation limits), the behavior is fully compatible. - RFC9180bis has higher minimum limits (e.g., on info size). - RFC9180 has stuff RFC9180bis does not (e.g., auth modes). - RFC9180bis has stuff RFC9180 does not (e.g., single-step KDFs). I suppose one should be careful with things like single-step KDF with auth modes (I have written HPKE library that somehow supports that). -Ilari _______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
