Subject: [COSE] [Editorial Errata Reported] RFC8152 (6909)

From: RFC Errata System <[email-masked]>
Date: Thu, 31 Mar 2022 06:48:32 -0700 (PDT)

The following errata report has been submitted for RFC8152,
"CBOR Object Signing and Encryption (COSE)".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6909

--------------------------------------
Type: Editorial
Reported by: Thomas Fossati <[email-masked]>

Section: 3.1

Original Text
-------------
Generic_Headers = (
    ? 1 => int / tstr,  ; algorithm identifier
    ? 2 => [+label],    ; criticality
    ? 3 => tstr / int,  ; content type
    ? 4 => bstr,        ; key identifier
    ? 5 => bstr,        ; IV
    ? 6 => bstr         ; Partial IV
)

Corrected Text
--------------
Generic_Headers = (
    ? 1 => int / tstr,  ; algorithm identifier
    ? 2 => [+label],    ; criticality
    ? 3 => tstr / int,  ; content type
    ? 4 => bstr,        ; key identifier
    ? ( 5 => bstr //    ; IV
        6 => bstr )     ; Partial IV
)

Notes
-----
Section 3.1 says: "The "Initialization Vector" and "Partial Initialization Vector" header parameters MUST NOT both be present in the same security layer."

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC8152 (draft-ietf-cose-msg-24)
--------------------------------------
Title               : CBOR Object Signing and Encryption (COSE)
Publication Date    : July 2017
Author(s)           : J. Schaad
Category            : PROPOSED STANDARD
Source              : CBOR Object Signing and Encryption
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 31 Mar 2022 15:53:04 +0200

I think this change can be a good improvement, but the existing CDDL is not “wrong”, it is just not expressing all the constraints that are then expressed in prose.

Grüße, Carsten

> On 2022-03-31, at 15:48, RFC Errata System <[email-masked]> wrote:
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose

---

From: Thomas Fossati <[email-masked]>
Date: Thu, 31 Mar 2022 15:33:50 +0000

Sorry for top-posting.

I agree with Carsten.  Is it still possible to add this to rfc-to-be-9052 ?

From: Carsten Bormann <[email-masked]>
Date: Thursday, 31 March 2022 at 14:53
To: RFC Errata System <[email-masked]>
Cc: [email-masked] <[email-masked]>, Thomas Fossati <[email-masked]>, [email-masked] <[email-masked]>
Subject: Re: [COSE] [Editorial Errata Reported] RFC8152 (6909)
I think this change can be a good improvement, but the existing CDDL is not “wrong”, it is just not expressing all the constraints that are then expressed in prose.

Grüße, Carsten

> "CBOR Object Signing and Encryption (COSE)".
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.