CBOR Object Signing and Encryption (COSE) 2017-01-11 2026-03-04 COSE Header Parameters Integers less than -65536 Private Use Integer values in the range -1 to -65536 delegated to the COSE Header Algorithm Parameters registry Integer values between 1 and 255 Standards Action With Expert Review Integer values from 256 to 65535 Specification Required Integer values greater than 65535 Expert Review Strings of length 1 Standards Action With Expert Review Strings of length 2 Specification Required Strings of length greater than 2 Expert Review Francesca Palombini, Carsten Bormann Reserved for Private Use delegated to the COSE Header Algorithm Parameters registry Reserved alg int / tstr COSE Algorithms Cryptographic algorithm to use crit [+ label] COSE Header Parameters Critical headers to be understood content type tstr / uint COAP Content-Formats or Media Types Content type of the payload kid bstr Key identifier IV bstr Full Initialization Vector Partial IV bstr Partial Initialization Vector counter signature COSE_Signature / [+ COSE_Signature ] CBOR-encoded signature structure (Deprecated by ) Unassigned CounterSignature0 bstr Counter signature with implied signer and headers (Deprecated by ) kid context bstr Identifies the context for the key identifier Countersignature version 2 COSE_Countersignature / [+ COSE_Countersignature] V2 countersignature attribute Countersignature0 version 2 COSE_Countersignature0 V2 Abbreviated Countersignature kcwt COSE_Messages A CBOR Web Token (CWT) containing a COSE_Key in a 'cnf' claim and possibly other claims. CWT is defined in . COSE_Messages is defined in . kccs map A CWT Claims Set (CCS) containing a COSE_Key in a 'cnf' claim and possibly other claims. CCS is defined in . CWT Claims map map keys in CWT Claims Location for CWT Claims in COSE Header Parameters. typ (type) uint / tstr COAP Content-Formats or Media Types Content type of the complete COSE object sd_claims (TEMPORARY - registered 2026-01-16, expires 2027-01-16) [ +bstr ] A list of selectively disclosed claims, which were originally redacted, then later disclosed at the discretion of the sender. Unassigned c5t (TEMPORARY - registered 2024-03-11, publication requested 2025-09-23) COSE_CertHash Hash of a C509Certificate c5u (TEMPORARY - registered 2024-03-11, publication requested 2025-09-23) uri URI pointing to a COSE_C509 containing an ordered chain of certificates c5b (TEMPORARY - registered 2024-03-11, publication requested 2025-09-23) COSE_C509 An unordered bag of C509 certificates c5c (TEMPORARY - registered 2024-03-11, publication requested 2025-09-23) COSE_C509 An ordered chain of C509 certificates Unassigned x5bag COSE_X509 An unordered bag of X.509 certificates x5chain COSE_X509 An ordered chain of X.509 certificates x5t COSE_CertHash Hash of an X.509 certificate x5u uri URI pointing to an X.509 certificate Unassigned sd_alg (TEMPORARY - registered 2026-01-16, expires 2027-01-16) int COSE Algorithms The hash algorithm used for redacting disclosures. sd_aead_encrypted_claims (TEMPORARY - registered 2026-01-16, expires 2027-01-16) [ +[bstr,bstr,bstr] ] A list of AEAD encrypted selectively