Add wc_CoseSign1_Sign_ex with an untagged output option - #65
Open
aidangarske wants to merge 2 commits into
Open
Conversation
mattia-moffa
approved these changes
Aug 1, 2026
danielinux
requested changes
Aug 3, 2026
danielinux
left a comment
danielinux
left a comment
Member
There was a problem hiding this comment.
Please rebase fix merge conflicts with #59 (now merged).
aidangarske
force-pushed
the
cose-sign1-untagged-only
branch
2 times, most recently
from
August 3, 2026 18:51
60aad36 to
19c46ed
Compare
aidangarske
force-pushed
the
cose-sign1-untagged-only
branch
from
August 3, 2026 19:04
19c46ed to
c962707
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RFC 9052 allows a
COSE_Sign1to be carried without its tag 18 prefix, and some consumers require that form, but the library could only emit tagged output.Adds
wc_CoseSign1_Sign_ex, which takes a flags bitmask withWOLFCOSE_SIGN1_UNTAGGEDto omit the tag.wc_CoseSign1_Signis unchanged for existing callers and forwards with flags of zero.wolfBoot DICE attestation PR wolfSSL/wolfBoot#831 uses this explicit option together with delegated signing from PR #59. The temporary integration branch composes both changes without changing either PR's merge order or release state.
Also adds
wc_CoseSign1_SignSize_ex, which computes the exact tagged or untagged encoded size without signing, using an RNG, or invoking an external signer. This lets wolfBoot size a DICE attestation token without advancing the CDI.Tests cover tagged and untagged output, exact size agreement, attached and detached payloads, CBOR length boundaries, supported signature families, invalid arguments, and confirmation that the size query does not call a delegated signer. The wolfBoot DICE unit test also covers 32, 48, and 64-byte PSA challenges, one-byte-short buffers, exact generated sizes, and verifies that sizing does not update the CDI or invoke signing.