<?xml version='1.0' encoding='utf-8'?>
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" version="3" ipr="trust200902" docName="draft-ietf-cose-tsa-tst-header-parameter-08" number="9921" updates="" obsoletes="" category="std" consensus="true" submissionType="IETF" tocInclude="true" sortRefs="true" symRefs="true" xml:lang="en" prepTime="2026-02-26T17:44:10" indexInclude="true" scripts="Common,Latin" tocDepth="3">
  <link href="https://datatracker.ietf.org/doc/draft-ietf-cose-tsa-tst-header-parameter-08" rel="prev"/>
  <link href="https://dx.doi.org/10.17487/rfc9921" rel="alternate"/>
  <link href="urn:issn:2070-1721" rel="alternate"/>
  <front>
    <title abbrev="TST Header">CBOR Object Signing and Encryption (COSE) Header Parameter for Timestamp Tokens as Defined in RFC 3161</title>
    <seriesInfo name="RFC" value="9921" stream="IETF"/>
    <author initials="H." surname="Birkholz" fullname="Henk Birkholz">
      <organization abbrev="Fraunhofer SIT" showOnFrontPage="true">Fraunhofer SIT</organization>
      <address>
        <postal>
          <street>Rheinstrasse 75</street>
          <city>Darmstadt</city>
          <code>64295</code>
          <country>Germany</country>
        </postal>
        <email>henk.birkholz@ietf.contact</email>
      </address>
    </author>
    <author initials="T." surname="Fossati" fullname="Thomas Fossati">
      <organization showOnFrontPage="true">Linaro</organization>
      <address>
        <email>thomas.fossati@linaro.org</email>
      </address>
    </author>
    <author initials="M." surname="Riechert" fullname="Maik Riechert">
      <organization showOnFrontPage="true">Microsoft</organization>
      <address>
        <postal>
          <country>United Kingdom</country>
        </postal>
        <email>Maik.Riechert@microsoft.com</email>
      </address>
    </author>
    <date month="02" year="2026"/>
    <area>SEC</area>
    <workgroup>cose</workgroup>
    <abstract pn="section-abstract">
      <t indent="0" pn="section-abstract-1">This document defines two CBOR Object Signing and Encryption (COSE) header parameters for incorporating timestamping based on RFC 3161 into COSE message structures (<tt>COSE_Sign</tt> and <tt>COSE_Sign1</tt>).
This enables the use of established timestamping infrastructure per RFC 3161 in COSE-based protocols.</t>
    </abstract>
    <boilerplate>
      <section anchor="status-of-memo" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.1">
        <name slugifiedName="name-status-of-this-memo">Status of This Memo</name>
        <t indent="0" pn="section-boilerplate.1-1">
            This is an Internet Standards Track document.
        </t>
        <t indent="0" pn="section-boilerplate.1-2">
            This document is a product of the Internet Engineering Task Force
            (IETF).  It represents the consensus of the IETF community.  It has
            received public review and has been approved for publication by
            the Internet Engineering Steering Group (IESG).  Further
            information on Internet Standards is available in Section 2 of 
            RFC 7841.
        </t>
        <t indent="0" pn="section-boilerplate.1-3">
            Information about the current status of this document, any
            errata, and how to provide feedback on it may be obtained at
            <eref target="https://www.rfc-editor.org/info/rfc9921" brackets="none"/>.
        </t>
      </section>
      <section anchor="copyright" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.2">
        <name slugifiedName="name-copyright-notice">Copyright Notice</name>
        <t indent="0" pn="section-boilerplate.2-1">
            Copyright (c) 2026 IETF Trust and the persons identified as the
            document authors. All rights reserved.
        </t>
        <t indent="0" pn="section-boilerplate.2-2">
            This document is subject to BCP 78 and the IETF Trust's Legal
            Provisions Relating to IETF Documents
            (<eref target="https://trustee.ietf.org/license-info" brackets="none"/>) in effect on the date of
            publication of this document. Please review these documents
            carefully, as they describe your rights and restrictions with
            respect to this document. Code Components extracted from this
            document must include Revised BSD License text as described in
            Section 4.e of the Trust Legal Provisions and are provided without
            warranty as described in the Revised BSD License.
        </t>
      </section>
    </boilerplate>
    <toc>
      <section anchor="toc" numbered="false" removeInRFC="false" toc="exclude" pn="section-toc.1">
        <name slugifiedName="name-table-of-contents">Table of Contents</name>
        <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1">
          <li pn="section-toc.1-1.1">
            <t indent="0" keepWithNext="true" pn="section-toc.1-1.1.1"><xref derivedContent="1" format="counter" sectionFormat="of" target="section-1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-introduction">Introduction</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.1.2">
              <li pn="section-toc.1-1.1.2.1">
                <t indent="0" keepWithNext="true" pn="section-toc.1-1.1.2.1.1"><xref derivedContent="1.1" format="counter" sectionFormat="of" target="section-1.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-use-cases">Use Cases</xref></t>
              </li>
              <li pn="section-toc.1-1.1.2.2">
                <t indent="0" keepWithNext="true" pn="section-toc.1-1.1.2.2.1"><xref derivedContent="1.2" format="counter" sectionFormat="of" target="section-1.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-requirements-notation">Requirements Notation</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.2">
            <t indent="0" pn="section-toc.1-1.2.1"><xref derivedContent="2" format="counter" sectionFormat="of" target="section-2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-modes-of-use">Modes of Use</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.2.2">
              <li pn="section-toc.1-1.2.2.1">
                <t indent="0" pn="section-toc.1-1.2.2.1.1"><xref derivedContent="2.1" format="counter" sectionFormat="of" target="section-2.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-cose-then-timestamp-ctt">COSE, Then Timestamp (CTT)</xref></t>
              </li>
              <li pn="section-toc.1-1.2.2.2">
                <t indent="0" pn="section-toc.1-1.2.2.2.1"><xref derivedContent="2.2" format="counter" sectionFormat="of" target="section-2.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-timestamp-then-cose-ttc">Timestamp, Then COSE (TTC)</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.3">
            <t indent="0" pn="section-toc.1-1.3.1"><xref derivedContent="3" format="counter" sectionFormat="of" target="section-3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-timestamp-tokens-per-rfc-31">Timestamp Tokens per RFC 3161: COSE Header Parameters</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2">
              <li pn="section-toc.1-1.3.2.1">
                <t indent="0" pn="section-toc.1-1.3.2.1.1"><xref derivedContent="3.1" format="counter" sectionFormat="of" target="section-3.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-3161-ctt"><tt>3161-ctt</tt></xref></t>
                <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.3.2.1.2">
                  <li pn="section-toc.1-1.3.2.1.2.1">
                    <t indent="0" pn="section-toc.1-1.3.2.1.2.1.1"><xref derivedContent="3.1.1" format="counter" sectionFormat="of" target="section-3.1.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-messageimprint-computation-"><tt>MessageImprint</tt> Computation for <tt>COSE_Sign1</tt></xref></t>
                  </li>
                  <li pn="section-toc.1-1.3.2.1.2.2">
                    <t indent="0" pn="section-toc.1-1.3.2.1.2.2.1"><xref derivedContent="3.1.2" format="counter" sectionFormat="of" target="section-3.1.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-messageimprint-computation-f"><tt>MessageImprint</tt> Computation for <tt>COSE_Sign</tt></xref></t>
                  </li>
                </ul>
              </li>
              <li pn="section-toc.1-1.3.2.2">
                <t indent="0" pn="section-toc.1-1.3.2.2.1"><xref derivedContent="3.2" format="counter" sectionFormat="of" target="section-3.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-3161-ttc"><tt>3161-ttc</tt></xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.4">
            <t indent="0" pn="section-toc.1-1.4.1"><xref derivedContent="4" format="counter" sectionFormat="of" target="section-4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-timestamp-processing">Timestamp Processing</xref></t>
          </li>
          <li pn="section-toc.1-1.5">
            <t indent="0" pn="section-toc.1-1.5.1"><xref derivedContent="5" format="counter" sectionFormat="of" target="section-5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-security-considerations">Security Considerations</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.5.2">
              <li pn="section-toc.1-1.5.2.1">
                <t indent="0" pn="section-toc.1-1.5.2.1.1"><xref derivedContent="5.1" format="counter" sectionFormat="of" target="section-5.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-avoiding-semantic-confusion">Avoiding Semantic Confusion</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.6">
            <t indent="0" pn="section-toc.1-1.6.1"><xref derivedContent="6" format="counter" sectionFormat="of" target="section-6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-iana-considerations">IANA Considerations</xref></t>
          </li>
          <li pn="section-toc.1-1.7">
            <t indent="0" pn="section-toc.1-1.7.1"><xref derivedContent="7" format="counter" sectionFormat="of" target="section-7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-normative-references">Normative References</xref></t>
          </li>
          <li pn="section-toc.1-1.8">
            <t indent="0" pn="section-toc.1-1.8.1"><xref derivedContent="Appendix A" format="default" sectionFormat="of" target="section-appendix.a"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-examples">Examples</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.8.2">
              <li pn="section-toc.1-1.8.2.1">
                <t indent="0" pn="section-toc.1-1.8.2.1.1"><xref derivedContent="A.1" format="counter" sectionFormat="of" target="section-appendix.a.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-ttc">TTC</xref></t>
              </li>
              <li pn="section-toc.1-1.8.2.2">
                <t indent="0" pn="section-toc.1-1.8.2.2.1"><xref derivedContent="A.2" format="counter" sectionFormat="of" target="section-appendix.a.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-ctt">CTT</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.9">
            <t indent="0" pn="section-toc.1-1.9.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.b"/><xref derivedContent="" format="title" sectionFormat="of" target="name-acknowledgments">Acknowledgments</xref></t>
          </li>
          <li pn="section-toc.1-1.10">
            <t indent="0" pn="section-toc.1-1.10.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.c"/><xref derivedContent="" format="title" sectionFormat="of" target="name-contributors">Contributors</xref></t>
          </li>
          <li pn="section-toc.1-1.11">
            <t indent="0" pn="section-toc.1-1.11.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.d"/><xref derivedContent="" format="title" sectionFormat="of" target="name-authors-addresses">Authors' Addresses</xref></t>
          </li>
        </ul>
      </section>
    </toc>
  </front>
  <middle>
    <section anchor="introduction" numbered="true" removeInRFC="false" toc="include" pn="section-1">
      <name slugifiedName="name-introduction">Introduction</name>
      <t indent="0" pn="section-1-1">RFC 3161 <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/> provides a method for timestamping a message digest to prove that it was created before a given time.</t>
      <t indent="0" pn="section-1-2">This document defines two new CBOR Object Signing and Encryption (COSE) <xref target="RFC9052" format="default" sectionFormat="of" derivedContent="RFC9052"/> header parameters that carry the <tt>TimeStampToken</tt> (TST) output <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/>, thus allowing existing and widely deployed trust infrastructure to be used with COSE structures used for signing (<tt>COSE_Sign</tt> and <tt>COSE_Sign1</tt>).</t>
      <section anchor="use-cases" numbered="true" removeInRFC="false" toc="include" pn="section-1.1">
        <name slugifiedName="name-use-cases">Use Cases</name>
        <t indent="0" pn="section-1.1-1">This section discusses two use cases, each representing one of the two modes of use defined in <xref target="modes" format="default" sectionFormat="of" derivedContent="Section 2"/>.
