Comments (10)
I would not be using a kid in this case, I would be more likely to use a thumbprint for the identification purposes. Given that we have consistently said that the structure of kid is not known, making it known in this case seems to be a bad idea to me.
from x509.
Suppose I'm using COSE for code signing and a root has been embedded in the entity that will verify and run the signed code. The cert chain is a leaf, two intermediates and a root. The two intermediates and leaf are put in an x5bag. How does the verifier know which of the three in the x5bag is the leaf?
It seems that it should be Subject Key ID as that is best practice for this identification AFAIK. Thus, there should be some COSE header that contains the Subject Key ID. If that is not the kid, then another header should be formally defined. If it is a thumbprint then how the thumbprint works should be described.
Said another way, I think this draft should give enough info (along with 5280) to accomplish chain formation with an x5bag for the code signing example or other similar uses.
from x509.
Starting at the top, this is a case where a chain makes more sense because it resolves that problem entirely. Using a bag only makes sense if you have certificates that are outside of the chain.
Second, as I said I would put in a bag and a thumbprint. The thumbprint would be used to identify the leaf certificate to use.
from x509.
Understand that a thumbprint can work, but the word "thumbprint" only occurs in the document once in Table 2 which applies only to ECDH. Seems like there is some important text missing.
If x5t is the thumbprint, then it should say something like "x5t identifies the leaf cert in the chain, such as the one with the public key to verify the signature on a COSE_Sign1."
from x509.
That is implied by the bullet items immediately prior to table 1.
from x509.
Is that fixed now (with commit d6ba2d5)
from x509.
I think we can consider it addressed, yes. @laurencelundblade is encouraged to chime in as well, of course.
from x509.
It still doesn't say "the x5t header indicates the end-entity certificate" in any explicit way that I can see. I searched the tip of the repo document for "end-entity" and "leaf" to check. JWS is more clear.
The solution to this one and #29 are probably the same, so maybe it's OK to close this one if #29 stays open.
from x509.
I've made a PR to resolve this: #41
from x509.
Thank you, Laurence!
from x509.
Related Issues (20)
- ref uri format HOT 2
- cert bag unordered HOT 1
- Clarification needed HOT 3
- CDDL HOT 1
- Terminology -- header parameter? HOT 2
- Require DER encoding for x5t HOT 3
- PEM, DER, BER or other format? HOT 7
- Register a CBOR tag for X.509 cert? HOT 2
- Identification of end-entity cert / consistency with JWS HOT 16
- Header protection and consistency with JWS HOT 9
- What is the trust relationship for the x5u parameter? HOT 5
- Allow OSCORE [RFC8613] for x5u CoAP URIs HOT 1
- Prefer just array for x5bag and x5chain HOT 6
- media-type parameter, CoRE Content-Formats, HOT 2
- hash-algs auth48 HOT 4
- ISO 18013-5 replying on x509 HOT 1
- Do SHA-3/SHAKE algorithms need bit-order disclaimer? HOT 1
- x5t hashAlg as a name or just a value HOT 3
- Suggestion: consolidate self-signed cert discussion
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from x509.