Re: [Rats] [Suit] [sacm] CoSWID and EAT and CWT

EAT is a payload that can be exchanged between an Attester-Verifier or Verifier-RelyingParty.
[Co]SWID is a payload that can be exchanged between Endorser-Verifier or (possibly?) Attester-Verifier.

It is the latter use case context (Attester-Verifier) that is potentially confusing because it presumes the [Co]SWID payload should be wrapped by an EAT.

The architecture slides presented at Singapore showed Attester-Verifier interactions supporting multiple signed formats. Therefore, it could be reasonable to consider [Co]SWID as yet another payload format the Verifier needs to handle.

Another consideration might question whether it makes sense for [Co]SWID to be regarded as Evidence. Maybe it should be restricted to Endorsements?

The SWID documentation seems to suggest that SWID structures should be maintained on the Attester and updated when SW/FW updates occur. Possibly, the installer is working with two objects SUIT manifests and [Co]SWID structures keeping both maintained on the Attester? If this is the case, then it might make sense to consider unifying them? That might be the context for some of the list activity surrounding SUIT manifest and [Co]SWID?

The important distinction from the perspective of the RATS architecture is that Endorsements (signed by a mfg – aka “Endorser”) are still Endorsements even if they are stored on the Attester and conveyed to a Verifier over a conveyance protocol that supports conveyance of Evidence. Evidence and Endorsements are signed by different keys. How they are conveyed isn’t interesting to the Verifier per se. except where freshness is a consideration.
-Ned

From: Suit <suit-bounces@ietf.org> on behalf of Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Date: Monday, December 2, 2019 at 10:16 AM
To: Michael Richardson <mcr+ietf@sandelman.ca>
Cc: "rats@ietf.org" <rats@ietf.org>, "suit@ietf.org" <suit@ietf.org>, sacm <sacm@ietf.org>
Subject: Re: [Suit] [Rats] [sacm] CoSWID and EAT and CWT

On Mon, Dec 2, 2019 at 11:51 AM Michael Richardson <mcr+ietf@sandelman.ca<mailto:mcr%2Bietf@sandelman.ca>> wrote:

Brendan Moran <Brendan.Moran@arm.com<mailto:Brendan.Moran@arm.com>> wrote:
    > Thanks for bringing this to my attention. I'm not sure that I
    > understand the goal of using a CWT for a CoSWID or a SUIT
    > manifest. Would you be able to elaborate on why we should use CWT?

I'm also in need of a diagram of how CoSWID and SUIT manifests and RATS EAT
interact.   I feel that the (optional) layer of signature in the CoSWID is
causing us to lose the forest for the trees...

I see why you might want a CoSWID or SWID in a CWT or EAT, but don't see the mapping for SUIT being preferred to CoSWID or SWID.

Best regards,
Kathleen

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     mcr@sandelman.ca<mailto:mcr@sandelman.ca>  http://www.sandelman.ca/        |   ruby on rails    [

--
Michael Richardson <mcr+IETF@sandelman.ca<mailto:mcr%2BIETF@sandelman.ca>>, Sandelman Software Works
 -= IPv6 IoT consulting =-

_______________________________________________
RATS mailing list
RATS@ietf.org<mailto:RATS@ietf.org>
https://www.ietf.org/mailman/listinfo/rats

--

Best regards,
Kathleen