Hi Laurence, Carsten, Thanks for your comments. Trying to resolve the previous discussion a single mail.
1. We just submitted -02<https://datatracker.ietf.org/doc/html/draft-ietf-cose-c509-test-vectors-02> of the test vectors draft which is matching C509-20. And added a note about which version it is based on to avoid further confusion. Hope this is more clear now. 2. We started an editorial PR#401<https://github.com/cose-wg/CBOR-certificates/pull/401> against C509-20 mainly including the discussion in this thread. * Laurence: I didn’t understand what is unclear with: "Hash of a C509Certificate”. C509Certificate is a CBOR array with 11 elements, i.e., starting with 0x8B. How does “CBOR-encoded C509Certificate” make that more clear? * Carsten: Did we capture your distinction well? Other comments we missed? Thanks, Göran From: Laurence Lundblade <[email protected]> Date: Wednesday, 22 July 2026 at 18:17 To: Carsten Bormann <[email protected]> Cc: Lijun Liao <[email protected]>; cose <[email protected]> Subject: [COSE] Re: Tweaks to draft-ietf-cose-c509-test-vectors? Apologies; my mistake about ~ here. LL > On Jul 21, 2026, at 2:01 PM, Carsten Bormann <[email protected]> wrote: > > On Jul 21, 2026, at 22:05, Laurence Lundblade <[email protected]> wrote: >> >> It looks like -19 attempted to use ~ (unwrap) to remove the array grouping >> to yield a sequence. But ~ only works on tag numbers, not arrays. > > Let’s clarify that last sentence a bit: > CDDL was defined before CBOR Sequences were being used more heavily. > It therefore has no way to describe a CBOR Sequence directly, only single > CBOR data items (CDDL types, i.e., sets of data items). > > Unwrapping (~) a CDDL Tag data item gives you the content of the tag, which > is another data item (a *type* in CDDL). > Unwrapping a map or an array gives you a *group*, which you can use to build > larger arrays and maps (see example on page 26 of RFC 8610), but which is not > a CBOR Sequence. > Please see Section 4.1 of RFC 8742 for how to handle CBOR Sequences in CDDL. > Essentially, if you use CDDL to describe an array the content of which stands > for a CBOR Sequence, you’ll need to say that. > “The elements of a C509Certificate form a CBOR Sequence. Similarly, the > subsequence of elements described as the group TBSCertificate form a CBOR > Sequence that stands for a similar structure with the issuerSignatureValue > removed at the end.” Or so. > 3.1.12 then says “…the signatureValue is calculated over the CBOR sequence > TBSCertificate." > > Grüße, Carsten > > _______________________________________________ > COSE mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
