Re: [Rats] Easier changes summary (was Re: I-D Action: draft-ietf-rats-eat-13.txt)

["Smith, Ned" <[e-mail]>]

Thanks for the clarifications Laurence and Giri!
-Ned

From: RATS <[e-mail]> on behalf of Laurence Lundblade <[e-mail]>
Date: Friday, May 20, 2022 at 5:12 PM
To: "[e-mail]" <[e-mail]>
Cc: Giridhar Mandyam <[e-mail]>
Subject: [Rats] Easier changes summary (was Re: I-D Action: draft-ietf-rats-eat-13.txt)

Here’s an easier-to-read summary of important changes in the EAT -13 draft. Appreciate all the discussions that led to these useful changes.

How Claims in Evidence relates to Claim in Results
I believe the question about claims in Evidence and Results is resolved with this text<https://datatracker.ietf.org/doc/html/draft-ietf-rats-eat-13#section-1.4.1>  It basically says, the RP needs to understand the Verifier’s policy for forwarding claims.

CDDL for JSON
The CDDL here works for both CBOR and JSON, including the nesting of CBOR tokens in JSON tokens and vice versa. It is only at the token boundary that encoding can switch.

Lots of CBOR and JSON examples are included and validated against the CDDL using the “cddl" tool. Most of the CDDL is common, but it wasn’t possible to make it all common with the way the current “cddl” tool works.

Removed UCCS and UJCS
There is a CDDL socket for where UCCS and UJCS plug in. I have validated that it works for what I think the UCCS CDDL will be. The UCCS standard document should specify that it plugs into this socket so it works correctly for nested tokens.

CoSWID and SUIT identified by CoAP Content Types
I switched to CoAP content types to identify CoSWID and SUIT for the manifest and swevidence claims because what was there before, CBOR tags, don’t work for JSON.

Improved SecLevel Claim
Just three levels now. Try to be clear it is only a simple and rough classification that requires no certification to claim.

Sort Claims into three sub sections
The claims section is now divided into four for easier reading: 1) nonce, 2) claims about the entity, 3) claims about the token and 4) how to include keys. This was an outcome of the Evidence vs Results discussion.

SWResults -> Measurement-Results + revamp
Since more than SW can be measured (e.g., file system and config), this claim is renamed and revamped.

Nonce claim in JSON is same as CBOR nonce
EAT was using the already-defined JWT nonce claim, but in the process of validating all the JSON CDDL I noticed that it can not support multiple nonces like the CBOR nonce.

LL