disclosed claims, which were originally redacted, then later disclosed at the discretion of the sender. sd_aead (TEMPORARY - registered 2026-01-16, expires 2027-01-16) uint .size 2 AEAD Algorithms The AEAD algorithm used for encrypting disclosures. Unassigned CUPHNonce bstr Challenge Nonce FIDO Device Onboard Specification CUPHOwnerPubKey array Public Key FIDO Device Onboard Specification payload-hash-alg int COSE Algorithms The hash algorithm used to produce the payload of a COSE_Sign1 preimage-content-type uint / tstr CoAP Content-Formats The content-format number or content-type (media-type name) of data that has been hashed to produce the payload of the COSE_Sign1 payload-location tstr The string or URI hint for the location of the data hashed to produce the payload of a COSE_Sign1 x5ts array of COSE_CertHash CBOR array of instances of COSE_CertHash TS 119 152-1 V0.0.9, Clause 5.2.2 srCms array of SrCm set of commitments and optional commitments qualifiers TS 119 152-1 V0.0.9, Clause 5.2.3 sigPl map CBOR map for indicating the location where the signature was generated. It may contain an indication of the country, the locality, the region, a box number in a post office, the postal code, and the street address TS 119 152-1 V0.0.9, Clause 5.2.4 srAts map CBOR map that may contain: an array of attributes that the signer claims to be in possession of, an array of attribute certificates (X.509 attribute certificates or other) issued to the signer, an array of signed assertions issued by a third party to the signer, or any combination of the three aforementioned CBOR arrays TS 119 152-1 V0.0.9, Clause 5.2.5 adoTst map CBOR map that encapsulates one or more electronic time-stamps, generated before the signature production, and whose message imprint computation input is the COSE Payload of the CB-AdES signature TS 119 152-1 V0.0.9, Clause 5.2.6 sigPId map CBOR map that identifies a certain signature policy and may contain the digest of the document defining this signature policy. TS 119 152-1 V0.0.9, Clause 5.2.7 sigD map CBOR map that references data objects that are detached from the CB-AdES signature and that are collectively signed. TS 119 152-1 V0.0.9, Clause 5.2.8 uHeaders [+bstr] CBOR array that contains a number of CBOR elements that are placed within the array in the order they are incorporated into the CB-AdES signature TS 119 152-1 V0.0.9, Clause 5.3.1 3161-ttc bstr Timestamp Token per : Timestamp, Then COSE 3161-ctt bstr Timestamp Token per : COSE, Then Timestamp Unassigned receipts array Priority ordered sequence of CBOR encoded Receipts vds int COSE Verifiable Data Structure Algorithms Algorithm identifier for verifiable data structures, used to produce verifiable data structure proofs vdp map map key in COSE Verifiable Data Structure Proofs Location for verifiable data structure proofs in COSE Header Parameters COSE Header Algorithm Parameters Expert Review Göran Selander, Derek Atkins, Sean Turner Unassigned x5chain-sender ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW COSE_X509 static key X.509 certificate chain x5u-sender ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW