Deb Cooley's review

[marco-tiloca-sics]

This PR addresses the review from Deb Cooley archived at https://mailarchive.ietf.org/arch/msg/core/hewfpUmkcxXq0uKDqe93yIzzsVs/

[rikard-sics]

Looks good to me. I left one final comment.

Not sure if the part about AES-CTR can be simplified somehow, but currently it feels like the more details the better

[rikard-sics]

Building on John's comments. I'd propose the following for the main part about AES-CTR:

A non-authenticated algorithm MUST NOT be used as Group Encryption Algorithm if it is not possible to ensure uniqueness of the (key, IV) pairs, or intermediate values used in the algorithm, e.g., for algorithms that increment the IV internally.

Examples of non-authenticated algorithms that can be used as Group Encryption Algorithm are A128CTR, A192CTR, and A256CTR (see {{Section 4 of RFC9459}}). When either of those three algorithms is used, the following applies:

• The 12-byte nonce MUST be computed as defined in {{sec-cose-object-aead-nonce}} of this document. The Initialization Vector (IV) used in {{Section 4 of RFC9459}} is equivalent to this nonce (12 bytes) concatenated with 0x00000000 (4 bytes), in this order.

• The algorithm MUST NOT be used to encrypt a plaintext or decrypt a ciphertext whose length is larger than 64 GB (i.e., 2³⁶ bytes).

Future specifications can admit alternative non-authenticated algorithms that can be used as Group Encryption Algorithm. When doing so, it MUST be defined how to compose the IV in a secure manner, building on the nonce computed as defined in {{sec-cose-object-aead-nonce}} of this document. Absent such a specification, alternative non-authenticated algorithms MUST NOT be used as Group Encryption Algorithm.

Or even more brief:

Examples of non-authenticated algorithms that can be used as Group Encryption Algorithm are A128CTR, A192CTR, and A256CTR (see {{Section 4 of RFC9459}}). When either of those three algorithms is used, the following applies:

• The 12-byte nonce MUST be computed as defined in {{sec-cose-object-aead-nonce}} of this document. The Initialization Vector (IV) used in {{Section 4 of RFC9459}} is equivalent to this nonce (12 bytes) concatenated with 0x00000000 (4 bytes), in this order.

• The algorithm MUST NOT be used to encrypt a plaintext or decrypt a ciphertext whose length is larger than 64 GB (i.e., 2³⁶ bytes).