From 1dbac17f08cb59ffe0acb7af1d76c924c76f5f39 Mon Sep 17 00:00:00 2001 From: Henk Birkholz Date: Tue, 27 Aug 2024 15:45:07 +0200 Subject: [PATCH] addresses Carl's comment on signature cardinality / COSE msg type --- draft-birkholz-cose-tsa-tst-header-parameter.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/draft-birkholz-cose-tsa-tst-header-parameter.md b/draft-birkholz-cose-tsa-tst-header-parameter.md index efeeb08..b819de7 100644 --- a/draft-birkholz-cose-tsa-tst-header-parameter.md +++ b/draft-birkholz-cose-tsa-tst-header-parameter.md @@ -163,7 +163,7 @@ RFC 3161 timestamp tokens use CMS as signature envelope format. The payload of the signed timestamp token is the TSTInfo structure defined in {{-TSA}}, which contains the message imprint that was sent to the TSA. The hash algorithm is contained in the message imprint structure, together with the hash itself. -As part of the signature verification, the receiver MUST make sure that the message imprint in the embedded timestamp token matches either the payload or the signature fields, depending on the mode of use. +As part of the signature verification, the receiver MUST make sure that the message imprint in the embedded timestamp token matches a hash of either the payload, signature, or signature fields, depending on the mode of use and type of COSE structure. {{Appendix B of -TSA}} provides an example that illustrates how timestamp tokens can be used to verify signatures of a timestamped message when utilizing X.509 certificates.