uri URI for the sender's X.509 certificate x5t-sender ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW COSE_CertHash Thumbprint for the sender's X.509 certificate PartyV other direct+HKDF-SHA-256, direct+HKDF-SHA-512, direct+HKDF-AES-128, direct+HKDF-AES-256, ECDH-ES+HKDF-256, ECDH-ES+HKDF-512, ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW bstr Party V other provided information PartyV nonce direct+HKDF-SHA-256, direct+HKDF-SHA-512, direct+HKDF-AES-128, direct+HKDF-AES-256, ECDH-ES+HKDF-256, ECDH-ES+HKDF-512, ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW bstr / int Party V provided nonce PartyV identity direct+HKDF-SHA-256, direct+HKDF-SHA-512, direct+HKDF-AES-128, direct+HKDF-AES-256, ECDH-ES+HKDF-256, ECDH-ES+HKDF-512, ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW bstr Party V identity information PartyU other direct+HKDF-SHA-256, direct+HKDF-SHA-512, direct+HKDF-AES-128, direct+HKDF-AES-256, ECDH-ES+HKDF-256, ECDH-ES+HKDF-512, ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW bstr Party U other provided information PartyU nonce direct+HKDF-SHA-256, direct+HKDF-SHA-512, direct+HKDF-AES-128, direct+HKDF-AES-256, ECDH-ES+HKDF-256, ECDH-ES+HKDF-512, ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW bstr / int Party U provided nonce PartyU identity direct+HKDF-SHA-256, direct+HKDF-SHA-512, direct+HKDF-AES-128, direct+HKDF-AES-256, ECDH-ES+HKDF-256, ECDH-ES+HKDF-512, ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW bstr Party U identity information salt direct+HKDF-SHA-256, direct+HKDF-SHA-512, direct+HKDF-AES-128, direct+HKDF-AES-256, ECDH-ES+HKDF-256, ECDH-ES+HKDF-512, ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW bstr Random salt Unassigned static key id ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW bstr Static public key identifier for the sender static key ECDH-SS+HKDF-256, ECDH-SS+HKDF-512, ECDH-SS+A128KW, ECDH-SS+A192KW, ECDH-SS+A256KW COSE_Key Static public key for the sender ephemeral key ECDH-ES+HKDF-256, ECDH-ES+HKDF-512, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW COSE_Key Ephemeral public key for the sender COSE Algorithms Integers less than -65536 Private Use Integer values from -65536 to -257 Specification Required Integer values between -256 and 255 Standards Action With Expert Review Integer values from 256 to 65535 Specification Required Integer values greater than 65535 Expert Review Strings of length 1 Standards Action With Expert Review Strings of length 2 Specification Required Strings of length greater than 2 Expert Review Göran Selander, Derek Atkins, Sean Turner Reserved for Private Use less than -65536 No Unassigned -65536 RS1 -65535 RSASSA-PKCS1-v1_5 using SHA-1 [kty] IESG Deprecated A128CTR -65534 AES-CTR w/ 128-bit key [kty] IETF Deprecated A192CTR -65533 AES-CTR w/ 192-bit key [kty] IETF Deprecated A256CTR -65532 AES-CTR w/ 256-bit key [kty] IETF Deprecated A128CBC -65531 AES-CBC w/ 128-bit key [kty] IETF Deprecated A192CBC -65530 AES-CBC w/ 192-bit key [kty] IETF Deprecated A256CBC -65529 AES-CBC w/ 256-bit key [kty] IETF Deprecated Unassigned -65528 to -269 ESB512 -268 ECDSA