Draft: draft-ietf-cose-msg

Commentary: Make the base iv text clearer Assign numbers and make CFRG curve names match  document
Care needs to be taken that this is only used as part of a key
distribution algorithm that will ensure that it will be given only
to parties that will use it correctly.  This is due to the fact
that many of the content encryption algorithms defined for COSE
require that IVs be unique for every message.  Use of this field
will easily allow for this rule to be broken if not used
carefully.  This field MUST be ignored unless an application
specifically calls for its use.
Extreme care needs to be taken when using a Base IV in an
application.  Since many encryption algorithms have considerations
about using the same IV twice, applications need to be designed so
that this does not accidently happen.  The simpliest method to do
this is to ensure that a unique key is derived for every direction
of a conersation.  If a single group key is being used, then some
algorithm needs to be used to ensure that the IV space is divided
among all of the transmitters so that each entity is given a
segment of the overall IV space.  This field MUST be ignored
unless an application specifically calls for its use.
I-D.irtf-cfrg-eddsa describes the elliptic curve signature scheme
Edwards-curve Digital Signature Algorithm (EdDSA).  In that document,
the signature algorithm is instantiated using parameters for
edwards25519 and edwards448 curves.  The document additionally
describes two variants of the EdDSA algorithm: Pure EdDSA, where no
hash function is applied to the content before signing and, HashEdDSA
where a hash function is applied to the content before signing and
the result of that hash function is signed.  For use with COSE, on
the pure EdDSA version is used.  This is because it is not expected
that extremely large contents are going to be needed and, based on
the arrangement of the message structure, the entire message is going
to need to be held in memory in order to create or verify a
signature.  Thus, the use of an incremental update process would not
be useful.  Applications can provide the same features by defining
the content of the message as a hash value and transporting the COSE
message and the content as separate items.
I-D.irtf-cfrg-eddsa describes the elliptic curve signature scheme
Edwards-curve Digital Signature Algorithm (EdDSA).  In that document,
the signature algorithm is instantiated using parameters for
edwards25519 and edwards448 curves.  The document additionally
describes two variants of the EdDSA algorithm: Pure EdDSA, where no
hash function is applied to the content before signing and, HashEdDSA
where a hash function is applied to the content before signing and
the result of that hash function is signed.  For use with COSE, only
the pure EdDSA version is used.  This is because it is not expected
that extremely large contents are going to be needed and, based on
the arrangement of the message structure, the entire message is going
to need to be held in memory in order to create or verify a
signature.  Thus, the use of an incremental update process would not
be useful.  Applications can provide the same features by defining
the content of the message as a hash value and transporting the COSE
message and the content as separate items.
The Edwards curves for EdDSA and ECDH are distinct and should not be
used for the other algorithm.
If batch signature verification is performed, a well-seeded
cryptographic random number generator is REQUIRED.  Signing and non-
batch signature verification are deterministic operations and do not
nee random nuber of any kind.