feat: support detached payloads in COSESign and COSESign1 #197

alex-richards · 2024-07-22T02:42:11Z

Hey,

I've extended COSESign and COSESign1 to support detached payloads, adds a parameter to the public API, not sure if that's desirable.

I'm also pretty new to Go, I've tried to copy the existing style but I'm sure there's plenty that could be improved.

Cheers, Alex

#195

SteveLasker · 2024-07-22T15:18:20Z

Hi, @alex-richards,
Thanks for the PR. Several of the maintainers/reviewers are at IETF this week. Please give us a bit of time to review.

Without knowing more about the specific scenario you want to implement, you might want to check this new draft for HASH Envelopes. It addresses many of the challenges detached payloads solve and create. Here's a set of slides we're presenting this week at the COSE Working group.

While we're still generally supportive for go-cose supporting detached payloads, one of the advantages of HASH Envelope is it's "just a payload" and you won't need to detach and re-attach the payload. Just FYI, we should still support detached payloads in go-cose.

alex-richards · 2024-07-22T21:46:25Z

Thanks Steve, I'll have a read, though I'm interested in ISO 18013-5, which specifies detached payloads.

I've removed the breaking changes.

SteveLasker · 2024-07-25T02:36:56Z

Hi @alex-richards. Welcome to the verasion/go-cose project and thank you for your contributions.
As go-cose is used in many projects and products, can you provide more info about yourself? Your profile has very limited info, with no additional info in your commits.

Thank you

alex-richards · 2024-07-25T02:47:52Z

Hi @alex-richards. Welcome to the verasion/go-cose project and thank you for your contributions. As go-cose is used in many projects and products, can you provide more info about yourself? Your profile has very limited info, with no additional info in your commits.

Thank you

Hi Steve,

Yeah, sure. Do you have a preferred private way for me to get in touch?

SteveLasker · 2024-07-25T02:51:23Z

You can reach me through my linkedin profile info.

alex-richards · 2024-07-26T22:02:04Z

Hey Steve,

I've signed as discussed.

Cheers, Alex

SteveLasker · 2024-07-26T22:28:39Z

Thanks, @alex-richards,
Several folks were at IETF this week, so maintainers may take a few days to catch up with their "day jobs" and review.

OR13

This seems ok to me, but it would be good to get more reviews, since this touches several interfaces

SteveLasker · 2024-08-02T22:42:33Z

Thanks, @alex-richards, can you please resolve the DCO error: https://github.com/veraison/go-cose/pull/197/checks?check_run_id=27984447393

sign.go

alex-richards · 2024-08-13T07:43:41Z

@qmuntal I've made those changes, yeah, they're much clearer.

Not sure what resolving etiquette is here, tag you? Resolve myself?

qmuntal · 2024-08-13T07:47:19Z

@qmuntal I've made those changes, yeah, they're much clearer.

Not sure what resolving etiquette is here, tag you? Resolve myself?

You can resolve them yourself 👍

sign.go

sign1.go

sign.go

qmuntal

LGTM, thanks!

alex-richards · 2024-08-14T21:20:25Z

Any merging etiquette I should know about? Or just go for it once it's approved? Is 2 enough?

SteveLasker · 2024-08-14T21:42:52Z

Due to the slightly larger change, it would be good to have an additional golang and cose expert weigh in
@thomas-fossati, @shizhMSFT l, @setrofim can either of you please take a look?

thomas-fossati

Looks very good to me. Thanks a lot for the great contribution!

bench_test.go

yogeshbdeshpande · 2024-08-15T08:36:09Z

sign1.go

+ return m.sign(rand, nil, external, signer)
+}
+
+// SignDetached signs a Sign1Message using the provided Signer.


The comments here are very identical to the comments for normal Sign Method.

At the least you should refer to the
// COSE defined detached payloads in Section 2 of [RFC9052]

The comments here are very identical to the comments for normal Sign Method.

I'd be surprised if they weren't ;-)

At the least you should refer to the // COSE defined detached payloads in Section 2 of [RFC9052]

I reckon the reference to S4.4 of RFC8152 is precise enough. A standards nerd would probably reference S4.4 of RFC9052 :-), but for the detached payload case, there is no material difference between 9052 and 8152.

@thomas-fossati I beg to differ. Section 4.4 RFC8152 talks about general signing. There is no reference to Detached Signing in 4.4

My intention was also to reference to specification which clarifies aspects of DetachedSigning, which is lacking in the reference!

@thomas-fossati I beg to differ. Section 4.4 RFC8152 talks about general signing. There is no reference to Detached Signing in 4.4

And rightly so, because there's nothing special about detached/non-detached in terms of signing and verification.

S4.4, Bullet point 5, second sentence:

[T]he full payload is used here, independent of how it is transported.