using BrainpoolP512r1 curve and SHA-512 [kty] IETF No ESB384 -267 ECDSA using BrainpoolP384r1 curve and SHA-384 [kty] IETF No ESB320 -266 ECDSA using BrainpoolP320r1 curve and SHA-384 [kty] IETF No ESB256 -265 ECDSA using BrainpoolP256r1 curve and SHA-256 [kty] IETF No KT256 -264 KT256 XOF [kty] IETF No KT128 -263 KT128 XOF [kty] IETF No TurboSHAKE256 -262 TurboSHAKE256 XOF [kty] IETF No TurboSHAKE128 -261 TurboSHAKE128 XOF [kty] IETF No WalnutDSA -260 WalnutDSA signature [kty] No RS512 -259 RSASSA-PKCS1-v1_5 using SHA-512 [kty] IESG No RS384 -258 RSASSA-PKCS1-v1_5 using SHA-384 [kty] IESG No RS256 -257 RSASSA-PKCS1-v1_5 using SHA-256 [kty] IESG No Unassigned -256 to -54 Ed448 -53 EdDSA using the Ed448 parameter set in Section 5.2 of [kty] IETF Yes ESP512 -52 ECDSA using P-521 curve and SHA-512 [kty] IETF Yes ESP384 -51 ECDSA using P-384 curve and SHA-384 [kty] IETF Yes ML-DSA-87 -50 CBOR Object Signing Algorithm for ML-DSA-87 [kty] IETF Yes ML-DSA-65 -49 CBOR Object Signing Algorithm for ML-DSA-65 [kty] IETF Yes ML-DSA-44 -48 CBOR Object Signing Algorithm for ML-DSA-44 [kty] IETF Yes ES256K -47 ECDSA using secp256k1 curve and SHA-256 [kty] IESG No HSS-LMS -46 HSS/LMS hash-based digital signature [kty] Yes SHAKE256 -45 SHAKE-256 512-bit Hash Value [kty] Yes SHA-512 -44 SHA-2 512-bit Hash [kty] Yes SHA-384 -43 SHA-2 384-bit Hash [kty] Yes RSAES-OAEP w/ SHA-512 -42 RSAES-OAEP w/ SHA-512 [kty] Yes RSAES-OAEP w/ SHA-256 -41 RSAES-OAEP w/ SHA-256 [kty] Yes RSAES-OAEP w/ RFC 8017 default parameters -40 RSAES-OAEP w/ SHA-1 [kty] Yes PS512 -39 RSASSA-PSS w/ SHA-512 [kty] Yes PS384 -38 RSASSA-PSS w/ SHA-384 [kty] Yes PS256 -37 RSASSA-PSS w/ SHA-256 [kty] Yes ES512 -36 ECDSA w/ SHA-512 [kty] IETF Deprecated ES384 -35 ECDSA w/ SHA-384 [kty] IETF Deprecated ECDH-SS + A256KW -34 ECDH SS w/ Concat KDF and AES Key Wrap w/ 256-bit key [kty] Yes ECDH-SS + A192KW -33 ECDH SS w/ Concat KDF and AES Key Wrap w/ 192-bit key [kty] Yes ECDH-SS + A128KW -32 ECDH SS w/ Concat KDF and AES Key Wrap w/ 128-bit key [kty] Yes ECDH-ES + A256KW -31 ECDH ES w/ Concat KDF and AES Key Wrap w/ 256-bit key [kty] Yes ECDH-ES + A192KW -30 ECDH ES w/ Concat KDF and AES Key Wrap w/ 192-bit key [kty] Yes ECDH-ES + A128KW -29 ECDH ES w/ Concat KDF and AES Key Wrap w/ 128-bit key [kty] Yes ECDH-SS + HKDF-512 -28 ECDH SS w/ HKDF - generate key directly [kty] Yes ECDH-SS + HKDF-256 -27 ECDH SS w/ HKDF - generate key directly [kty] Yes ECDH-ES + HKDF-512 -26 ECDH ES w/ HKDF - generate key directly [kty] Yes ECDH-ES + HKDF-256 -25 ECDH ES w/ HKDF - generate key directly [kty] Yes Unassigned -24 to -20 Ed25519 -19 EdDSA using the Ed25519 parameter set in Section 5.1 of [kty] IETF Yes SHAKE128 -18 SHAKE-128 256-bit Hash Value [kty] Yes SHA-512/256 -17 SHA-2 512-bit Hash truncated to 256-bits [kty] Yes SHA-256 -16 SHA-2 256-bit Hash [kty] Yes SHA-256/64 -15 SHA-2 256-bit Hash truncated to 64-bits [kty] Filter Only SHA-1 -14 SHA-1 Hash [kty] Filter Only direct+HKDF-AES-256 -13 Shared secret w/ AES-MAC 256-bit key [kty] Yes direct+HKDF-AES-128 -12 Shared secret w/ AES-MAC 128-bit key [kty] Yes direct+HKDF-SHA-512 -11 Shared secret w/ HKDF