-
Notifications
You must be signed in to change notification settings - Fork 17
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Include COSE HASH Envelope reference #334
base: main
Are you sure you want to change the base?
Conversation
Signed-off-by: steve lasker <[email protected]>
Signed-off-by: steve lasker <[email protected]>
@@ -367,7 +368,8 @@ Envelope: | |||
: metadata, created by the Issuer to produce a Signed Statement. | |||
The Envelope contains the identity of the Issuer and information about the Artifact, enabling Transparency Service Registration Policies to validate the Signed Statement. | |||
A Signed Statement is a COSE Envelope wrapped around a Statement, binding the metadata in the Envelope to the Statement. | |||
In COSE, an Envelope consists of a protected header (included in the Issuer's signature) and an unprotected header (not included in the Issuer's signature). | |||
In COSE, an Envelope consists of a protected header (included in the Issuer's signature) and an unprotected header (not included in the Issuer's signature) and the Payload. | |||
The Payload may contain the contents of the Statement, or a hash using {{-COSE-HASH}}. | |||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should may not be MAY per BCP14 or was it an intentional choice to cap it lowercase?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Some preliminary questions on keywords
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is just tangling drafts together for no real benefit.
A signed statement is a cose sign1, we don't need to say more than that.
Do we want to cover in SCRAPI: ietf-wg-scitt/draft-ietf-scitt-scrapi#43 |
Fixes #333