Hi, I would appreciate feedback on the signed-object format used in an individual Internet-Draft:
Title: PulseProof Sentinel Protocol Draft: draft-hezami-pulseproof-sentinel Datatracker: https://datatracker.ietf.org/doc/draft-hezami-pulseproof-sentinel/ Repository: https://github.com/pps-protocol/pulseproof-sentinel Documentation: https://pps-protocol.github.io/pulseproof-sentinel/docs/ PPS defines a signed authentication artifact called a Pulse. The Pulse envelope is currently a CBOR map containing: - the signed message bytes - a signature map - optional rotation certificates The mandatory profile uses Ed25519 signatures over deterministic CBOR-encoded payloads. The protocol is intended for offline OTP-style authentication, constrained terminals, transaction signing, silent duress signaling, and offline multi-device approval. I would appreciate feedback on the following questions: 1. Would COSE_Sign1 or COSE_Sign be a better fit for the PPS Pulse envelope? 2. Are there advantages to using COSE protected/unprotected headers instead of the current custom CBOR map? 3. Is the algorithm identifier approach compatible with COSE algorithm registration practices? 4. Would using COSE improve interoperability with existing implementations? 5. Are there COSE extensions or profiles that would be relevant for time-bound authentication proofs? The draft currently defines a custom CBOR envelope because it needs to carry protocol-specific fields such as epoch, counter, rotation sequence, duress state indicators, threshold signatures, policy hash, and context hash. I am open to changing the format if COSE provides a more interoperable and well-reviewed approach. Thanks, Hossein Hezami Independent
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