As the security characteristics of the two cases differ, care must be taken when choosing the appropriate mode for a given application.
See <xref target="sec-sema-confusion-avoidance" format="default" sectionFormat="of" derivedContent="Section 5.1"/> for a discussion on the security of the implementations.</t>
        <t indent="0" pn="section-1.1-2">The primary use case is that of "long-term signatures", i.e., signatures that can still be verified even after the signing certificate has expired.
This can address situations where it is important to prevent subsequent denial by the signer or to verify signatures made using (very) short-term certificates.
To achieve this, the document signer acquires a fresh TST for the document's signature from a trusted Time Stamping Authority (TSA) <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/> and concatenates it with the document.
Later, when a relying party verifies the signed document and its associated TST, they can be certain that the document was signed <em>at least</em> at the time specified by the TSA and that the signing certificate was valid at the time the signature was made.
</t>
        <t indent="0" pn="section-1.1-3">This primary usage scenario motivates the "COSE, Then Timestamp" mode described in <xref target="sec-cose-then-timestamp" format="default" sectionFormat="of" derivedContent="Section 2.1"/>.</t>
        <t indent="0" pn="section-1.1-4">The second use case is new.
It is the notarization of a signed document by registering it with a transparency service.
This is common practice for ensuring the accountability and auditability of issued documents, which are typically referred to as "statements" in this context.
It is also common practice to only register the signed parts of a statement (the "signed statement" portion) with a transparency service, in order to reduce the complexity of consistency checks at a later stage and to avoid the need to retrieve or reconstruct unsigned parts.
Once the signed parts of a document have been registered in the append-only log at a transparency service, the log entry cannot be changed.
In order to avoid losing the TST during the registration process, the TST must be included in the signed statement.
To achieve this, the issuer acquires a TST from a TSA, includes it in the to-be-signed part of the statement so that the resulting signed statement includes the TST, and then registers the signed parts (rendering it a "transparent statement").
Later on, a relying party consuming the transparent statement including the TST can be certain that the statement was signed by the issuer <em>at least</em> at the time specified by the TSA.
If the issuer's signing key has expired (or has been compromised), the authenticity of the statement can be ascertained by ensuring that no revocation information was made public before the time asserted by the issuer and registered at the transparency service.
</t>
        <t indent="0" pn="section-1.1-5">This new usage scenario motivates the "Timestamp, Then COSE" mode defined in <xref target="sec-timestamp-then-cose" format="default" sectionFormat="of" derivedContent="Section 2.2"/>.</t>
      </section>
      <section anchor="requirements-notation" numbered="true" removeInRFC="false" toc="include" pn="section-1.2">
        <name slugifiedName="name-requirements-notation">Requirements Notation</name>
        <t indent="0" pn="section-1.2-1">The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>",
       "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>",
       "<bcp14>SHALL NOT</bcp14>", "<bcp14>SHOULD</bcp14>",
       "<bcp14>SHOULD NOT</bcp14>",
       "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
       "<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document
       are to be interpreted as described in BCP 14
       <xref target="RFC2119" format="default" sectionFormat="of" derivedContent="RFC2119"/> <xref target="RFC8174" format="default" sectionFormat="of" derivedContent="RFC8174"/> when, and only
       when, they appear in all capitals, as shown here.</t>
      </section>
    </section>
    <section anchor="modes" numbered="true" removeInRFC="false" toc="include" pn="section-2">
      <name slugifiedName="name-modes-of-use">Modes of Use</name>
      <t indent="0" pn="section-2-1">There are two different modes of composing COSE protection and timestamping, motivated by the usage scenarios discussed above.</t>
      <t indent="0" pn="section-2-2">The diagrams in this section illustrate the processing flow of the specified modes.
For simplicity, only the <tt>COSE_Sign1</tt> processing is shown.
Similar diagrams for <tt>COSE_Sign</tt> can be derived by allowing multiple <tt>private-key</tt> parallelogram boxes and replacing the label <tt>[signature]</tt> with <tt>[signatures]</tt>.</t>
      <section anchor="sec-cose-then-timestamp" numbered="true" removeInRFC="false" toc="include" pn="section-2.1">
        <name slugifiedName="name-cose-then-timestamp-ctt">COSE, Then Timestamp (CTT)</name>
        <t indent="0" pn="section-2.1-1"><xref target="fig-cose-then-timestamp" format="default" sectionFormat="of" derivedContent="Figure 1"/> shows the case where the signature(s) field of the COSE Signed Message is digested and submitted to a TSA to be timestamped.
