IETF Meeting Minutes

Session Date/Time: 23 Jul 2024 16:30
# cose Meeting Minutes

## Summary

The COSE working group meeting covered several draft specifications, including updates on HPKE, post-quantum signature schemes (Dilithium, SPHINCS+, Falcon), CBOR-encoded certificates (C509), COSE Receipts, COSE Timestamp Tokens, and COSE Hash Envelopes. Discussions revolved around security considerations, implementation details, and readiness for working group last call.

## Key Discussion Points

*   **HPKE:** A new recipient structure was introduced for context information, and terminology was updated. Concerns were raised about protecting the algorithm using the algorithm itself.
*   **Post-Quantum Signature Schemes:**
    *   **Dilithium:** The draft is in good shape, but more reviews and interop testing are needed.
    *   **SPHINCS+:** IANA section updates are being incorporated.
    *   **Falcon:** The working group discussed whether there is sufficient interest in Falcon to justify further development.
*   **C509:** The signature algorithm's position was changed for parsing efficiency. Several pending issues regarding IP address block certificates and QC statements were discussed.
*   **COSE Receipts:** Early allocations were requested for IANA tags. A working group last call was requested.
*   **COSE Timestamp Tokens:** The draft is considered ready for working group last call.
*   **COSE Hash Envelopes:** A new draft specification was presented for signing the hash of the payload instead of the payload itself. Potential adoption by the working group.
*   **AAD to non-AAD Downgrading Attack:** A new mechanism proposed to mitigate the AAD to non-AAD downgrading attack.

## Decisions and Action Items

*   **HPKE:** Authors to re-compute examples, incorporate parameters into protected headers.
*   **Dilithium:** Get more reviews and interop testing.
*   **SPHINCS+:** Incorporate editorial and IANA updates. Chairs will seek additional reviewers.
*   **Falcon:** Authors will revive the draft with editorial cleanup. Align with NIST draft when it becomes available.
*   **C509:** Authors to address open issues and update the working group when they believe all issues have been resolved.
*   **COSE Receipts:** Authors to respond to Robin Bryce's comments and address all comments.
*   **COSE Timestamp Tokens:** Start working group last call.
*   **COSE Hash Envelopes:** Adopted as a new working group draft.
*   **AAD to non-AAD Downgrading Attack:** Seek community input and working group decision on the correct approach.
*   **Overall:** The chairs emphasized the importance of addressing open issues and incorporating feedback from reviews before initiating working group last calls.

## Next Steps

*   Chairs to follow up on the mailing list regarding Falcon use-cases.
*   Chairs to send message to the list asking about code point deployment of the Hybrid HPKE.
*   Authors of each draft to complete action items noted above and communicate progress to chairs and working group.