Original text:
option is critical, safe to forward, part of the cache key, and not repeatable. <del> The Object-Security option contains the OSCORE flag byte and for requests, the Sender ID (see compression).  If the flag byte is all zero (0x00) the Option value SHALL be empty (Option Length = 0).  An endpoint receiving a CoAP message without payload, that also contains an Object-Security option SHALL treat it as malformed and reject it. </del>  A successful response to a request with the Object-Security option SHALL contain the Object-Security option.  Whether error responses 8.1. The value of the Object-Security option SHALL contain the OSCORE flag <del> byte and the kid parameter as follows: </del>  The first byte (= the OSCORE flag byte) encodes a set of flags and the length of the Partial IV parameter. <del> The three least significant bits, n, encode the Partial IV length.  If n = 0 then the Partial IV is not present in the </del>  compressed COSE object.  The values n = 6 and n = 7 is reserved. The sixth-eighth least significant bits are reserved and SHALL be set to zero when not in use.  The remaining bytes encode the value of the kid, if the kid is present (k = 1)  The presence of Partial IV and kid in requests and responses is specified in cose-object, and summarized in fig-byte-flag. 8.2. <del> The payload of the OSCORE message SHALL be encoded as follows: The first n bytes encode the value of the Partial IV, if the Partial IV is present (n > 0). The following 1 byte encode the length of the Context Hint (context-hint), s, if the Context Hint flag is set (h = 1). The following s bytes encode the Context Hint, if the Context Hint flag is set (h = 1). The remaining bytes encode the ciphertext. </del>  8.3.

Reviewer comments:
This implements the change I suggested in , ie move everything but the ciphertext from CoAP payload to the option value. The text about kid being the last field is a draft, please modify if you have any better formulation.

Revised text:
option is critical, safe to forward, part of the cache key, and not repeatable.  <ins> The Object-Security option contains the OSCORE flag byte, the Sender Sequence Number and the Sender ID when present, (see compression). If the flag byte is all zero (0x00) and no other fields are present, the Option value SHALL be empty (Option Length = 0).  An endpoint receiving a CoAP message without payload, that also contains an Object-Security option SHALL treat it as malformed and reject it. </ins> A successful response to a request with the Object-Security option SHALL contain the Object-Security option.  Whether error responses 8.1. The value of the Object-Security option SHALL contain the OSCORE flag  <ins> byte, the Partial IV parameter, the Context Hint parameter (length and value), and the kid parameter as follows: </ins> The first byte (= the OSCORE flag byte) encodes a set of flags and the length of the Partial IV parameter.  <ins> The three least significant bits encode the Partial IV length n.  If n = 0 then the Partial IV is not present in the </ins> compressed COSE object.  The values n = 6 and n = 7 is reserved. The sixth-eighth least significant bits are reserved and SHALL be set to zero when not in use. <ins> The following n bytes encode the value of the Partial IV, if the Partial IV is present (n > 0). The following 1 byte encode the length of the Context Hint (context-hint) s, if the Context Hint flag is set (h = 1). The following s bytes encode the Context Hint, if the Context Hint flag is set (h = 1). </ins> The remaining bytes encode the value of the kid, if the kid is present (k = 1) <ins> Note that the kid MUST be the last field of the object-security value, even in case reserved bits are used and additional fields are added to it. </ins> The presence of Partial IV and kid in requests and responses is specified in cose-object, and summarized in fig-byte-flag. 8.2.  <ins> The payload of the OSCORE message SHALL encode the ciphertext. </ins> 8.3.