The obtained timestamp token is then added back as an unprotected header into the same COSE object.</t>
        <t indent="0" pn="section-2.1-2">This mode is utilized when a record of the timing of the signature operation is desired.</t>
        <figure anchor="fig-cose-then-timestamp" align="left" suppress-title="false" pn="figure-1">
          <name slugifiedName="name-cose-then-timestamp-ctt-2">COSE, Then Timestamp (CTT)</name>
          <artset pn="section-2.1-3.1">
            <artwork type="svg" align="center" pn="section-2.1-3.1.1"><svg xmlns="http://www.w3.org/2000/svg" version="1.1" height="448" width="616" viewBox="0 0 616 448" class="diagram" text-anchor="middle" font-family="monospace" font-size="13px">
                <path d="M 8,32 L 8,288" fill="none" stroke="black"/>
                <path d="M 48,224 L 48,336" fill="none" stroke="black"/>
                <path d="M 48,368 L 48,400" fill="none" stroke="black"/>
                <path d="M 72,112 L 72,184" fill="none" stroke="black"/>
                <path d="M 80,32 L 80,64" fill="none" stroke="black"/>
                <path d="M 96,400 L 96,432" fill="none" stroke="black"/>
                <path d="M 160,320 L 160,336" fill="none" stroke="black"/>
                <path d="M 160,368 L 160,392" fill="none" stroke="black"/>
                <path d="M 168,80 L 168,112" fill="none" stroke="black"/>
                <path d="M 200,112 L 200,144" fill="none" stroke="black"/>
                <path d="M 224,176 L 224,224" fill="none" stroke="black"/>
                <path d="M 232,240 L 232,272" fill="none" stroke="black"/>
                <path d="M 264,80 L 264,112" fill="none" stroke="black"/>
                <path d="M 264,368 L 264,392" fill="none" stroke="black"/>
                <path d="M 280,80 L 280,112" fill="none" stroke="black"/>
                <path d="M 296,240 L 296,272" fill="none" stroke="black"/>
                <path d="M 304,176 L 304,224" fill="none" stroke="black"/>
                <path d="M 312,112 L 312,128" fill="none" stroke="black"/>
                <path d="M 312,400 L 312,432" fill="none" stroke="black"/>
                <path d="M 320,304 L 320,384" fill="none" stroke="black"/>
                <path d="M 344,80 L 344,112" fill="none" stroke="black"/>
                <path d="M 352,336 L 352,368" fill="none" stroke="black"/>
                <path d="M 360,64 L 360,200" fill="none" stroke="black"/>
                <path d="M 360,216 L 360,248" fill="none" stroke="black"/>
                <path d="M 360,264 L 360,288" fill="none" stroke="black"/>
                <path d="M 376,384 L 376,400" fill="none" stroke="black"/>
                <path d="M 384,32 L 384,288" fill="none" stroke="black"/>
                <path d="M 400,336 L 400,368" fill="none" stroke="black"/>
                <path d="M 432,32 L 432,64" fill="none" stroke="black"/>
                <path d="M 432,304 L 432,344" fill="none" stroke="black"/>
                <path d="M 432,360 L 432,384" fill="none" stroke="black"/>
                <path d="M 456,112 L 456,160" fill="none" stroke="black"/>
                <path d="M 456,192 L 456,232" fill="none" stroke="black"/>
                <path d="M 464,288 L 464,336" fill="none" stroke="black"/>
                <path d="M 544,64 L 544,288" fill="none" stroke="black"/>
                <path d="M 8,32 L 80,32" fill="none" stroke="black"/>
                <path d="M 384,32 L 432,32" fill="none" stroke="black"/>
                <path d="M 8,64 L 360,64" fill="none" stroke="black"/>
                <path d="M 384,64 L 544,64" fill="none" stroke="black"/>
                <path d="M 40,80 L 152,80" fill="none" stroke="black"/>
                <path d="M 168,80 L 264,80" fill="none" stroke="black"/>
                <path d="M 280,80 L 344,80" fill="none" stroke="black"/>
                <path d="M 416,80 L 528,80" fill="none" stroke="black"/>
                <path d="M 24,112 L 136,112" fill="none" stroke="black"/>
                <path d="M 168,112 L 264,112" fill="none" stroke="black"/>
                <path d="M 280,112 L 344,112" fill="none" stroke="black"/>
                <path d="M 400,112 L 512,112" fill="none" stroke="black"/>
                <path d="M 72,144 L 296,144" fill="none" stroke="black"/>
                <path d="M 224,176 L 304,176" fill="none" stroke="black"/>
                <path d="M 40,192 L 104,192" fill="none" stroke="black"/>
                <path d="M 160,192 L 184,192" fill="none" stroke="black"/>
                <path d="M 120,208 L 136,208" fill="none" stroke="black"/>
                <path d="M 200,208 L 216,208" fill="none" stroke="black"/>
                <path d="M 304,208 L 376,208" fill="none" stroke="black"/>
                <path d="M 40,224 L 104,224" fill="none" stroke="black"/>
                <path d="M 160,224 L 184,224" fill="none" stroke="black"/>
                <path d="M 224,224 L 304,224" fill="none" stroke="black"/>
                <path d="M 232,240 L 296,240" fill="none" stroke="black"/>
                <path d="M 432,240 L 496,240" fill="none" stroke="black"/>
                <path d="M 296,256 L 376,256" fill="none" stroke="black"/>
                <path d="M 232,272 L 296,272" fill="none" stroke="black"/>
                <path d="M 432,272 L 496,272" fill="none" stroke="black"/>
                <path d="M 8,288 L 40,288" fill="none" stroke="black"/>
                <path d="M 56,288 L 360,288" fill="none" stroke="black"/>
                <path d="M 384,288 L 544,288" fill="none" stroke="black"/>
                <path d="M 320,304 L 432,304" fill="none" stroke="black"/>
                <path d="M 48,320 L 248,320" fill="none" stroke="black"/>
                <path d="M 352,336 L 400,336" fill="none" stroke="black"/>
                <path d="M 408,352 L 448,352" fill="none" stroke="black"/>
                <path d="M 352,368 L 400,368" fill="none" stroke="black"/>
                <path d="M 320,384 L 432,384" fill="none" stroke="black"/>
                <path d="M 96,400 L 312,400" fill="none" stroke="black"/>
                <path d="M 64,416 L 88,416" fill="none" stroke="black"/>
                <path d="M 320,416 L 360,416" fill="none" stroke="black"/>
                <path d="M 96,432 L 312,432" fill="none" stroke="black"/>
                <path d="M 24,112 L 40,80" fill="none" stroke="black"/>
                <path d="M 136,112 L 152,80" fill="none" stroke="black"/>
                <path d="M 400,112 L 416,80" fill="none" stroke="black"/>
                <path d="M 512,112 L 528,80" fill="none" stroke="black"/>
                <path d="M 296,144 C 304.83064,144 312,136.83064 312,128" fill="none" stroke="black"/>
                <path d="M 456,160 C 447.16936,160 440,167.16936 440,176" fill="none" stroke="black"/>
                <path d="M 456,160 C 464.83064,160 472,167.16936 472,176" fill="none" stroke="black"/>
                <path d="M 40,192 C 31.16936,192 24,199.16936 24,208" fill="none" stroke="black"/>
                <path d="M 104,192 C 112.83064,192 120,199.16936 120,208" fill="none" stroke="black"/>
                <path d="M 160,192 C 151.16936,192 144,199.16936 144,208" fill="none" stroke="black"/>
                <path d="M 184,192 C 192.83064,192 200,199.16936 200,208" fill="none" stroke="black"/>
                <path d="M 456,192 C 447.16936,192 440,184.83064 440,176" fill="none" stroke="black"/>
                <path d="M 456,192 C 464.83064,192 472,184.83064 472,176" fill="none" stroke="black"/>
                <path d="M 40,224 C 31.16936,224 24,216.83064 24,208" fill="none" stroke="black"/>
                <path d="M 104,224 C 112.83064,224 120,216.83064 120,208" fill="none" stroke="black"/>
                <path d="M 160,224 C 151.16936,224 144,216.83064 144,208" fill="none" stroke="black"/>
                <path d="M 184,224 C 192.83064,224 200,216.83064 200,208" fill="none" stroke="black"/>
                <path d="M 432,240 C 423.16936,240 416,247.16936 416,256" fill="none" stroke="black"/>
                <path d="M 496,240 C 504.83064,240 512,247.16936 512,256" fill="none" stroke="black"/>
                <path d="M 432,272 C 423.16936,272 416,264.83064 416,256" fill="none" stroke="black"/>
                <path d="M 496,272 C 504.83064,272 512,264.83064 512,256" fill="none" stroke="black"/>
                <path d="M 248,320 C 256.83064,320 264,327.16936 264,336" fill="none" stroke="black"/>
                <path d="M 448,352 C 456.83064,352 464,344.83064 464,336" fill="none" stroke="black"/>
                <path d="M 64,416 C 55.16936,416 48,408.83064 48,400" fill="none" stroke="black"/>
                <path d="M 360,416 C 368.83064,416 376,408.83064 376,400" fill="none" stroke="black"/>
                <polygon class="arrowhead" points="464,232 452,226.4 452,237.6" fill="black" transform="rotate(90,456,232)"/>
                <polygon class="arrowhead" points="416,352 404,346.4 404,357.6" fill="black" transform="rotate(180,408,352)"/>
                <polygon class="arrowhead" points="384,256 372,250.4 372,261.6" fill="black" transform="rotate(0,376,256)"/>
                <polygon class="arrowhead" points="384,208 372,202.4 372,213.6" fill="black" transform="rotate(0,376,208)"/>
                <polygon class="arrowhead" points="328,416 316,410.4 316,421.6" fill="black" transform="rotate(180,320,416)"/>
                <polygon class="arrowhead" points="272,392 260,386.4 260,397.6" fill="black" transform="rotate(90,264,392)"/>
                <polygon class="arrowhead" points="224,208 212,202.4 212,213.6" fill="black" transform="rotate(0,216,208)"/>
                <polygon class="arrowhead" points="168,392 156,386.4 156,397.6" fill="black" transform="rotate(90,160,392)"/>
                <polygon class="arrowhead" points="144,208 132,202.4 132,213.6" fill="black" transform="rotate(0,136,208)"/>
                <polygon class="arrowhead" points="96,416 84,410.4 84,421.6" fill="black" transform="rotate(0,88,416)"/>
                <polygon class="arrowhead" points="80,184 68,178.4 68,189.6" fill="black" transform="rotate(90,72,184)"/>
                <g class="text">
                  <text x="44" y="52">Signer</text>
                  <text x="408" y="52">TSA</text>
                  <text x="88" y="100">private-key</text>
                  <text x="216" y="100">protected</text>
                  <text x="312" y="100">datum</text>
                  <text x="464" y="100">private-key</text>
                  <text x="456" y="180">L</text>
                  <text x="504" y="180">Clock</text>
                  <text x="264" y="196">Message</text>
                  <text x="72" y="212">Sign1</text>
                  <text x="172" y="212">hash</text>
                  <text x="264" y="212">Imprint</text>
                  <text x="264" y="260">nonce</text>
                  <text x="464" y="260">timestamp</text>
                  <text x="376" y="324">unprotected</text>
                  <text x="48" y="356">[protected]</text>
                  <text x="160" y="356">[payload]</text>
                  <text x="264" y="356">[signature]</text>
                  <text x="376" y="356">TST</text>
                  <text x="184" y="420">rfc3161-ctt</text>
                  <text x="252" y="420">COSE</text>
                </g>
              </svg>
            </artwork>
            <artwork type="ascii-art" align="center" pn="section-2.1-3.1.2">
.--------.                                     .-----.
| Signer |                                     | TSA |
+--------+----------------------------------.  +-----+-------------.
