Re: [Rats] [EXTERNAL] SBOMs -- SPDX and CycloneDX, Eliots review

[Henk Birkholz <[e-mail]>]

Hi Roy,
hi Laurence,

the really confusing thing is:

An *Endorsement is called Attestation* in SBOM space.

A pointer to "SBOM Attestations":

> https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/software-supply-chain-security-guidance-2

Please compare with:

> https://www.ietf.org/archive/id/draft-ietf-rats-architecture-18.html#name-terminology-2

The type of "attestation" used in SBOM actually has *nothing* to with 
remote attestation Evidence or Attestation Results.

Please always keep that in mind, when you hear or read the term 
"attestation" without proper context. It means factually nothing by 
itself in a lot of cases.

In the context of RATS please always make clear what part of remote 
attestation procedures (especially which type of conceptual message / 
RATS artifact) you are referring to. Is it Evidence? AR? Endorsements? 
Or even Reference Values? Simply use these term, not just attestation.

Viele Grüße,

Henk

On 16.06.22 00:37, Roy Williams (COSINE) wrote:
> There is a difference between endorsements for Secure Supply Chain and 
> Attestations like RATS.  The former can be a weaker claim that “I 
> reviewed this and signed off” whereas the latter is “Here is what I 
> reviewed and why I signed off”. The value of the former is that it does 
> not educate bad actors of what to taint or what is actually used.
> 
> The convergence of SPDX and CycloneDX comes up time and again and I 
> suspect will resonate for quite a while.
> 
> Roy.
> 
> *From:* RATS <[e-mail]> *On Behalf Of * Laurence Lundblade
> *Sent:* Wednesday, June 15, 2022 2:04 PM
> *To:* rats <[e-mail]>
> *Subject:* [EXTERNAL] [Rats] SBOMs -- SPDX and CycloneDX, Eliots review
> 
> 	
> 
> You don't often get email from [e-mail] 
> <mailto:[e-mail]>. Learn why this is important 
> <https://aka.ms/LearnAboutSenderIdentification>
> 
> 	
> 
> In his review Eliot wrote:
> 
>     Section 4.2.16
> 
>     Can a software manifest be an SPDX or CycloneDX document or a pointer
> 
>     to same?  There's a WHOLE lot of the former out there, and the latter
> 
>     is growing in popularity.  If this is the case, let's define
> 
>     appropriate types now.
> 
> Off the top of my head, I’d say yes a manifest can be an SPDX or 
> CycloneDX, but this is not something I know a lot about, so I’m asking 
> here.
> 
> Doesn’t look like there are CoAP registrations for SPDX or CycloneDX, 
> but there are MIME type registries.
> 
> I think EAT establishes a means of extending the manifests claim and 
> registers a couple of important ones and that is enough for the EAT 
> draft. I propose that registration of CoAP content formats for SPDX and 
> CycloneDX and inclusion in EAT can be done in a follow-on draft, but am 
> open to suggestions.
> 
> Again, not my area of expertise (so I’m fishing a bit here), but it 
> seems like SBOM processing is similar to a big part of what a RATS 
> Verifier does, or at least what a lot of people are expecting a RATS 
> verifier to do — Checking SW versions, checking vulnerability databases…
> 
> Also, for the sake of clarification, I wouldn’t call SBOM processing and 
> RATS Verification “certification”, at least not in the way that FIPS and 
> Common Criteria are certification. Certification is something that takes 
> months or years, costs a lot and involves detailed review of the 
> implementation and design.  I think the way DLOA’s bring certification 
> into RATS in a good way.
> 
> LL
> 
> 
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats