Yes. The input of hash algorithm is CBOR-encoded C509Certificate (starting with 0x8B).
An issue is created to follow track this editorial change https://github.com/cose-wg/CBOR-certificates/issues/399. Lijun From: Laurence Lundblade <[email protected]> Date: Tuesday, 21. July 2026 at 22:20 To: cose <[email protected]> Subject: [COSE] C509 and c5t/COSE_CertHash CAUTION! External Email. Do not click links or open attachments unless you recognize the sender and know the content is safe. Here’s text from C509: The value type of c5t is the COSE_CertHash structure defined in [RFC9360], which contains the hash value of the C509 certificate calculated over C509Certificate. Thus, C509CertData contains all data necessary to calculate the thumbprint c5t. Later the table says: c5t 22 COSE_CertHash Hash of a C509Certificate I think this means that the first byte input to the hash is 0x8B, not 0x59 (0x59 is the first byte of an encoded byte string of length 256..64K) because of the mention of C509CertData. Seems like the definition should be: The input to the hash is a CBOR-encoded C509Certificate. No need to mention C509CertData because it’s not a factor in the c5t, only in c5b and c5c. LL _______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected] [Banner]<http://www.nio.io> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. You may NOT use, disclose, copy or disseminate this information. If you have received this email in error, please notify the sender and destroy all copies of the original message and all attachments. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