|   .-------------. .-----------. .-------. |  |   .-------------. |
|  / private-key /  | protected | | datum | |  |  / private-key /  |
| '-----+-------'   '---+-------' '---+---' |  | '------+------'   |
|       |               |             |     |  |        |          |
|       +---------------+------------'      |  |        |          |
|       |                                   |  |       .+.         |
|       v                  .---------.      |  |      | L | Clock  |
|  .---------.    .----.   | Message |      |  |       '+'         |
| |   Sign1   +-&gt;+ hash +-&gt;+ Imprint +--------&gt;|        |          |
|  '-+-------'    '----'   '---------'      |  |        v          |
|    |                      .-------.       |  |    .---------.    |
|    |                      | nonce +---------&gt;|   | timestamp |   |
|    |                      '-------'       |  |    '---------'    |
'----|--------------------------------------'  '---------+---------'
     |                                 .-------------.   |
     +-------------+-----------+       | unprotected |   |
     |             |            |      |   .-----.   |   |
[protected]    [payload]   [signature] |   | TST |&lt;-----'
     |             |            |      |   '-----'   |
     |             v            v      '------+------'
     |     .-------+------------+-----.       |
      '---&gt;+     rfc3161-ctt COSE     +&lt;-----'
           '--------------------------'
</artwork>
          </artset>
        </figure>
        <t indent="0" pn="section-2.1-4">In this context, timestamp tokens are similar to a countersignature made by the TSA.</t>
      </section>
      <section anchor="sec-timestamp-then-cose" numbered="true" removeInRFC="false" toc="include" pn="section-2.2">
        <name slugifiedName="name-timestamp-then-cose-ttc">Timestamp, Then COSE (TTC)</name>
        <t indent="0" pn="section-2.2-1"><xref target="fig-timestamp-then-cose" format="default" sectionFormat="of" derivedContent="Figure 2"/> shows the case where a datum is first digested and submitted to a TSA to be timestamped.</t>
        <t indent="0" pn="section-2.2-2">This mode is used to wrap the signed document and its timestamp together in an immutable payload.</t>
        <t indent="0" pn="section-2.2-3">A COSE Signed Message is then built as follows:</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-2.2-4">
          <li pn="section-2.2-4.1">The obtained timestamp token is added to the protected headers.</li>
          <li pn="section-2.2-4.2">The original datum becomes the payload of the COSE Signed Message.</li>
        </ul>
        <figure anchor="fig-timestamp-then-cose" align="left" suppress-title="false" pn="figure-2">
          <name slugifiedName="name-timestamp-then-cose-ttc-2">Timestamp, Then COSE (TTC)</name>
          <artset pn="section-2.2-5.1">
            <artwork type="svg" align="center" pn="section-2.2-5.1.1"><svg xmlns="http://www.w3.org/2000/svg" version="1.1" height="464" width="616" viewBox="0 0 616 464" class="diagram" text-anchor="middle" font-family="monospace" font-size="13px">
                <path d="M 8,32 L 8,304" fill="none" stroke="black"/>
                <path d="M 40,112 L 40,232" fill="none" stroke="black"/>
                <path d="M 48,272 L 48,352" fill="none" stroke="black"/>
                <path d="M 48,384 L 48,416" fill="none" stroke="black"/>
                <path d="M 64,144 L 64,176" fill="none" stroke="black"/>
                <path d="M 80,32 L 80,64" fill="none" stroke="black"/>
                <path d="M 80,176 L 80,232" fill="none" stroke="black"/>
                <path d="M 96,416 L 96,448" fill="none" stroke="black"/>
                <path d="M 128,144 L 128,176" fill="none" stroke="black"/>
                <path d="M 160,336 L 160,352" fill="none" stroke="black"/>
                <path d="M 160,384 L 160,408" fill="none" stroke="black"/>
                <path d="M 208,208 L 208,288" fill="none" stroke="black"/>
                <path d="M 232,128 L 232,176" fill="none" stroke="black"/>
                <path d="M 240,80 L 240,112" fill="none" stroke="black"/>
                <path d="M 240,240 L 240,272" fill="none" stroke="black"/>
                <path d="M 264,384 L 264,408" fill="none" stroke="black"/>
                <path d="M 288,240 L 288,272" fill="none" stroke="black"/>
                <path d="M 304,80 L 304,112" fill="none" stroke="black"/>
                <path d="M 312,128 L 312,176" fill="none" stroke="black"/>
                <path d="M 312,416 L 312,448" fill="none" stroke="black"/>
                <path d="M 320,208 L 320,248" fill="none" stroke="black"/>
                <path d="M 320,264 L 320,288" fill="none" stroke="black"/>
                <path d="M 320,320 L 320,400" fill="none" stroke="black"/>
                <path d="M 352,352 L 352,384" fill="none" stroke="black"/>
                <path d="M 360,64 L 360,88" fill="none" stroke="black"/>
                <path d="M 360,104 L 360,152" fill="none" stroke="black"/>
                <path d="M 360,168 L 360,248" fill="none" stroke="black"/>
                <path d="M 360,264 L 360,304" fill="none" stroke="black"/>
                <path d="M 376,400 L 376,416" fill="none" stroke="black"/>
                <path d="M 384,32 L 384,304" fill="none" stroke="black"/>
                <path d="M 400,352 L 400,384" fill="none" stroke="black"/>
                <path d="M 432,32 L 432,64" fill="none" stroke="black"/>
                <path d="M 432,320 L 432,400" fill="none" stroke="black"/>
                <path d="M 456,112 L 456,160" fill="none" stroke="black"/>
                <path d="M 456,192 L 456,232" fill="none" stroke="black"/>
                <path d="M 544,64 L 544,304" fill="none" stroke="black"/>
                <path d="M 8,32 L 80,32" fill="none" stroke="black"/>
                <path d="M 384,32 L 432,32" fill="none" stroke="black"/>
                <path d="M 8,64 L 360,64" fill="none" stroke="black"/>
                <path d="M 384,64 L 544,64" fill="none" stroke="black"/>
                <path d="M 40,80 L 152,80" fill="none" stroke="black"/>
                <path d="M 240,80 L 304,80" fill="none" stroke="black"/>
                <path d="M 416,80 L 528,80" fill="none" stroke="black"/>
                <path d="M 304,96 L 376,96" fill="none" stroke="black"/>
                <path d="M 24,112 L 136,112" fill="none" stroke="black"/>
                <path d="M 240,112 L 304,112" fill="none" stroke="black"/>
                <path d="M 400,112 L 512,112" fill="none" stroke="black"/>
                <path d="M 232,128 L 312,128" fill="none" stroke="black"/>
                <path d="M 64,144 L 128,144" fill="none" stroke="black"/>
                <path d="M 168,144 L 192,144" fill="none" stroke="black"/>
                <path d="M 128,160 L 144,160" fill="none" stroke="black"/>
                <path d="M 208,160 L 224,160" fill="none" stroke="black"/>
                <path d="M 312,160 L 376,160" fill="none" stroke="black"/>
                <path d="M 64,176 L 128,176" fill="none" stroke="black"/>
                <path d="M 168,176 L 192,176" fill="none" stroke="black"/>
                <path d="M 232,176 L 312,176" fill="none" stroke="black"/>
                <path d="M 208,208 L 320,208" fill="none" stroke="black"/>
                <path d="M 40,240 L 88,240" fill="none" stroke="black"/>
                <path d="M 240,240 L 288,240" fill="none" stroke="black"/>
                <path d="M 432,240 L 496,240" fill="none" stroke="black"/>
                <path d="M 112,256 L 208,256" fill="none" stroke="black"/>
                <path d="M 296,256 L 384,256" fill="none" stroke="black"/>
                <path d="M 40,272 L 88,272" fill="none" stroke="black"/>
                <path d="M 240,272 L 288,272" fill="none" stroke="black"/>
                <path d="M 432,272 L 496,272" fill="none" stroke="black"/>
                <path d="M 208,288 L 320,288" fill="none" stroke="black"/>
                <path d="M 8,304 L 40,304" fill="none" stroke="black"/>
                <path d="M 56,304 L 360,304" fill="none" stroke="black"/>
                <path d="M 384,304 L 544,304" fill="none" stroke="black"/>
                <path d="M 320,320 L 432,320" fill="none" stroke="black"/>
                <path d="M 48,336 L 248,336" fill="none" stroke="black"/>
                <path d="M 352,352 L 400,352" fill="none" stroke="black"/>
                <path d="M 352,384 L 400,384" fill="none" stroke="black"/>
                <path d="M 320,400 L 432,400" fill="none" stroke="black"/>
                <path d="M 96,416 L 312,416" fill="none" stroke="black"/>
                <path d="M 64,432 L 88,432" fill="none" stroke="black"/>
                <path d="M 320,432 L 360,432" fill="none" stroke="black"/>
                <path d="M 96,448 L 312,448" fill="none" stroke="black"/>
                <path d="M 24,112 L 40,80" fill="none" stroke="black"/>
