Draft: draft-ietf-cose-msg

Commentary: Edits on the HKDF functionality for clarity . NITs pass
salt - an optional public value that is used to change the
generation process.  If specified, the salt is carried using the
'salt' algorithm parameter.  While RFC5869 suggests that the
length of the salt be the same as the length of the underlying
hash value, any amount of salt will improve the security as
different key values will be generated.  A parameter to carry the
salt is defined in HKDF_Alg_Params.  This parameter is protected
by being included in the key computation and does not need to be
separately authenticated.
salt - an optional public value that is used to change the
generation process.  The salt value can be either public or
private.  If the salt is public and carried in the message, then
the 'salt' algorithm header parameter defined in HKDF_Alg_Params
is used.  While RFC5869 suggests that the length of the salt be
the same as the length of the underlying hash value, any amount of
salt will improve the security as different key values will be
generated.  This parameter is protected by being included in the
key computation and does not need to be separately authenticated.
The salt value does not need to be unique for every message sent.
HKDF is defined to use HMAC as the underlying PRF.  However, it is
possible to use other functions in the same construct to provide a
different KDF function that may be more appropriate in the
constrained world.  Specifically, one can use AES-CBC-MAC as the PRF
for the expand step, but not for the extract step.  When using a good
random shared secret of the correct length, the extract step can be
skipped.  The extract cannot be skipped if the secret is not
uniformly random, for example if it is the result of an ECDH key
agreement step.
HKDF is defined to use HMAC as the underlying PRF.  However, it is
possible to use other functions in the same construct to provide a
different KDF function that can be more appropriate in the
constrained world.  Specifically, one can use AES-CBC-MAC as the PRF
for the expand step, but not for the extract step.  When using a good
random shared secret of the correct length, the extract step can be
skipped.  For the AES algorithm versions, the extract step is always
skipped.  The extract cannot be skipped if the secret is not
uniformly random, for example if it is the result of an ECDH key
agreement step.  (This implies that the AES HKDF function cannot be
used with ECDH.)  If the extract step is skipped, the 'salt' value is
not used as part of the KDF functionality.
Fields can be define by the application.  This is commonly used to
assign names to parties.
Fields can be define by the application.  This is commonly used to
assign fixed names to parties.
Key Encryption mode is also called key transport mode in some
standards.  Key Encryption mode differs from Key Wrap mode in that it
uses an asymmetric encryption algorithm rather than a symmetric
encryption algorithm to protect the key.  This document defines one
Key Encryption mode algorithm.
Key Encryption mode is also called key transport mode in some
standards.  Key Encryption mode differs from Key Wrap mode in that it
uses an asymmetric encryption algorithm rather than a symmetric
encryption algorithm to protect the key.  This document does not
define any Key Encryption mode algorithms.