Re: [Rats] Call for 111 RATS presentations

[Laurence Lundblade <[e-mail]>]

> On Sep 3, 2021, at 3:29 PM, Smith, Ned <[e-mail]> wrote:
> 
> > version
> > I think we need more details on this to know what to do with it.
> > 
> > —> At minimum rename it so it is not just “version”, so the claim name says what it is the version of.
>  
> I think this point raises a bigger question. “To what do any of the claims pertain?” Today EAT claims are tag-value tuples where the tag “version” is followed by its value. An EAT claim set is a list of tuples that describes something, but that something isn’t named. 
>  
> Possibly, some of the other CWT claims could be used to do that? For example, ‘sub’ could identify the Target Environment but ‘sub’ is pretty open ended in terms of what it could contain. By contrast, a SUIT manifest relies on vendor name, class identifier etc… In the corim schema environments can be identified by a class identifier or an instance identifier (such as a UEID). The association of a set of claims to an environment should be a central aspect of what we’re trying to accomplish IMHO.

Hi Ned,

I’m not too worried about this. I think of the CWT/JWT registries as a smorgasbord/mall food court/dim sum of claims for anyone to use for any purpose they wish. The receiver distinguishes the use by context. In one context it might be an authentication token, in another an attestation token. It’s perfectly OK for authentication tokens to use attestation claims. This seems to be the way CWT and JWT work now.

I’m asking that the claims defined for SUIT have SUIT-specific names so no one looks into the CWT/JWT registries and thinks that the vendor-identifier claim and such are intended for identify a vendor in every/any context that a token is every used, that this is THE universal vendor identifier for ALL hardware, firmware and software.

Trying for just a little bit of order in the CWT/JWT registries. :-)

We also have EAT profiles to help manage chaos here. Maybe there should be an EAT profile that says how attestation claims apply to SUIT?

LL