                <path d="M 136,112 L 152,80" fill="none" stroke="black"/>
                <path d="M 400,112 L 416,80" fill="none" stroke="black"/>
                <path d="M 512,112 L 528,80" fill="none" stroke="black"/>
                <path d="M 168,144 C 159.16936,144 152,151.16936 152,160" fill="none" stroke="black"/>
                <path d="M 192,144 C 200.83064,144 208,151.16936 208,160" fill="none" stroke="black"/>
                <path d="M 456,160 C 447.16936,160 440,167.16936 440,176" fill="none" stroke="black"/>
                <path d="M 456,160 C 464.83064,160 472,167.16936 472,176" fill="none" stroke="black"/>
                <path d="M 168,176 C 159.16936,176 152,168.83064 152,160" fill="none" stroke="black"/>
                <path d="M 192,176 C 200.83064,176 208,168.83064 208,160" fill="none" stroke="black"/>
                <path d="M 456,192 C 447.16936,192 440,184.83064 440,176" fill="none" stroke="black"/>
                <path d="M 456,192 C 464.83064,192 472,184.83064 472,176" fill="none" stroke="black"/>
                <path d="M 40,240 C 31.16936,240 24,247.16936 24,256" fill="none" stroke="black"/>
                <path d="M 88,240 C 96.83064,240 104,247.16936 104,256" fill="none" stroke="black"/>
                <path d="M 432,240 C 423.16936,240 416,247.16936 416,256" fill="none" stroke="black"/>
                <path d="M 496,240 C 504.83064,240 512,247.16936 512,256" fill="none" stroke="black"/>
                <path d="M 40,272 C 31.16936,272 24,264.83064 24,256" fill="none" stroke="black"/>
                <path d="M 88,272 C 96.83064,272 104,264.83064 104,256" fill="none" stroke="black"/>
                <path d="M 432,272 C 423.16936,272 416,264.83064 416,256" fill="none" stroke="black"/>
                <path d="M 496,272 C 504.83064,272 512,264.83064 512,256" fill="none" stroke="black"/>
                <path d="M 248,336 C 256.83064,336 264,343.16936 264,352" fill="none" stroke="black"/>
                <path d="M 64,432 C 55.16936,432 48,424.83064 48,416" fill="none" stroke="black"/>
                <path d="M 360,432 C 368.83064,432 376,424.83064 376,416" fill="none" stroke="black"/>
                <polygon class="arrowhead" points="464,232 452,226.4 452,237.6" fill="black" transform="rotate(90,456,232)"/>
                <polygon class="arrowhead" points="384,160 372,154.4 372,165.6" fill="black" transform="rotate(0,376,160)"/>
                <polygon class="arrowhead" points="384,96 372,90.4 372,101.6" fill="black" transform="rotate(0,376,96)"/>
                <polygon class="arrowhead" points="328,432 316,426.4 316,437.6" fill="black" transform="rotate(180,320,432)"/>
                <polygon class="arrowhead" points="304,256 292,250.4 292,261.6" fill="black" transform="rotate(180,296,256)"/>
                <polygon class="arrowhead" points="272,408 260,402.4 260,413.6" fill="black" transform="rotate(90,264,408)"/>
                <polygon class="arrowhead" points="232,160 220,154.4 220,165.6" fill="black" transform="rotate(0,224,160)"/>
                <polygon class="arrowhead" points="168,408 156,402.4 156,413.6" fill="black" transform="rotate(90,160,408)"/>
                <polygon class="arrowhead" points="152,160 140,154.4 140,165.6" fill="black" transform="rotate(0,144,160)"/>
                <polygon class="arrowhead" points="120,256 108,250.4 108,261.6" fill="black" transform="rotate(180,112,256)"/>
                <polygon class="arrowhead" points="96,432 84,426.4 84,437.6" fill="black" transform="rotate(0,88,432)"/>
                <polygon class="arrowhead" points="88,232 76,226.4 76,237.6" fill="black" transform="rotate(90,80,232)"/>
                <polygon class="arrowhead" points="48,232 36,226.4 36,237.6" fill="black" transform="rotate(90,40,232)"/>
                <g class="text">
                  <text x="44" y="52">Signer</text>
                  <text x="408" y="52">TSA</text>
                  <text x="88" y="100">private-key</text>
                  <text x="272" y="100">nonce</text>
                  <text x="464" y="100">private-key</text>
                  <text x="272" y="148">Message</text>
                  <text x="96" y="164">datum</text>
                  <text x="180" y="164">hash</text>
                  <text x="272" y="164">Imprint</text>
                  <text x="456" y="180">L</text>
                  <text x="504" y="180">Clock</text>
                  <text x="264" y="228">protected</text>
                  <text x="64" y="260">Sign1</text>
                  <text x="264" y="260">TST</text>
                  <text x="464" y="260">timestamp</text>
                  <text x="376" y="340">unprotected</text>
                  <text x="48" y="372">[protected]</text>
                  <text x="160" y="372">[payload]</text>
                  <text x="264" y="372">[signature]</text>
                  <text x="376" y="372">...</text>
                  <text x="184" y="436">rfc3161-ttc</text>
                  <text x="252" y="436">COSE</text>
                </g>
              </svg>
            </artwork>
            <artwork type="ascii-art" align="center" pn="section-2.2-5.1.2">
.--------.                                     .-----.
| Signer |                                     | TSA |
+--------+----------------------------------.  +-----+-------------.
|   .-------------.          .-------.      |  |   .-------------. |
|  / private-key /           | nonce +--------&gt;+  / private-key /  |
| '-+-----------'            '-------'      |  | '------+------'   |
|   |                       .---------.     |  |        |          |
|   |  .-------.   .----.   | Message |     |  |        |          |
|   |  + datum +-&gt;+ hash +-&gt;+ Imprint +-------&gt;+       .+.         |
|   |  '-+-----'   '----'   '---------'     |  |      | L | Clock  |
|   |    |                                  |  |       '+'         |
|   |    |               .-------------.    |  |        |          |
|   v    v               |  protected  |    |  |        v          |
|  .-------.             |   .-----.   |    |  |    .---------.    |
| |  Sign1  +&lt;-----------+   | TST |&lt;----------+   | timestamp |   |
|  '-+-----'             |   '-----'   |    |  |    '---------'    |
|    |                   '-------------'    |  |                   |
'----|--------------------------------------'  '-------------------'
     |                                 .-------------.
     +-------------+-----------+       | unprotected |
     |             |            |      |   .-----.   |
[protected]    [payload]   [signature] |   | ... |   |
     |             |            |      |   '-----'   |
     |             v            v      '------+------'
     |     .-------+------------+-----.       |
      '---&gt;+     rfc3161-ttc COSE     +&lt;-----'
           '--------------------------'
</artwork>
          </artset>
        </figure>
      </section>
    </section>
    <section anchor="sec-tst-hdr" numbered="true" removeInRFC="false" toc="include" pn="section-3">
      <name slugifiedName="name-timestamp-tokens-per-rfc-31">Timestamp Tokens per RFC 3161: COSE Header Parameters</name>
      <t indent="0" pn="section-3-1">The two modes described in Sections <xref target="sec-timestamp-then-cose" format="counter" sectionFormat="of" derivedContent="2.2"/> and <xref target="sec-cose-then-timestamp" format="counter" sectionFormat="of" derivedContent="2.1"/> use different inputs into the timestamping machinery and consequently create different kinds of bindings between COSE and TST.
To clearly separate their semantics, two different COSE header parameters are defined as described in the following subsections.</t>
      <section anchor="sec-tst-hdr-ctt" numbered="true" removeInRFC="false" toc="include" pn="section-3.1">
        <name slugifiedName="name-3161-ctt"><tt>3161-ctt</tt></name>
        <t indent="0" pn="section-3.1-1">The <tt>3161-ctt</tt> COSE <em>unprotected</em> header parameter <bcp14>MUST</bcp14> be used for the mode described in <xref target="sec-cose-then-timestamp" format="default" sectionFormat="of" derivedContent="Section 2.1"/>.</t>
        <t indent="0" pn="section-3.1-2">The <tt>3161-ctt</tt> unprotected header parameter contains a DER-encoded TST <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/> wrapped in a CBOR byte string (Major type 2).</t>
        <t indent="0" pn="section-3.1-3">The <tt>MessageImprint</tt> sent in the request to the TSA <bcp14>MUST</bcp14> be</t>
        <ul spacing="normal" bare="false" empty="false" indent="3" pn="section-3.1-4">
          <li pn="section-3.1-4.1">the hash of the CBOR-encoded signature field of the <tt>COSE_Sign1</tt> message, or</li>
          <li pn="section-3.1-4.2">the hash of the CBOR-encoded signatures field of the <tt>COSE_Sign</tt> message.</li>
        </ul>
        <t indent="0" pn="section-3.1-5">In either case, to minimize dependencies, the hash algorithm <bcp14>SHOULD</bcp14> be the same as the algorithm used for signing the COSE message.
