Current text:
"The kid parameter (COSE header label 4) in the CWT’s protected header SHALL be the SHA-384 digest of the Attestation Key’s certificate chain, computed in the same manner as the SPDM DIGEST response for the selected slot..."
Issue:
The kid parameter should identify the specific signing key rather than being a SHA-384 digest of the certificate chain.
Proposed resolution:
Specify kid as the 20-byte Subject Key Identifier (SKID, RFC 5280) of the leaf certificate, enabling verifiers to directly match kid == cert.extensions.subjectKeyIdentifier .
Current text:
"The kid parameter (COSE header label 4) in the CWT’s protected header SHALL be the SHA-384 digest of the Attestation Key’s certificate chain, computed in the same manner as the SPDM DIGEST response for the selected slot..."
Issue:
The
kidparameter should identify the specific signing key rather than being a SHA-384 digest of the certificate chain.Proposed resolution:
Specify
kidas the 20-byte Subject Key Identifier (SKID, RFC 5280) of the leaf certificate, enabling verifiers to directly matchkid == cert.extensions.subjectKeyIdentifier.