COSEAuthVerify

[russhousley]

For Ed256 and HSS-LMS, the signature validation routine needs the public key, the buffer that contains the (supposedly) signed content, the signature value, and the signature algorithm identifier. I suggest that this be the API for all signature validation, and in the ES256 case, the SHA-256 have value can be computed inside the ES256_verify function.

[bremoran]

It looks like the only difference between the current API and the one you've suggested is whether COSEAuthVerify does the lookup of the public key. Is that right?

[russhousley]

Yes, I think so. I have not written code yet for HSS-LMS, but that seems right.

[bremoran]

Do you think that the signature verification functions need the algorithm ID?

[russhousley]

No, I do not think so.