Comments (4)
Hi @nealmcb!
My 2 cents (I've since left the SSL so take this with a grain of salt). I think that document was insightful, but for reasons beyond the raw content in it. I honestly don't think it really articulates a rationale for using COSE other than it being an IETF endorsed "standard". In fact, I can't still answer this, but now that their charter does describe the NEED to use COSE/RATS for no reason other than the authors of that RFC being co-authors of that other one, then I believe there's your answer. When I asked repeatedly that they'd be willing to use other cryptographic standards instead of COSE (e.g., PKCS9 or PGP) they had no answer other than "we want to use COSE". To me, it feels like the requirement was to have one standard, rather than provide certain fundamental security/performance properties.
As for my side --- I don't speak for the SSL! --- most of the pushback to using COSE (at least from my side) fell within not adding unnecessary complexity, as well as COSE's pedigree of massive CVE's from its ancestor JOSE. They say they fixed those issues, by issuing yet another RFC where they document the common mistakes people do when implementing JOSE. I'm not exactly satisfied with this. I believe in security by default, and I know knobs can also serve as footguns, thus the minimal specification around DSSE (Speaking of which, you may be interested in PASETO as well).
I think it'd be valuable to bring some clarity into the issue as you point out, and perhaps working on fleshing out that document is it. I unfortunately don't have the cycles for something like this, but I'd be happy to chime in whenever possible. I'd be happy to participate to the extent possible!
P.S. Oh, and to clarify. Sigstore didn't add support for COSE because of any enlightening conversation with the SCITT folks (as they seem to hint in that issue), but rather because it already supported a bunch of other standards (such as GPG and PKCS9 mentioned above) so why not.
from dsse.
A related observation. It seems that Sigstore bundle was invented purely because DSSE has limits on the metadata you can embed in the signature.
I have no proof of the claim, but after working with cose it would be a similar thing I'd miss.
from dsse.
The Sigstore bundle format is also needed for non-DSSE cases to ship the additional verification information. On the DSSE side, we're actively working to support the additional information on a case-by-case basis. See: #59, #61, and sigstore/protobuf-specs#145. I can't speak for how COSE handles this though.
from dsse.
from dsse.
Related Issues (20)
- Design: Where to put timestamps in envelope? HOT 23
- Add envelope version HOT 8
- Communicating signing algorithm and parameters HOT 10
- Envelope headers HOT 6
- Extending DSSE to accept optional signature specific metadata HOT 26
- How to verify an envelope properly? HOT 5
- Add field for certificate chains, or explain alternative solution HOT 26
- Clarify design philosphy
- Document the sigstore/sigstore client libraries? HOT 3
- Specify DSSE Signature encoding in the Protocol or as a Parameter HOT 6
- "DSSE Multi-signature Verification" protocol lacks detail about threshold verification HOT 3
- Have you considered signing a hash digest of the payload instead of the payload itself? HOT 3
- Feature: generate DSSE language clients from the protobuf HOT 4
- reconsider threshold (aka multi-sig) verification HOT 7
- DSSE Maintainers HOT 4
- Process to enhance DSSE HOT 2
- Extending DSSE Signatures HOT 22
- DSSE Extension for Timestamping and PKI Support
- Reducing overhead for payload encoding HOT 15
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dsse.