This may not be possible if the timestamp token has been obtained outside the processing context in which the COSE object is assembled.</t>
        <t indent="0" pn="section-3.1-6">Refer to Sections <xref target="ctt-sign1" format="counter" sectionFormat="of" derivedContent="3.1.1"/> and <xref target="ctt-sign" format="counter" sectionFormat="of" derivedContent="3.1.2"/> for concrete examples of <tt>MessageImprint</tt> computation.</t>
        <section anchor="ctt-sign1" numbered="true" removeInRFC="false" toc="include" pn="section-3.1.1">
          <name slugifiedName="name-messageimprint-computation-"><tt>MessageImprint</tt> Computation for <tt>COSE_Sign1</tt></name>
          <t indent="0" pn="section-3.1.1-1">The following illustrates how <tt>MessageImprint</tt> is computed using a sample <tt>COSE_Sign1</tt> message.</t>
          <t indent="0" pn="section-3.1.1-2">Given the <tt>COSE_Sign1</tt> message</t>
          <sourcecode type="cbor-diag" markers="false" pn="section-3.1.1-3">
18(
  [
    / protected h'a10126' / &lt;&lt; {
        / alg / 1:-7 / ECDSA 256 /
      } &gt;&gt;,
    / unprotected / {
      / kid / 4:'11'
    },
    / payload / 'This is the content.',
    / signature / h'8eb33e4ca31d1c465ab05aac34cc6b23d58fef5c083106c4
d25a91aef0b0117e2af9a291aa32e14ab834dc56ed2a223444547e01f11d3b0916e5
a4c345cacb36'
  ]
)
</sourcecode>
          <t indent="0" pn="section-3.1.1-4">the <tt>bstr</tt>-wrapped <tt>signature</tt></t>
          <sourcecode type="cbor-pretty" markers="false" pn="section-3.1.1-5">
58 40                                     # bytes(64)
   8eb33e4ca31d1c465ab05aac34cc6b23
   d58fef5c083106c4d25a91aef0b0117e
   2af9a291aa32e14ab834dc56ed2a2234
   44547e01f11d3b0916e5a4c345cacb36
</sourcecode>
          <t indent="0" pn="section-3.1.1-6">(including the heading bytes <tt>0x5840</tt>) is used as input for computing the <tt>MessageImprint</tt>.</t>
          <t indent="0" pn="section-3.1.1-7">When using SHA-256, the resulting <tt>MessageImprint</tt> is</t>
          <sourcecode type="asn.1" markers="false" pn="section-3.1.1-8">
SEQUENCE {
  SEQUENCE {
    OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
    NULL
    }
  OCTET STRING
    44 C2 41 9D 13 1D 53 D5 55 84 B5 DD 33 B7 88 C2
    4E 55 1C 6D 44 B1 AF C8 B2 B8 5E 69 54 76 3B 4E
  }
</sourcecode>
        </section>
        <section anchor="ctt-sign" numbered="true" removeInRFC="false" toc="include" pn="section-3.1.2">
          <name slugifiedName="name-messageimprint-computation-f"><tt>MessageImprint</tt> Computation for <tt>COSE_Sign</tt></name>
          <t indent="0" pn="section-3.1.2-1">The following illustrates how <tt>MessageImprint</tt> is computed using a sample <tt>COSE_Sign</tt> message.</t>
          <t indent="0" pn="section-3.1.2-2">Given the <tt>COSE_Sign</tt> message</t>
          <sourcecode type="cbor-diag" markers="false" pn="section-3.1.2-3">
98(
  [
    / protected / h'',
    / unprotected / {},
    / payload / 'This is the content.',
    / signatures / [
      [
        / protected h'a10126' / &lt;&lt; {
            / alg / 1:-7 / ECDSA 256 /
          } &gt;&gt;,
        / unprotected / {
          / kid / 4:'11'
        },
        / signature / h'e2aeafd40d69d19dfe6e52077c5d7ff4e408282cbefb
5d06cbf414af2e19d982ac45ac98b8544c908b4507de1e90b717c3d34816fe926a2b
98f53afd2fa0f30a'
      ]
    ]
  ]
)
</sourcecode>
          <t indent="0" pn="section-3.1.2-4">the <tt>signatures</tt> array</t>
          <sourcecode type="cbor-pretty" markers="false" pn="section-3.1.2-5">
81                                        # array(1)
   83                                     # array(3)
      43                                  # bytes(3)
         a10126
      a1                                  # map(1)
         04                               # unsigned(4)
         42                               # bytes(2)
            3131                          # "11"
      58 40                               # bytes(64)
         e2aeafd40d69d19dfe6e52077c5d7ff4
         e408282cbefb5d06cbf414af2e19d982
         ac45ac98b8544c908b4507de1e90b717
         c3d34816fe926a2b98f53afd2fa0f30a
</sourcecode>
          <t indent="0" pn="section-3.1.2-6">is used as input for computing the <tt>MessageImprint</tt>.</t>
          <t indent="0" pn="section-3.1.2-7">When using SHA-256, the resulting <tt>MessageImprint</tt> is</t>
          <sourcecode type="asn.1" markers="false" pn="section-3.1.2-8">
SEQUENCE {
  SEQUENCE {
    OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
    NULL
    }
  OCTET STRING
    80 3F AD A2 91 2D 6B 7A 83 3A 27 BD 96 1C C0 5B
    C1 CC 16 47 59 B1 C5 6F 7A A7 71 E4 E2 15 26 F7
  }
</sourcecode>
        </section>
      </section>
      <section anchor="sec-tst-hdr-ttc" numbered="true" removeInRFC="false" toc="include" pn="section-3.2">
        <name slugifiedName="name-3161-ttc"><tt>3161-ttc</tt></name>
        <t indent="0" pn="section-3.2-1">The <tt>3161-ttc</tt> COSE <em>protected</em> header parameter <bcp14>MUST</bcp14> be used for the mode described in <xref target="sec-timestamp-then-cose" format="default" sectionFormat="of" derivedContent="Section 2.2"/>.</t>
        <t indent="0" pn="section-3.2-2">The <tt>3161-ttc</tt> protected header parameter contains a DER-encoded TST <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/> wrapped in a CBOR byte string (Major type 2).</t>
        <t indent="0" pn="section-3.2-3">The <tt>MessageImprint</tt> sent to the TSA (<xref section="2.4" sectionFormat="of" target="RFC3161" format="default" derivedLink="https://rfc-editor.org/rfc/rfc3161#section-2.4" derivedContent="RFC3161"/>) <bcp14>MUST</bcp14> be the hash of the payload of the COSE Signed Message.
This does not include the <tt>bstr</tt> wrapping -- only the payload bytes.
(For an example, see <xref target="ex-ttc" format="default" sectionFormat="of" derivedContent="Appendix A.1"/>.)</t>
        <t indent="0" pn="section-3.2-4">To minimize dependencies, the hash algorithm used for signing the COSE message <bcp14>SHOULD</bcp14> be the same as the algorithm used in the <tt>MessageImprint</tt> <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/>.
However, this may not be possible if the timestamp requester and the COSE message signer are different entities.</t>
      </section>
    </section>
    <section anchor="timestamp-processing" numbered="true" removeInRFC="false" toc="include" pn="section-4">
      <name slugifiedName="name-timestamp-processing">Timestamp Processing</name>
      <t indent="0" pn="section-4-1">Timestamp tokens <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/> use Cryptographic Message Syntax (CMS) as the signature envelope format.
<xref target="RFC5652" format="default" sectionFormat="of" derivedContent="RFC5652"/> provides details about signature verification, and <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/> provides details specific to timestamp token validation.
The payload of the signed timestamp token is the <tt>TSTInfo</tt> structure defined in <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/>, which contains the <tt>MessageImprint</tt> that was sent to the TSA.
The hash algorithm is contained in the <tt>MessageImprint</tt> structure, together with the hash itself.</t>
      <t indent="0" pn="section-4-2">As part of the signature verification, the receiver <bcp14>MUST</bcp14> make sure that the <tt>MessageImprint</tt> in the embedded timestamp token matches a hash of either the payload, signature, or signature fields, depending on the mode of use and type of COSE structure.</t>
      <t indent="0" pn="section-4-3"><xref section="B" sectionFormat="of" target="RFC3161" format="default" derivedLink="https://rfc-editor.org/rfc/rfc3161#appendix-B" derivedContent="RFC3161"/> provides an example that illustrates how timestamp tokens can be used to verify signatures of a timestamped message when utilizing X.509 certificates.</t>
    </section>
    <section anchor="security-considerations" numbered="true" removeInRFC="false" toc="include" pn="section-5">
      <name slugifiedName="name-security-considerations">Security Considerations</name>
      <t indent="0" pn="section-5-1">Please review the Security Considerations section in <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/>; these considerations apply to this document as well.</t>
      <t indent="0" pn="section-5-2">Also review the Security Considerations section in <xref target="RFC9052" format="default" sectionFormat="of" derivedContent="RFC9052"/>.
These considerations apply to this document as well, particularly with regard to the need for implementations to protect private key material.
Additionally, solutions based on the COSE header parameters defined in this document must be able to report compromised keys promptly.</t>
      <t indent="0" pn="section-5-3">The following scenario assumes that an attacker can manipulate the clocks on the COSE signer and its relying parties, but not the TSA.
It is also assumed that the TSA is a trusted third party, so the attacker cannot impersonate the TSA and create valid timestamp tokens.
In such a setting, any tampering with the COSE signer's clock does not have an impact, because once the timestamp is obtained from the TSA, it becomes the only reliable source of time.
However, in both CTT mode and TTC mode, a denial of service can occur if the attacker can adjust the relying party's clock so that the CMS validation fails.
This could disrupt the timestamp validation.</t>
      <t indent="0" pn="section-5-4">In CTT mode, an attacker could manipulate the unprotected header by removing or replacing the timestamp.
To avoid that, the COSE Signed Message should be integrity protected during transit and at rest.</t>
      <t indent="0" pn="section-5-5">In TTC mode, the TSA is given an opaque identifier (a cryptographic hash value) for the payload.