and SHA-512 [kty] Yes direct+HKDF-SHA-256 -10 Shared secret w/ HKDF and SHA-256 [kty] Yes ESP256 -9 ECDSA using P-256 curve and SHA-256 [kty] IETF Yes EdDSA -8 EdDSA [kty] IETF Deprecated ES256 -7 ECDSA w/ SHA-256 [kty] IETF Deprecated direct -6 Direct use of CEK [kty] Yes A256KW -5 AES Key Wrap w/ 256-bit key [kty] Yes A192KW -4 AES Key Wrap w/ 192-bit key [kty] Yes A128KW -3 AES Key Wrap w/ 128-bit key [kty] Yes Unassigned -2 to -1 Reserved 0 No A128GCM 1 AES-GCM mode w/ 128-bit key, 128-bit tag [kty] Yes A192GCM 2 AES-GCM mode w/ 192-bit key, 128-bit tag [kty] Yes A256GCM 3 AES-GCM mode w/ 256-bit key, 128-bit tag [kty] Yes HMAC 256/64 4 HMAC w/ SHA-256 truncated to 64 bits [kty] Yes HMAC 256/256 5 HMAC w/ SHA-256 [kty] Yes HMAC 384/384 6 HMAC w/ SHA-384 [kty] Yes HMAC 512/512 7 HMAC w/ SHA-512 [kty] Yes Unassigned 8-9 AES-CCM-16-64-128 10 AES-CCM mode 128-bit key, 64-bit tag, 13-byte nonce [kty] Yes AES-CCM-16-64-256 11 AES-CCM mode 256-bit key, 64-bit tag, 13-byte nonce [kty] Yes AES-CCM-64-64-128 12 AES-CCM mode 128-bit key, 64-bit tag, 7-byte nonce [kty] Yes AES-CCM-64-64-256 13 AES-CCM mode 256-bit key, 64-bit tag, 7-byte nonce [kty] Yes AES-MAC 128/64 14 AES-MAC 128-bit key, 64-bit tag [kty] Yes AES-MAC 256/64 15 AES-MAC 256-bit key, 64-bit tag [kty] Yes Unassigned 16-23 ChaCha20/Poly1305 24 ChaCha20/Poly1305 w/ 256-bit key, 128-bit tag [kty] Yes AES-MAC 128/128 25 AES-MAC 128-bit key, 128-bit tag [kty] Yes AES-MAC 256/128 26 AES-MAC 256-bit key, 128-bit tag [kty] Yes Unassigned 27-29 AES-CCM-16-128-128 30 AES-CCM mode 128-bit key, 128-bit tag, 13-byte nonce [kty] Yes AES-CCM-16-128-256 31 AES-CCM mode 256-bit key, 128-bit tag, 13-byte nonce [kty] Yes AES-CCM-64-128-128 32 AES-CCM mode 128-bit key, 128-bit tag, 7-byte nonce [kty] Yes AES-CCM-64-128-256 33 AES-CCM mode 256-bit key, 128-bit tag, 7-byte nonce [kty] Yes IV-GENERATION 34 For doing IV generation for symmetric algorithms. No COSE Key Common Parameters Integers less than -65536 Private Use Integer values in the range -65536 to -1 used for key parameters specific to a single algorithm delegated to the COSE Key Type Parameters registry Integer values between 0 and 255 Standards Action With Expert Review Integer values from 256 to 65535 Specification Required Integer values greater than 65535 Expert Review Strings of length 1 Standards Action With Expert Review Strings of length 2 Specification Required Strings of length greater than 2 Expert Review Francesca Palombini, Carsten Bormann Reserved for Private Use used for key parameters specific to a single algorithm delegated to the COSE Key Type Parameters registry Reserved kty tstr / int COSE Key Types Identification of the key type kid bstr Key identification value - match to kid in message alg tstr / int COSE Algorithms Key usage restriction to this algorithm key_ops [+ (tstr/int)] Restrict set of permissible operations Base IV bstr Base IV to be XORed with Partial IVs COSE Key Type Parameters Expert Review Göran Selander, Derek Atkins, Sean Turner 1 crv int / tstr EC identifier -- Taken from the "COSE Elliptic Curves" registry 1 x bstr Public Key 1 d bstr Private key 2 