search

ietf-rats / ietf-corim-cddl

This repository is abandoned. The adopted I-D can be found at:
https://github.com/ietf-rats-wg/draft-ietf-rats-corim/
2 stars 0 forks source link

A couple of doubts about COSE key-id #131

Open thomas-fossati opened 3 years ago

thomas-fossati commented 3 years ago

It is not clear to me the reasoning behind making key-id:

  1. part of the protected header (rather than the unprotected);
  2. a mandatory parameter.

Re: 1. I guess it could be as well in the unprotected part because it is going to be verified indirectly anyway. Re: 2. The signer information in the meta structure could be enough to do the key lookup, so it looks like we are forcing the signer and verifier to have to agree on yet another explicit parameter.

Thanks, cheers!

nedmsmith commented 3 years ago

are unprotected parameters subject to MITM replacement? Maybe just another form of denial of service if the keyid is computed from the key.

thomas-fossati commented 3 years ago

are unprotected parameters subject to MITM replacement?

yep

Maybe just another form of denial of service if the keyid is computed from the key.

the DoS surface exists even if the key-id is part of the protected header.