Skip to content

Commit 04ce524

Browse files
committed
Simplify signature discussion
Mentioning PKIX here seems to just be confusing. Just say this is how you sign a thing. The PKIX connection already comes in later in the Representing Certification Authorities section. Issue #279
1 parent 36cb851 commit 04ce524

1 file changed

Lines changed: 2 additions & 4 deletions

File tree

draft-ietf-plants-merkle-tree-certs.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1213,11 +1213,9 @@ Subtree signatures can be used to sign timestamped log checkpoints with a non-ze
12131213

12141214
### Signature Algorithms
12151215

1216-
The cosigner's public key specifies both the key material and the signature algorithm to use with the key material. In order to change key or signature parameters, a cosigner operator MUST deploy a new cosigner, with a new cosigner ID. Signature algorithms MUST fully specify the algorithm parameters, such as hash functions used.
1216+
The cosigner's public key specifies both the key material and the signature algorithm to use with the key material. In order to change key or signature parameters, a cosigner operator MUST deploy a new cosigner, with a new cosigner ID. Signature algorithms MUST fully specify the algorithm parameters, such as hash functions used. Signatures are computed over the CosignedMessage described in {{signature-format}}.
12171217

1218-
In this document, any PKIX signature algorithm MAY be used, such as the ML-DSA algorithms defined in {{!RFC9881}}. The signature is generated as in PKIX, except that the input is the structure defined in {{signature-format}}. In particular, in ML-DSA algorithms, the context string MUST be an empty string, as in {{Section 3 of !RFC9881}}.
1219-
1220-
Other documents or deployments MAY define other signature schemes and formats. Log clients that accept cosignatures from some cosigner are assumed to be configured with all parameters necessary to verify that cosigner's signatures, including the signature algorithm and version of the signature format.
1218+
Log clients that accept cosignatures from some cosigner are assumed to be configured with all parameters necessary to verify that cosigner's signatures, including the signature algorithm and version of the signature format.
12211219

12221220
## Certification Authority Cosigners
12231221

0 commit comments

Comments
 (0)