Subject: Re: [COSE] cose-countersignatures

From: Russ Housley <[email-masked]>
Date: Mon, 16 Nov 2020 05:32:48 -0500

Based on the discussion at the meeting earlier today, I put together a PR:

	https://github.com/cose-wg/countersign/pull/2

Comments are most welcome.

Russ

---

From: Jonathan Hammell <[email-masked]>
Date: Thu, 19 Nov 2020 19:13:37 -0500

Hi Russ,
I cannot find the existing examples from the document in the GitHub
Examples repository, despite Appendix A saying that they are there.

Furthermore, the existing examples in the document do not cover the
COSE_Sign1 case that was deemed to be the problem with the original
countersignature.  I realize that the WG is having difficulty finding
someone to produce these examples, but I thought that this omission
should be pointed out on the list.

Jonathan

On Mon, Nov 16, 2020 at 5:32 AM Russ Housley <[email-masked]> wrote:
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose

---

From: Jonathan Hammell <[email-masked]>
Date: Fri, 20 Nov 2020 19:37:36 -0500

An update...
I was able to extend my COSE parser to verify the countersignature
examples from the I-D and I recreated the JSON input for the Examples
repository (https://github.com/cose-wg/Examples/pull/99).

I wasn't able to compute a few of the intermediate values due to
limitations of my code.  The intermediate values that I did not
compute or verify, I removed from the JSON.  But, important to this
I-D, I generated and included the ToBeSign_hex in countersignatures
and used this to successfully verify the ECDSA signature.

As Michael said, it would be nice if there was a second independent
implementation to validate.

As I pointed out in my previous message, these examples do not test
the CounterSignatureV2 structure.  But I think I'm close enough now
that I should be able to create some new examples.

Russ, maybe hold off on the PR for removing those Example stubs.

Jonathan

---

From: Russ Housley <[email-masked]>
Date: Sat, 21 Nov 2020 12:40:57 -0500

Jonathan:

I was poking around the GitHub repository, and I cannot find these Examples either. I am guessing that Jim did not get around to posting them.

If someone wants to work with me on an example for COSE_Sign1, I am willing to assist.

Russ

> On Nov 19, 2020, at 7:13 PM, Jonathan Hammell <[email-masked]> wrote:
> 
> Hi Russ,

---

From: Russ Housley <[email-masked]>
Date: Sat, 21 Nov 2020 12:59:44 -0500

The PR is waiting.  I will not do a merge until I hear back from you.

Russ

> On Nov 20, 2020, at 7:37 PM, Jonathan Hammell <[email-masked]> wrote:
> 
> An update...