Any decision here?

yogeshbdeshpande · 2024-08-15T13:54:37Z

sign.go

+// Notice: The COSE Sign API is EXPERIMENTAL and may be changed or removed in a
+// later release.


Is Line 487 and 488 relevant here ?, given that we are commenting on Verify here?

I copied these lines from the existing methods. I took it to mean the whole of the Sign/Verify API together.

Perhaps we should change this to sign/verify

I'm waiting to see if anyone else has strong opinions on this.

yogeshbdeshpande

Left some minor points on the comments to Verify, but in general LGTM!

shizhMSFT

I'd like to discuss more about the design in #195 before merging this PR as I have commented at #195 (comment)

bench_test.go

sign.go

shizhMSFT · 2024-08-15T15:07:28Z

sign1.go

+func Sign1Detached(rand io.Reader, signer Signer, headers Headers, detached, external []byte) ([]byte, error) {
+ msg := Sign1Message{
+ Headers: headers,
+ }
+ err := msg.SignDetached(rand, detached, external, signer)
+ if err != nil {
+ return nil, err
+ }
+ return msg.MarshalCBOR()
+}


Do we really need

func (m *SignMessage) SignDetached(rand io.Reader, detached, external []byte, signers ...Signer) error func (m *Sign1Message) SignDetached(rand io.Reader, detached, external []byte, signer Signer) error

?

Can Sign1Detached be implemented as

Suggested change

func Sign1Detached(rand io.Reader, signer Signer, headers Headers, detached, external []byte) ([]byte, error) {

msg := Sign1Message{

Headers: headers,

}

err := msg.SignDetached(rand, detached, external, signer)

if err != nil {

return nil, err

}

return msg.MarshalCBOR()

}

func Sign1Detached(rand io.Reader, signer Signer, headers Headers, detached, external []byte) ([]byte, error) {

msg := Sign1Message{

Headers: headers,

Payload: detached,

}

err := msg.Sign(rand, external, signer)

if err != nil {

return nil, err

}

msg.Payload = nil

return msg.MarshalCBOR()

}

?

Same question for SignDetached.

Seems fussy to me, would making detached the base case and calling from Sign1 be ok? Saves unsetting the payload on the detached object.

shizhMSFT · 2024-08-15T15:26:14Z

sign.go

+ if detached == nil {
+ return ErrMissingPayload
+ }
+ return m.verify(detached, external, verifiers...)


nit: can it be simplified as

Suggested change

return m.verify(detached, external, verifiers...)

msg := *m

msg.Payload = detached

return msg.Verify(external, verifiers...)

?

This clones the SignMessage object, correct?

Signed-off-by: Alex Richards <alex-richards@users.noreply.github.com>

codecov · 2024-08-16T07:20:53Z

Codecov Report

Attention: Patch coverage is 64.86486% with 26 lines in your changes missing coverage. Please review.

Project coverage is 91.16%. Comparing base (2b6f94f) to head (fa0344c).
Report is 7 commits behind head on main.

Files	Patch %	Lines
sign1.go	40.90%	26 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #197      +/-   ##
==========================================
- Coverage   92.04%   91.16%   -0.88%     
==========================================
  Files          12       12              
  Lines        1973     1676     -297     
==========================================
- Hits         1816     1528     -288     
+ Misses        108       92      -16     
- Partials       49       56       +7

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

SteveLasker · 2024-08-16T15:53:18Z

Thanks for all the feedback.
To move forward, there are a number of questions, which seem to be change requests on this PR. Yet, there are several approvals.
Can folks please update their comments?
If you have a comment you expect to be addressed before merging, please change to a change request.
If there are no "change requests" by August 23, 2024, and we have 2 or more approvals from maintainers, we'll move to merge.

shizhMSFT

Changing to "Request changes"

alex-richards requested review from henkbirkholz, qmuntal, roywill, setrofim, shizhMSFT, SimonFrost-Arm, SteveLasker, thomas-fossati and yogeshbdeshpande as code owners July 22, 2024 02:42

alex-richards force-pushed the detached-payloads branch 2 times, most recently from 4e80ef5 to bc11d1c Compare July 22, 2024 22:59

alex-richards force-pushed the detached-payloads branch from bc11d1c to 1736a40 Compare July 26, 2024 22:01

