Subject: [Cbor] draft-bormann-lpwan-cbor-template

From: Jim Schaad <[email-masked]>
Date: Wed, 12 Jul 2017 01:32:33 -0700

There is a security consideration that should probably be mentioned.

If a signed value includes the variables to be substituted, but does not
contain a unique identifier for the template, then the structure resulting
in substituting the variables in the template must not be considered as
having been signed.  Identifying templates by a hash or identifier and
version number is recommended.

Jim

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 12 Jul 2017 10:40:45 +0200

Hi Jim,

thank you!

I put that in (slightly changing the text about version numbers).

Will submit when the I-D directory opens again.

Grüße, Carsten

> On Jul 12, 2017, at 10:32, Jim Schaad <[email-masked]> wrote:
>