[Rats] Re: A small number of new "CMW Claims" as an alternative to submods

["lgl island-resort.com" <[e-mail]>]

I would define nested-token as a composition of attestation evidence or attestation results all for the same device. A nested-token MUST contain all evidence or all results.  It must not be a mixture. The format of a nested-token is a CMW collection.

Security considerations for nested-token: When a nested-token claim appears in an EAT, UCCS or CMW, it MUST be protected from SESA (subordinate evidence substitution attack; see other RATS email thread). It MUST be secured by attestation-oriented key material.

It's fine (and probably necessary) to define other claims for other purposes that are in the format of a CMW collection. Recall my example where the EAT manifests and EAT measurements claims are the same format, but are for different purposes.

LL



On Dec 9, 2024, at 10:25 AM, Smith, Ned <[e-mail]> wrote:


From: Thomas Fossati <[e-mail]<mailto:[e-mail]>>
Date: Monday, December 9, 2024 at 09:14
To: Smith, Ned <[e-mail]<mailto:[e-mail]>>
Cc: lgl island-resort.com<http://island-resort.com/> <[e-mail]<mailto:[e-mail]>>, Henk Birkholz <[e-mail]<mailto:[e-mail]>>, [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Subject: Re: [Rats] Re: A small number of new "CMW Claims" as an alternative to submods
hi Ned,

On Mon, 9 Dec 2024 at 00:50, Smith, Ned <[e-mail]<mailto:[e-mail]>> wrote:
>
> >    “Nested-tokens” is CMW format and is for whole tokens. The big gain here is there’s only one token nesting structure in all of RATS and it uses the good content type mechanism.
>
> I think “nested-tokens” is a misnomer as CMWs can contain payloads that are not “tokens”.

It depends on what we mean by "tokens" :-)

If we use it to mean a "claims representation format" (as per
RFC7519), it may be fit for purpose across different conceptual
messages and serialisations.

[nms] That was my point. A CMW media-type format could be broader than “claims representation format”. It could be a payload produced by a TPM or a vendor specific format. The benefit of CMW as a universal adapter goes away if it no longer is universal.


cheers, t