OR13 approved these changes Aug 2, 2024

View reviewed changes

alex-richards force-pushed the detached-payloads branch from 1736a40 to a636db9 Compare August 2, 2024 23:07

alex-richards mentioned this pull request Aug 13, 2024

feat: COSEMac #198

Draft

qmuntal requested changes Aug 13, 2024

View reviewed changes

sign.go Outdated Show resolved Hide resolved

sign.go Outdated Show resolved Hide resolved

alex-richards force-pushed the detached-payloads branch from a636db9 to 94007e7 Compare August 13, 2024 07:41

qmuntal requested changes Aug 13, 2024

View reviewed changes

alex-richards force-pushed the detached-payloads branch from 94007e7 to 40060e0 Compare August 14, 2024 00:25

qmuntal approved these changes Aug 14, 2024

View reviewed changes

thomas-fossati approved these changes Aug 15, 2024

View reviewed changes

bench_test.go Outdated Show resolved Hide resolved

yogeshbdeshpande reviewed Aug 15, 2024

View reviewed changes

yogeshbdeshpande approved these changes Aug 15, 2024

View reviewed changes

shizhMSFT reviewed Aug 15, 2024

View reviewed changes

shizhMSFT linked an issue Aug 15, 2024 that may be closed by this pull request

External Payload Support for CoseSign1 #195

Open

feat: support detached payloads in COSESign and COSESign1

fa0344c

Signed-off-by: Alex Richards <alex-richards@users.noreply.github.com>

alex-richards force-pushed the detached-payloads branch from 40060e0 to fa0344c Compare August 16, 2024 07:14

SteveLasker added this to the v1.4.0 milestone Aug 16, 2024

shizhMSFT requested changes Aug 24, 2024

View reviewed changes

shizhMSFT mentioned this pull request Aug 24, 2024

External Payload Support for CoseSign1 #195

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support detached payloads in COSESign and COSESign1 #197

feat: support detached payloads in COSESign and COSESign1 #197

alex-richards commented Jul 22, 2024

SteveLasker commented Jul 22, 2024

alex-richards commented Jul 22, 2024

SteveLasker commented Jul 25, 2024

alex-richards commented Jul 25, 2024

SteveLasker commented Jul 25, 2024

alex-richards commented Jul 26, 2024

SteveLasker commented Jul 26, 2024

OR13 left a comment

SteveLasker commented Aug 2, 2024

alex-richards commented Aug 13, 2024

qmuntal commented Aug 13, 2024

qmuntal left a comment

alex-richards commented Aug 14, 2024

SteveLasker commented Aug 14, 2024

thomas-fossati left a comment

yogeshbdeshpande Aug 15, 2024 •

edited

Loading

thomas-fossati Aug 15, 2024 •

edited

Loading

yogeshbdeshpande Aug 15, 2024 •

edited

Loading

thomas-fossati Aug 15, 2024

alex-richards Aug 24, 2024

yogeshbdeshpande Aug 15, 2024

alex-richards Aug 16, 2024

yogeshbdeshpande Aug 16, 2024

alex-richards Aug 24, 2024

yogeshbdeshpande left a comment

shizhMSFT left a comment

shizhMSFT Aug 15, 2024

alex-richards Aug 18, 2024 •

edited

Loading

shizhMSFT Aug 15, 2024

alex-richards Aug 18, 2024

codecov bot commented Aug 16, 2024

SteveLasker commented Aug 16, 2024

shizhMSFT left a comment

		// Notice: The COSE Sign API is EXPERIMENTAL and may be changed or removed in a
		// later release.

- return m.verify(detached, external, verifiers...)
+ msg := *m
+ msg.Payload = detached
+ return msg.Verify(external, verifiers...)

feat: support detached payloads in COSESign and COSESign1 #197

Are you sure you want to change the base?

feat: support detached payloads in COSESign and COSESign1 #197

Conversation

alex-richards commented Jul 22, 2024

SteveLasker commented Jul 22, 2024

alex-richards commented Jul 22, 2024

SteveLasker commented Jul 25, 2024

alex-richards commented Jul 25, 2024

SteveLasker commented Jul 25, 2024

alex-richards commented Jul 26, 2024

SteveLasker commented Jul 26, 2024

OR13 left a comment

Choose a reason for hiding this comment

SteveLasker commented Aug 2, 2024

alex-richards commented Aug 13, 2024

qmuntal commented Aug 13, 2024

qmuntal left a comment

Choose a reason for hiding this comment

alex-richards commented Aug 14, 2024

SteveLasker commented Aug 14, 2024

thomas-fossati left a comment

Choose a reason for hiding this comment

yogeshbdeshpande Aug 15, 2024 • edited Loading

Choose a reason for hiding this comment

thomas-fossati Aug 15, 2024 • edited Loading

Choose a reason for hiding this comment

yogeshbdeshpande Aug 15, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

shizhMSFT left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alex-richards Aug 18, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Aug 16, 2024

Codecov Report

SteveLasker commented Aug 16, 2024

shizhMSFT left a comment

Choose a reason for hiding this comment

yogeshbdeshpande Aug 15, 2024 •

edited

Loading

thomas-fossati Aug 15, 2024 •

edited

Loading

yogeshbdeshpande Aug 15, 2024 •

edited

Loading

alex-richards Aug 18, 2024 •

edited

Loading