crv int / tstr EC identifier -- Taken from the "COSE Elliptic Curves" registry 2 x bstr x-coordinate 2 y bstr / bool y-coordinate 2 d bstr Private key 3 n bstr the RSA modulus n 3 e bstr the RSA public exponent e 3 d bstr the RSA private exponent d 3 p bstr the prime factor p of n 3 q bstr the prime factor q of n 3 dP bstr dP is d mod (p - 1) 3 dQ bstr dQ is d mod (q - 1) 3 qInv bstr qInv is the CRT coefficient q^(-1) mod p 3 other array other prime infos, an array 3 r_i bstr a prime factor r_i of n, where i >= 3 3 d_i bstr d_i = d mod (r_i - 1) 3 t_i bstr the CRT coefficient t_i = (r_1 * r_2 * ... * r_(i-1))^(-1) mod r_i 4 k bstr Key Value 5 pub bstr Public key for HSS/LMS hash-based digital signature 6 N uint Group and Matrix (NxN) size 6 q uint Finite field F_q 6 t-values array (of uint) List of T-values, entries in F_q 6 matrix 1 array (of array of uint) NxN Matrix of entries in F_q in column-major form 6 permutation 1 array (of uint) Permutation associated with matrix 1 6 matrix 2 array (of array of uint) NxN Matrix of entries in F_q in column-major form 7 pub bstr Public key 7 priv bstr Private key COSE Key Types Expert Review Göran Selander, Derek Atkins, Sean Turner Reserved 0 This value is reserved OKP 1 Octet Key Pair [kty(1), crv] EC2 2 Elliptic Curve Keys w/ x- and y-coordinate pair [kty(2), crv] RSA 3 RSA Key [kty(3)] Symmetric 4 Symmetric Keys [kty(4)] HSS-LMS 5 Public key for HSS/LMS hash-based digital signature [kty(5), hash algorithm] WalnutDSA 6 WalnutDSA public key [kty(6)] AKP 7 COSE Key Type for Algorithm Key Pairs [kty(7)] COSE Elliptic Curves Integers less than -65536 Private Use Integer values -65536 to -257 Specification Required Integer values -256 to 255 Standards Action With Expert Review Integer values 256 to 65535 Specification Required Integer values greater than 65535 Expert Review Göran Selander, Derek Atkins, Sean Turner Reserved for Private Use Integer values less than -65536 No Unassigned -65536 to -1 Reserved 0 No P-256 1 EC2 NIST P-256 also known as secp256r1 Yes P-384 2 EC2 NIST P-384 also known as secp384r1 Yes P-521 3 EC2 NIST P-521 also known as secp521r1 Yes X25519 4 OKP X25519 for use w/ ECDH only Yes X448 5 OKP X448 for use w/ ECDH only Yes Ed25519 6 OKP Ed25519 for use w/ EdDSA only Yes Ed448 7 OKP Ed448 for use w/ EdDSA only Yes secp256k1 8 EC2 SECG secp256k1 curve IESG No Unassigned 9-255 brainpoolP256r1 256 EC2 BrainpoolP256r1 ISO/IEC JTC 1/SC 17/WG 10 ISO/IEC 18013-5:2021, 9.1.5.2 No brainpoolP320r1 257 EC2 BrainpoolP320r1 ISO/IEC JTC 1/SC 17/WG 10 ISO/IEC 18013-5:2021, 9.1.5.2 No brainpoolP384r1 258 EC2 BrainpoolP384r1 ISO/IEC JTC 1/SC 17/WG 10 ISO/IEC 18013-5:2021, 9.1.5.2 No brainpoolP512r1 259 EC2 BrainpoolP512r1 ISO/IEC JTC 1/SC 17/WG 10 ISO/IEC 18013-5:2021, 9.1.5.2 No COSE Verifiable Data Structure Algorithms Specification Required Mike Jones, Orie Steele Reserved 0 Reserved RFC9162_SHA256 1 SHA256 Binary Merkle Tree IETF COSE Verifiable Data Structure Proofs Specification Required Mike Jones, Orie Steele 1 inclusion proofs array (of bstr) Proof of inclusion IETF 1 consistency proofs array (of bstr) Proof of append only property IETF