MARGINALIA · ANATOMY OF AN OBJECT

Four transmitted fields become a different structure before verification.

An expanded view of a COSE_Sign1 object contains:

COSE_Sign1 = [
  protected,
  unprotected,
  payload,
  signature
]

Those four fields are transported. They are not the byte sequence given directly to the signature algorithm. The verifier reconstructs a second CBOR structure:

Sig_structure = [
  "Signature1",
  protected,
  external_aad,
  payload
]

The protected header is included as its serialized byte string. The unprotected header is not included. External additional authenticated data is supplied by the application and may not appear in the transmitted object at all. If the payload is detached, the verifier must obtain the exact original bytes elsewhere.

This boundary explains several implementation failures. An algorithm placed only in an unprotected field is not bound by the signature. A key identifier can help locate a candidate key but does not prove that the key is acceptable. A different external context or payload representation produces a different signing input.

To debug a failed or surprising verification, inspect both objects: the structure received and the exact Sig_structure reconstructed from it.

Source: RFC 9052, Section 4.2 and Section 4.4.

Related research: The transcript is the protocol.