While this means that the content of the payload is not directly revealed, to prevent comparison with known payloads or disclosure of identical payloads being used over time, the payload would need to be armored, e.g., with a nonce that is shared with the recipient of the header parameter but not the TSA.
Such a mechanism is out of scope for this document.
</t>
      <t indent="0" pn="section-5-6">The resolution, accuracy, and precision of the TSA clock, as well as the expected latency introduced by round trips to and from the TSA, must be taken into account when implementing solutions based on the COSE header parameters defined in this document.</t>
      <section anchor="sec-sema-confusion-avoidance" numbered="true" removeInRFC="false" toc="include" pn="section-5.1">
        <name slugifiedName="name-avoiding-semantic-confusion">Avoiding Semantic Confusion</name>
        <t indent="0" pn="section-5.1-1">CTT mode and TTC mode have different semantic meanings.
An implementation must ensure that the contents of the CTT and TTC headers are interpreted according to their specific semantics.
In particular, symmetric to the signature and assembly mechanics, each mode has its own separate verification algorithm.</t>
        <t indent="0" pn="section-5.1-2">Implementers <bcp14>MUST</bcp14> clearly differentiate between TSA timestamps <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/> proving the existence of payload data at an earlier point in time (TTC) and timestamps explicitly providing evidence of the existence of the cryptographic signature (CTT).
Failure to clearly distinguish between these timestamp semantics can result in vulnerabilities, such as incorrectly accepting signatures created after key revocation based on older payload-only timestamps.
Validators must not interpret protected-header payload timestamps as proof of signature
creation time and should rely exclusively on TSA timestamps <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/> explicitly covering signature data for determining signature validity timing.</t>
      </section>
    </section>
    <section anchor="iana-considerations" numbered="true" removeInRFC="false" toc="include" pn="section-6">
      <name slugifiedName="name-iana-considerations">IANA Considerations</name>
      <t indent="0" pn="section-6-1">IANA has allocated the COSE header parameters defined in <xref target="tbl-new-hdrs" format="default" sectionFormat="of" derivedContent="Table 1"/> in the "COSE Header Parameters" registry <xref target="IANA.cose_header-parameters" format="default" sectionFormat="of" derivedContent="IANA.cose_header-parameters"/> as follows:</t>
      <table align="left" anchor="tbl-new-hdrs" pn="table-1">
        <name slugifiedName="name-new-cose-header-parameters">New COSE Header Parameters</name>
        <thead>
          <tr>
            <th align="left" colspan="1" rowspan="1">Name</th>
            <th align="left" colspan="1" rowspan="1">Label</th>
            <th align="left" colspan="1" rowspan="1">Value Type</th>
            <th align="left" colspan="1" rowspan="1">Value Registry</th>
            <th align="left" colspan="1" rowspan="1">Description</th>
            <th align="left" colspan="1" rowspan="1">Reference</th>
          </tr>
        </thead>
        <tbody>
          <tr>
            <td align="left" colspan="1" rowspan="1">
              <tt>3161-ttc</tt></td>
            <td align="left" colspan="1" rowspan="1">269</td>
            <td align="left" colspan="1" rowspan="1">
              <tt>bstr</tt></td>
            <td align="left" colspan="1" rowspan="1">-</td>
            <td align="left" colspan="1" rowspan="1">Timestamp Token per <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/>: Timestamp, Then COSE</td>
            <td align="left" colspan="1" rowspan="1">RFC 9921, <xref target="sec-tst-hdr-ttc" format="default" sectionFormat="of" derivedContent="Section 3.2"/></td>
          </tr>
          <tr>
            <td align="left" colspan="1" rowspan="1">
              <tt>3161-ctt</tt></td>
            <td align="left" colspan="1" rowspan="1">270</td>
            <td align="left" colspan="1" rowspan="1">
              <tt>bstr</tt></td>
            <td align="left" colspan="1" rowspan="1">-</td>
            <td align="left" colspan="1" rowspan="1">Timestamp Token per <xref target="RFC3161" format="default" sectionFormat="of" derivedContent="RFC3161"/>: COSE, Then Timestamp</td>
            <td align="left" colspan="1" rowspan="1">RFC 9921, <xref target="sec-tst-hdr-ctt" format="default" sectionFormat="of" derivedContent="Section 3.1"/></td>
          </tr>
        </tbody>
      </table>
    </section>
  </middle>
  <back>
    <references anchor="sec-normative-references" pn="section-7">
      <name slugifiedName="name-normative-references">Normative References</name>
      <reference anchor="IANA.cose_header-parameters" target="https://www.iana.org/assignments/cose" quoteTitle="true" derivedAnchor="IANA.cose_header-parameters">
        <front>
          <title>COSE Header Parameters</title>
          <author>
            <organization showOnFrontPage="true">IANA</organization>
          </author>
        </front>
      </reference>
      <reference anchor="RFC2119" target="https://www.rfc-editor.org/info/rfc2119" quoteTitle="true" derivedAnchor="RFC2119">
        <front>
          <title>Key words for use in RFCs to Indicate Requirement Levels</title>
          <author fullname="S. Bradner" initials="S." surname="Bradner"/>
          <date month="March" year="1997"/>
          <abstract>
            <t indent="0">In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="14"/>
        <seriesInfo name="RFC" value="2119"/>
        <seriesInfo name="DOI" value="10.17487/RFC2119"/>
      </reference>
      <reference anchor="RFC3161" target="https://www.rfc-editor.org/info/rfc3161" quoteTitle="true" derivedAnchor="RFC3161">
        <front>
          <title>Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)</title>
          <author fullname="C. Adams" initials="C." surname="Adams"/>
          <author fullname="P. Cain" initials="P." surname="Cain"/>
          <author fullname="D. Pinkas" initials="D." surname="Pinkas"/>
          <author fullname="R. Zuccherato" initials="R." surname="Zuccherato"/>
          <date month="August" year="2001"/>
          <abstract>
            <t indent="0">This document describes the format of a request sent to a Time Stamping Authority (TSA) and of the response that is returned. It also establishes several security-relevant requirements for TSA operation, with regards to processing requests to generate responses. [STANDARDS-TRACK]</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="3161"/>
        <seriesInfo name="DOI" value="10.17487/RFC3161"/>
      </reference>
      <reference anchor="RFC5652" target="https://www.rfc-editor.org/info/rfc5652" quoteTitle="true" derivedAnchor="RFC5652">
        <front>
          <title>Cryptographic Message Syntax (CMS)</title>
          <author fullname="R. Housley" initials="R." surname="Housley"/>
          <date month="September" year="2009"/>
          <abstract>
            <t indent="0">This document describes the Cryptographic Message Syntax (CMS). This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary message content. [STANDARDS-TRACK]</t>
          </abstract>
        </front>
        <seriesInfo name="STD" value="70"/>
        <seriesInfo name="RFC" value="5652"/>
        <seriesInfo name="DOI" value="10.17487/RFC5652"/>
      </reference>
      <reference anchor="RFC8174" target="https://www.rfc-editor.org/info/rfc8174" quoteTitle="true" derivedAnchor="RFC8174">
        <front>
          <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
          <author fullname="B. Leiba" initials="B." surname="Leiba"/>
          <date month="May" year="2017"/>
          <abstract>
            <t indent="0">RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="14"/>
        <seriesInfo name="RFC" value="8174"/>
        <seriesInfo name="DOI" value="10.17487/RFC8174"/>
      </reference>
      <reference anchor="RFC9052" target="https://www.rfc-editor.org/info/rfc9052" quoteTitle="true" derivedAnchor="RFC9052">
        <front>
          <title>CBOR Object Signing and Encryption (COSE): Structures and Process</title>
          <author fullname="J. Schaad" initials="J." surname="Schaad"/>
          <date month="August" year="2022"/>
          <abstract>
            <t indent="0">Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR.</t>
            <t indent="0">This document, along with RFC 9053, obsoletes RFC 8152.</t>
          </abstract>
        </front>
        <seriesInfo name="STD" value="96"/>
        <seriesInfo name="RFC" value="9052"/>
        <seriesInfo name="DOI" value="10.17487/RFC9052"/>
      </reference>
    </references>
    <section anchor="examples" numbered="true" removeInRFC="false" toc="include" pn="section-appendix.a">
      <name slugifiedName="name-examples">Examples</name>
      <section anchor="ex-ttc" numbered="true" removeInRFC="false" toc="include" pn="section-appendix.a.1">
        <name slugifiedName="name-ttc">TTC</name>
        <t indent="0" pn="section-appendix.a.1-1">The payload</t>
        <artwork align="left" pn="section-appendix.a.1-2">
'This is the content.'
