Another comment: Do we need the detailed content in the entire Section 4, "Composite Signature Algorithm"? A reference to the LAMPS specification should be sufficient.
Lijun From: Lijun Liao <[email protected]> Date: Friday, 31. July 2026 at 18:19 To: Lucas Prabel <[email protected]>; JOSE WG <[email protected]>; cose <[email protected]> Subject: [COSE] Re: draft-ietf-jose-pq-composite-sigs: ECDSA encoding CAUTION! External Email. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi, First, "A poll was organized, with the following result: I prefer aligning with the LAMPS Composite document? Yes: 21 / No: 12 / No opinion: 10" Was the COSE WG consulted as part of this poll? I also have the following editorial comments: 1. Section 4.5.1, Ecdsa-Sig-Value (Signatures) "r and s are the raw, fixed-length, big-endian values already used today by [RFC7518] and [RFC9053] (32 bytes each for P-256, 48 bytes each for P-384)." Although r and s are typically fixed-length values for a given curve, they may also be encoded using fewer bytes if leading zeros are omitted. 2. Section 4.5.1, Ecdsa-Sig-Value (Signatures) Please also specify how many bytes are used to encode and decode the length field. Otherwise, implementers need prior knowledge of ASN.1 encoding rules. 3. Section 4.5.1, Ecdsa-Sig-Value (Signatures) Please wrap the long lines in the last code block. Also, after "parameters field", add the explanatory text: "A0: explicit tag 0". 4. Please use either P-256 / P-384 or secp256 / secp384 consistently throughout the document, rather than mixing the two naming conventions. 5. Please wrap the long lines in Table 7: JOSE/COSE Composite Label Values. 6. Please wrap the long lines in the examples in Appendix A. 7. I am not sure that the example in Appendix A.2 is conformant with the COSE specification. Best regards, Lijun (from cose WG) [Banner]<http://www.nio.io/> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. You may NOT use, disclose, copy or disseminate this information. If you have received this email in error, please notify the sender and destroy all copies of the original message and all attachments. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. [Banner]<http://www.nio.io/> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. You may NOT use, disclose, copy or disseminate this information. If you have received this email in error, please notify the sender and destroy all copies of the original message and all attachments. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
