{"action":"closed","issue":{"url":"https://api.github.com/repos/cose-wg/cose-issues/issues/48","labels_url":"https://api.github.com/repos/cose-wg/cose-issues/issues/48/labels{/name}","comments_url":"https://api.github.com/repos/cose-wg/cose-issues/issues/48/comments","events_url":"https://api.github.com/repos/cose-wg/cose-issues/issues/48/events","html_url":"https://github.com/cose-wg/cose-issues/issues/48","id":120522565,"number":48,"title":"Move external_aad to the end of structures using it and make its presence optional","user":{"login":"selfissued","id":7644414,"avatar_url":"https://avatars.githubusercontent.com/u/7644414?v=3","gravatar_id":"","url":"https://api.github.com/users/selfissued","html_url":"https://github.com/selfissued","followers_url":"https://api.github.com/users/selfissued/followers","following_url":"https://api.github.com/users/selfissued/following{/other_user}","gists_url":"https://api.github.com/users/selfissued/gists{/gist_id}","starred_url":"https://api.github.com/users/selfissued/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/selfissued/subscriptions","organizations_url":"https://api.github.com/users/selfissued/orgs","repos_url":"https://api.github.com/users/selfissued/repos","events_url":"https://api.github.com/users/selfissued/events{/privacy}","received_events_url":"https://api.github.com/users/selfissued/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cose-wg/cose-issues/labels/Complete","name":"Complete","color":"e11d21"},{"url":"https://api.github.com/repos/cose-wg/cose-issues/labels/cose-msg-08","name":"cose-msg-08","color":"5319e7"},{"url":"https://api.github.com/repos/cose-wg/cose-issues/labels/Technical","name":"Technical","color":"009800"},{"url":"https://api.github.com/repos/cose-wg/cose-issues/labels/Won't%20Fix","name":"Won't Fix","color":"f7c6c7"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/cose-wg/cose-issues/milestones/5","html_url":"https://github.com/cose-wg/cose-issues/milestones/cose-msg-09","labels_url":"https://api.github.com/repos/cose-wg/cose-issues/milestones/5/labels","id":1424013,"number":5,"title":"cose-msg-09","description":"Release version 09 to the IETF website","creator":{"login":"jimsch","id":4946037,"avatar_url":"https://avatars.githubusercontent.com/u/4946037?v=3","gravatar_id":"","url":"https://api.github.com/users/jimsch","html_url":"https://github.com/jimsch","followers_url":"https://api.github.com/users/jimsch/followers","following_url":"https://api.github.com/users/jimsch/following{/other_user}","gists_url":"https://api.github.com/users/jimsch/gists{/gist_id}","starred_url":"https://api.github.com/users/jimsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimsch/subscriptions","organizations_url":"https://api.github.com/users/jimsch/orgs","repos_url":"https://api.github.com/users/jimsch/repos","events_url":"https://api.github.com/users/jimsch/events{/privacy}","received_events_url":"https://api.github.com/users/jimsch/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":2,"state":"closed","created_at":"2015-11-22T22:25:43Z","updated_at":"2016-01-12T14:06:38Z","due_on":"2015-12-15T08:00:00Z","closed_at":"2015-12-23T04:25:45Z"},"comments":3,"created_at":"2015-12-05T02:16:13Z","updated_at":"2016-01-12T14:06:38Z","closed_at":"2016-01-12T14:06:38Z","body":"The external_aad feature is one not found in JOSE, CMS, XMLDSIG, or other commonly used cryptographic formats.  While I am satisfied with the resolution of issue #16 keeping this feature because of the discussions about the CoAP use cases that occurred in Yokohama, I still would like to see the common case that doesn't use it simplified.\r\n\r\nCurrently, the sig_structure contains [ body_protected, sign_protected, external_aad, payload ].  I request that this be reordered to [ body_protected, sign_protected, payload, external_aad ] and the external_aad array element be specified to be not present when no external_aad value is supplied, so that in the no-external_aad case, the sig_structure value becomes  [ body_protected, sign_protected, payload ].  It's no harder for the code to omit it than to include a zero-length binary value, as currently specified.  And the code still signs the whole array - it's just that the array can have either 4 or 3 elements.\r\n\r\nSimilarly, please revise the hmac_structure and enc_structure, placing external_aad at the end and making its presence optional."}}