Yes. The input of hash algorithm is CBOR-encoded C509Certificate (starting with 
0x8B).

An issue is created to follow track this editorial change 
https://github.com/cose-wg/CBOR-certificates/issues/399.

Lijun

From: Laurence Lundblade <[email protected]>
Date: Tuesday, 21. July 2026 at 22:20
To: cose <[email protected]>
Subject: [COSE] C509 and c5t/COSE_CertHash

CAUTION! External Email. Do not click links or open attachments unless you 
recognize the sender and know the content is safe.

Here’s text from C509:

      The value type of c5t is the COSE_CertHash structure defined in 
[RFC9360], which contains the hash value
       of the C509 certificate calculated over C509Certificate. Thus, 
C509CertData contains all data necessary
       to calculate the thumbprint c5t.

Later the table says:

    c5t 22 COSE_CertHash Hash of a C509Certificate

I think this means that the first byte input to the hash is 0x8B, not 0x59 
(0x59 is the first byte of an encoded byte string of length 256..64K) because 
of the mention of C509CertData.

Seems like the definition should be:

   The input to the hash is a CBOR-encoded C509Certificate.

No need to mention C509CertData because it’s not a factor in the c5t, only in 
c5b and c5c.

LL

_______________________________________________
COSE mailing list -- [email protected]
To unsubscribe send an email to [email protected]
[Banner]<http://www.nio.io>
This email and any files transmitted with it are confidential and intended 
solely for the use of the individual or entity to whom they are addressed. You 
may NOT use, disclose, copy or disseminate this information. If you have 
received this email in error, please notify the sender and destroy all copies 
of the original message and all attachments. Please note that any views or 
opinions presented in this email are solely those of the author and do not 
necessarily represent those of the company. Finally, the recipient should check 
this email and any attachments for the presence of viruses. The company accepts 
no liability for any damage caused by any virus transmitted by this email.
_______________________________________________
COSE mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to