Draft: draft-schaad-cose

Commentary: Change the indexes used by msg_type so that zero is not used . Allow for signture payloads to not be present . Expand the text on keys Add CBOR encoder restrictions - not sure if this is complete or not - see open issue   and Security considerations place holders .
We switched from using a map to using an array at the message
level.  While this change means that it is no longer possible to
add new information in the form of new fields to the message
object, this ability is still there as this data can be added to
the protected and unprotected maps.
Encrypted messages key management has been made to be more
uniform.  All key management techniques are represented as a
recipient rather than only have some of them be so.
Switch from using a map to using an array at the message level.
While this change means that it is no longer possible to add new
information in the form of new fields to the message object, this
ability is still there as this data can be added to the protected
and unprotected maps.
Key management has been made to be more uniform.  All key
management techniques are represented as a recipient rather than
only have some of them be so.
Use binary encodings for binary data rather than base64url
encodings.
There currently is no standard CBOR grammar available for use by
specifications.  In this document, we use a modified version of the
CBOR data definition language (CDDL) defined in I-D.greevenbosch-
appsawg-cbor-cddl.  The differences between the defined grammar and
the one we used are mostly self explanatory.  The biggest difference
being the addition of the choice operator '|'.
There currently is no standard CBOR grammar available for use by
specifications.  In this document, we use a modified version of the
CBOR data definition language (CDDL) defined in I-D.greevenbosch-
appsawg-cbor-cddl.  The differences between the defined grammar and
the one we used are mostly self explanatory.  The biggest difference
being the addition of the choice operator '|'.  Additionally, note
the use of the null value which is used to occupy a location in an
array but to mark that the element is not present.
msg_type indicates which of the security structures is in this
block.
indicates which of the security structures is in this block.
contains attributes about the payload which are to be protected by
the signature.  An example of such an attribute would be the
content type ('cty') attribute.  The content is a CBOR map of
attributes which is encoded to a byte stream.  This field MUST NOT
contain attributes about the signature, even if those attributes
are common across multiple signatures.
contains attributes about the payload which are not protected by
the signature.  An example of such an attribute would be the
content type ('cty') attribute.  This field MUST NOT contain
attributes about a signature, even if the attributes are common
across multiple signatures.
contains the serialized content to be signed.
is either a single signature or an array of signature values.
contains attributes about the payload which are to be protected by
the signature.  An example of such an attribute would be the
content type ('cty') attribute.  The content is a CBOR map of
attributes which is encoded to a byte stream.  This field MUST NOT
contain attributes about the signature, even if those attributes
are common across multiple signatures.  At least one of protected
and unprotected MUST be present.
contains attributes about the payload which are not protected by
the signature.  An example of such an attribute would be the
content type ('cty') attribute.  This field MUST NOT contain
attributes about a signature, even if the attributes are common
across multiple signatures.  At least one of protected and
unprotected MUST be present.
contains the serialized content to be signed.  If the payload is
not present in the message, the application is required to supply
the payload separately.  The payload is wrapped in a bstr to
ensure that it is transported without changes, if the payload is
transported separately it is the responsibility of the application
to ensure that it will be transported without changes.
is either a single signature or an array of signature values.  It
is legal to use the array of signature values for a single
signature.  Implementations MUST be able to parse both layouts.
is optional and contains additional information to be
authenticated by the signature.  The field holds data about the
signature operation.  The field MUST NOT hold attributes about the
payload being signed.  The content is a CBOR map of attributes
which is encoded to a byte stream.
contains attributes about the signature which are not protected by
the signature.  This field MUST NOT contain attributes about the
payload being signed.
is optional and contains additional information to be
authenticated by the signature.  The field holds data about the
signature operation.  The field MUST NOT hold attributes about the
payload being signed.  The content is a CBOR map of attributes
which is encoded to a byte stream.  At least one of protected and
unprotected MUST be present.
contains attributes about the signature which are not protected by
the signature.  This field MUST NOT contain attributes about the
payload being signed.  At least one of protected and unprotected
MUST be present.
One of the by products of using the same technique for encrypting and
encoding bot the content and the keys using the various key
management techniques, is a requirement that all of the key
management techniques use an Authenticated Encryption (AE) algorithm.
When encrypting the plain text, it is normal to use an Authenticated
Encryption with Additional Data (AEAD) algorithm.  For key
management, either AE or AEAD algorithms can be used.  See AE-algo
for more details about the different types of algorithms.
One of the by products of using the same technique for encrypting and
encoding both the content and the keys using the various key
management techniques, is a requirement that all of the key
management techniques use an Authenticated Encryption (AE) algorithm.
When encrypting the plain text, it is normal to use an Authenticated
Encryption with Additional Data (AEAD) algorithm.  For key
management, either AE or AEAD algorithms can be used.  See AE-algo
for more details about the different types of algorithms.
contains an ephemeral key for key agreement management algorithms.
contains an ephemeral key for key agreement management algorithms.
Note however, that it is a COSE encoded key and not a JOSE encoded
key.
At the moment we do not have any key management methods that allow
for the use of protected headers.  This may be changed in the future
if, for example, the AES-GCM Key wrap method defined in [JWA] were
extended to allow for authenticated data.  In that event the use of
the 'protected' field, which is current forbidden below, would be
permitted.
There are only a few changes between JOSE and COSE for how keys are
formatted.  As with JOSE, COSE uses a map to contain the elements of
a key.  Those values, which in JOSE, are base64url encoded because
they are binary values, are encoded as bstr values in COSE.
The element "kty" is a required element in a COSE_Key map.
All other elements are optional and not all of the elements listed in
[JWK] or [JWA] have been listed here even though they can all appear
in a COSE_Key map.
The "key_ops" element is prefered over the "use" element as the
information provided that way is more finely detailed about the
operations allowed.  It is strongly suggested that this element be
present for all keys.
The restriction applies only the encoding the Sig_structure.
The rules for Canonical CBOR (Section 3.9 of RFC 7049) MUST be
used in these locations.  The main rule that needs to be enforced
is that all lengths in these structures MUST be encoded such that
they are encoded using definite lengths and the minimum length
encoding is used.
There are IANA considerations to be filled in.
Use of direct key with other recipient structures hands the key to
other recipients.
Use of direcct ECDH direct encryption is easy for people to leak
information on if there are other recipients in the message.