</artwork>
        <t indent="0" pn="section-appendix.a.1-3">is hashed using SHA-256 to create the following <tt>TimeStampReq</tt> object</t>
        <sourcecode type="asn.1" markers="false" pn="section-appendix.a.1-4">
SEQUENCE {
  INTEGER 1
  SEQUENCE {
    SEQUENCE {
      OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
      NULL
      }
    OCTET STRING
      09 E6 38 D4 AA 95 FD 72 71 86 62 03 59 53 03 BC
      E2 32 F4 62 A9 4D 38 E3 93 77 3C D3 AA E3 F6 B0
    }
  BOOLEAN TRUE
  }
</sourcecode>
        <t indent="0" pn="section-appendix.a.1-5">which is sent to the TSA.</t>
        <t indent="0" pn="section-appendix.a.1-6">A <tt>TimeStampResp</tt> containing the following TST is returned:</t>
        <sourcecode type="asn.1" markers="false" pn="section-appendix.a.1-7">
SEQUENCE {
  OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
  [0] {
    SEQUENCE {
      INTEGER 3
      SET {
        SEQUENCE {
          OBJECT IDENTIFIER sha-512 (2 16 840 1 101 3 4 2 3)
          NULL
          }
        }
      SEQUENCE {
        OBJECT IDENTIFIER tSTInfo (1 2 840 113549 1 9 16 1 4)
        [0] {
          OCTET STRING, encapsulates {
            SEQUENCE {
              INTEGER 1
              OBJECT IDENTIFIER '1 2 3 4 1'
              SEQUENCE {
                SEQUENCE {
                  OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
                  NULL
                  }
                OCTET STRING
                  09 E6 38 D4 AA 95 FD 72 71 86 62 03 59 53 03 BC
                  E2 32 F4 62 A9 4D 38 E3 93 77 3C D3 AA E3 F6 B0
                }
              INTEGER 12096870
              GeneralizedTime 29/08/2025 07:45:46 GMT
              BOOLEAN TRUE
[...]
</sourcecode>
        <t indent="0" pn="section-appendix.a.1-8">The contents of the TST are <tt>bstr</tt>-wrapped and added to the protected headers bucket, which is then signed alongside the original payload to obtain the <tt>COSE_Sign1</tt> object.</t>
        <sourcecode type="cbor-diag" markers="false" pn="section-appendix.a.1-9">
18([
        &lt;&lt;{1: -7, 269: h'3082154906092a864886f70d010702a082153a308215
[encoded data, 10833 characters]
11e33482e45c9b4f948bff15eba70'}&gt;&gt;,
        {4: '11'},
        'This is the content.',
        h'f5f0f27964f178dcb2254b30fdfdc48abc4499beaea7cb80f4004f30403
f13a44bcca24fc61c5d71d3823bac04b923011dc7d31de35df1aefcd5a8ec5fe0fe6e
'
    ])
</sourcecode>
      </section>
      <section anchor="ctt" numbered="true" removeInRFC="false" toc="include" pn="section-appendix.a.2">
        <name slugifiedName="name-ctt">CTT</name>
        <t indent="0" pn="section-appendix.a.2-1">Starting with the following <tt>COSE_Sign1</tt> object,</t>
        <sourcecode type="cbor-diag" markers="false" pn="section-appendix.a.2-2">
18(
  [
    / protected h'a10126' / &lt;&lt; {
        / alg / 1:-7 / ECDSA 256 /
      } &gt;&gt;,
    / unprotected / {
      / kid / 4:'11'
    },
    / payload / 'This is the content.',
    / signature / h'8eb33e4ca31d1c465ab05aac34cc6b23d58fef5c083106c4d
25a91aef0b0117e2af9a291aa32e14ab834dc56ed2a223444547e01f11d3b0916e5a4
c345cacb36'
  ]
)
</sourcecode>
        <t indent="0" pn="section-appendix.a.2-3">the CBOR-encoded signature field is hashed using SHA-256 to create the following <tt>TimeStampReq</tt> object</t>
        <sourcecode type="asn.1" markers="false" pn="section-appendix.a.2-4">
SEQUENCE {
  INTEGER 1
  SEQUENCE {
    SEQUENCE {
      OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
      NULL
      }
    OCTET STRING
      DD 94 71 EF E7 43 C4 05 13 35 DF 8F 6D 28 82 F3
      BA DC 38 77 00 F7 ED 3F 70 91 67 2A 3E EA F7 C8
    }
  BOOLEAN TRUE
  }
</sourcecode>
        <t indent="0" pn="section-appendix.a.2-5">which is sent to the TSA.</t>
        <t indent="0" pn="section-appendix.a.2-6">A <tt>TimeStampResp</tt> containing the following TST is returned:</t>
        <sourcecode type="asn.1" markers="false" pn="section-appendix.a.2-7">
SEQUENCE {
  OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
  [0] {
    SEQUENCE {
      INTEGER 3
      SET {
        SEQUENCE {
          OBJECT IDENTIFIER sha-512 (2 16 840 1 101 3 4 2 3)
          NULL
          }
        }
      SEQUENCE {
        OBJECT IDENTIFIER tSTInfo (1 2 840 113549 1 9 16 1 4)
        [0] {
          OCTET STRING, encapsulates {
            SEQUENCE {
              INTEGER 1
              OBJECT IDENTIFIER '1 2 3 4 1'
              SEQUENCE {
                SEQUENCE {
                  OBJECT IDENTIFIER sha-256 (2 16 840 1 101 3 4 2 1)
                  NULL
                  }
                OCTET STRING
                  DD 94 71 EF E7 43 C4 05 13 35 DF 8F 6D 28 82 F3
                  BA DC 38 77 00 F7 ED 3F 70 91 67 2A 3E EA F7 C8
                }
              INTEGER 12100074
              GeneralizedTime 29/08/2025 07:53:00 GMT
              BOOLEAN TRUE
[...]
</sourcecode>
        <t indent="0" pn="section-appendix.a.2-8">The contents of the TST are <tt>bstr</tt>-wrapped and added to the unprotected headers bucket in the original <tt>COSE_Sign1</tt> object to obtain the following:</t>
        <sourcecode type="cbor-diag" markers="false" pn="section-appendix.a.2-9">
18(
  [
    / protected h'a10126' / &lt;&lt; {
        / alg / 1:-7 / ECDSA 256 /
      } &gt;&gt;,
    / unprotected / {
      / 3161-ctt / 270 : h'3082154906092a864886f70d010702a082153a3082
[encoded data, 10833 characters]
450855dcb3b2a528063d426dc30268f',
      / kid / 4:'11'
    },
    / payload / 'This is the content.',
    / signature / h'8eb33e4ca31d1c465ab05aac34cc6b23d58fef5c083106c4
d25a91aef0b0117e2af9a291aa32e14ab834dc56ed2a223444547e01f11d3b0916e5
a4c345cacb36'
  ]
)
</sourcecode>
      </section>
    </section>
    <section numbered="false" anchor="acknowledgments" removeInRFC="false" toc="include" pn="section-appendix.b">
      <name slugifiedName="name-acknowledgments">Acknowledgments</name>
      <t indent="0" pn="section-appendix.b-1">The authors would like to thank
<contact fullname="Alexey Melnikov"/>,
<contact fullname="Carl Wallace"/>,
<contact fullname="Carsten Bormann"/>,
<contact fullname="Deb Cooley"/>,
<contact fullname="Éric Vyncke"/>,
<contact fullname="Francesca Palombini"/>,
<contact fullname="Leonard Rosenthol"/>,
<contact fullname="Linda Dunbar"/>,
<contact fullname="Michael B. Jones"/>,
<contact fullname="Michael Prorock"/>,
<contact fullname="Mike Bishop"/>,
<contact fullname="Mohamed Boucadair"/>,
<contact fullname="Orie Steele"/>,
<contact fullname="Roman Danyliw"/>,
<contact fullname="Shuping Peng"/>,
<contact fullname="Stefan Santesson"/>,
<contact fullname="Steve Lasker"/>,
and
<contact fullname="Yingzhen Qu"/>
for their reviews and comments.

</t>
    </section>
    <section anchor="contributors" numbered="false" toc="include" removeInRFC="false" pn="section-appendix.c">
      <name slugifiedName="name-contributors">Contributors</name>
      <contact initials="C." surname="Bormann" fullname="Carsten Bormann">
        <organization showOnFrontPage="true"/>
        <address>
          <email>cabo@tzi.org</email>
        </address>
      </contact>
      <t indent="0" pn="section-appendix.c-1">Carsten contributed part of the security considerations.</t>
      <contact initials="O." surname="Steele" fullname="Orie Steele">
        <organization showOnFrontPage="true"/>
        <address>
          <email>orie@transmute.industries</email>
        </address>
      </contact>
      <t indent="0" pn="section-appendix.c-2">Orie contributed an improved version of the diagrams.</t>
    </section>
    <section anchor="authors-addresses" numbered="false" removeInRFC="false" toc="include" pn="section-appendix.d">
      <name slugifiedName="name-authors-addresses">Authors' Addresses</name>
      <author initials="H." surname="Birkholz" fullname="Henk Birkholz">
        <organization abbrev="Fraunhofer SIT" showOnFrontPage="true">Fraunhofer SIT</organization>
        <address>
          <postal>
            <street>Rheinstrasse 75</street>
            <city>Darmstadt</city>
            <code>64295</code>
            <country>Germany</country>
          </postal>
          <email>henk.birkholz@ietf.contact</email>
        </address>
      </author>
      <author initials="T." surname="Fossati" fullname="Thomas Fossati">
        <organization showOnFrontPage="true">Linaro</organization>
        <address>
          <email>thomas.fossati@linaro.org</email>
        </address>
      </author>
      <author initials="M." surname="Riechert" fullname="Maik Riechert">
        <organization showOnFrontPage="true">Microsoft</organization>
        <address>
          <postal>
            <country>United Kingdom</country>
          </postal>
          <email>Maik.Riechert@microsoft.com</email>
        </address>
      </author>
    </section>
  </back>
</rfc>
