[Rats] Re: Opinions about removing SUIT-Manifest reference from EAT

["lgl island-resort.com" <[e-mail]>]

Nothing from us authors side. Please proceed :-)

LL


On May 6, 2024, at 12:52 PM, Smith, Ned <[e-mail]> wrote:

@Laurence Lundblade<mailto:[e-mail]> et.al. - Is there anything standing in the way of redoing the WGLC now?
-Ned

From: lgl island-resort.com <[e-mail]>
Date: Monday, May 6, 2024 at 10:37
To: rats <[e-mail]>
Cc: Smith, Ned <[e-mail]>, Ira McDonald <[e-mail]>, Thomas Fossati <[e-mail]>, Tschofenig, Hannes <hannes.tschofenig=[e-mail]>, Giridhar Mandyam <[e-mail]>
Subject: Re: [Rats] Opinions about removing SUIT-Manifest reference from EAT
FYI,

Us EAT authors have formally requested that EAT be recycled through the RATS WG and IETF reviews to remove the SUIT-Manifest dependency. It was our opinion that this was the faster way to complete EAT. Without this, we would have to wait for the complete publication of SUIT-Manifest and SUIT-MTI. That is, our position in the RFC Editor queue was behind SUIT-Manifest and SUIT-MTI because of the dependency.

The change is pretty much a one liner. See diff below of the manifests section. The other changes in -26 are formatting and an outcome of the completion of IANA registrations. It’s best to look at the difference between -24 and -26<https://author-tools.ietf.org/iddiff?url1=draft-ietf-rats-eat-24&url2=draft-ietf-rats-eat-26&difftype=--html> as -25 was kind of a false start. The only change that needs re reviewing is the manifests change.

Our understanding is that the next step is to bring the document back to the RATS WG and run another WG last call. Stay tuned.

It’s probably many months before EAT completes. If we were smarter, we would have recognized the SUIT dependency like we did the UCCS dependency and removed it (or made it informative) long ago.

LL





4.2.15.  manifests (Software Manifests) Claim



   The "manifests" claim contains descriptions of software present on

   the entity.  These manifests are installed on the entity when the

   software is installed or are created as part of the installation

   process.  Installation is anything that adds software to the entity,

   possibly factory installation, the user installing elective

   applications and so on.  The defining characteristic of a manifest is

   that it is created by the software manufacturer.  The purpose of this

   claim is to relay unmodified manifests to the verifier and possibly

   to the relying party.



   Some manifests are signed by their software manufacturer

   independently, and some are not either because they do not support

   signing or the manufacturer chose not to sign them.  For example, a

   CoSWID might be signed independently before it is included in an EAT.

   When signed manifests are put into an EAT, the manufacturer's

   signature SHOULD be included even though an EAT's signature will also

   cover the manifest.  This allows the receiver to directly verify the

   manufacturer-originated manifest.



   This claim allows multiple manifest formats.  For example, the

   manifest may be a CBOR-encoded CoSWID, an XML-encoded SWID or other.

   Identification of the type of manifest is always by a Constrained

   Application Protocol (CoAP) Content-Format integer [RFC7252].  If

   there is no CoAP identifier registered for a manifest format, one

   MUST be registered.



   This claim MUST be an array of one or more manifests.  Each manifest

   in the claim MUST be an array of two.  The first item in the array of

   two MUST be an integer CoAP Content-Format identifier.  The second

   item is MUST be the actual manifest.



   In JSON-encoded tokens the manifest, whatever encoding it is, MUST be

   placed in a text string.  When a non-text encoded manifest like a

   CBOR-encoded CoSWID is put in a JSON-encoded token, the manifest MUST

   be base-64 encoded.



   This claim allows for multiple manifests in one token since multiple

   software packages are likely to be present.  The multiple manifests

   MAY be of different encodings.  In some cases EAT submodules may be

   used instead of the array structure in this claim for multiple

   manifests.



   A CoSWID manifest MUST be a payload CoSWID, not an evidence CoSWID.

   These are defined in [RFC9393].



   A Software Updates for Internet of Things (SUIT) Manifest

   [SUIT.Manifest] may be used.



   This claim is extensible for use of manifest formats beyond those

   mentioned in this document.  No particular manifest format is

   preferred.  For manifest interoperability, an EAT profile as defined

   in Section 6, should be used to specify which manifest format(s) are

   allowed.



   $$Claims-Set-Claims //= (

       manifests-label => manifests-type

   )



   manifests-type = [+ manifest-format]



   manifest-format = [

       content-type:   coap-content-format,

       content-format: JC< $manifest-body-json,

                           $manifest-body-cbor >

   ]



   $manifest-body-cbor /= bytes .cbor untagged-coswid

   $manifest-body-json /= base64-url-text



   $manifest-body-cbor /= bytes .cbor SUIT_Envelope

   $manifest-body-json /= base64-url-text




On May 6, 2024, at 8:15 AM, Giridhar Mandyam <[e-mail]> wrote:

No.  For instance, we tried to sweep up all the IANA assignments (formerly TBD's) and adjusted the examples accordingly.  Moreover we tried to clean up multiple I.-D. nits to help the RFC editors.

Please see the closed PR's starting with 449 on https://github.com/ietf-rats-wg/eat for the main changes after entering Editor's queue.

-Giri

On Mon, May 6, 2024 at 7:55 AM Smith, Ned <[e-mail]<mailto:[e-mail]>> wrote:
Giri,
Was the only change to remove the reference to SUIT manifest?
Thx,
Ned

From: RATS <[e-mail]<mailto:[e-mail]>> on behalf of Giridhar Mandyam <[e-mail]<mailto:[e-mail]>>
Date: Sunday, May 5, 2024 at 11:19
To: Ira McDonald <[e-mail]<mailto:[e-mail]>>
Cc: Thomas Fossati <[e-mail]<mailto:[e-mail]>>, Tschofenig, Hannes <hannes.tschofenig=[e-mail]<mailto:[e-mail]>>, lgl island-resort.com<http://island-resort.com/> <[e-mail]<mailto:[e-mail]>>, rats <[e-mail]<mailto:[e-mail]>>
Subject: Re: [Rats] Opinions about removing SUIT-Manifest reference from EAT
New draft available now at https://datatracker.ietf.org/doc/draft-ietf-rats-eat/.

-Giri

On Mon, Apr 29, 2024 at 6:58 AM Ira McDonald <[e-mail]<mailto:[e-mail]>> wrote:
+1

Ira McDonald (Musician / Software Architect)
Chair - SAE Trust Anchors and Authentication TF
Co-Chair - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Access Protocol SG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [e-mail]<mailto:[e-mail]>
(permanent) PO Box 221  Grand Marais, MI 49839  906-494-2434


On Mon, Apr 29, 2024 at 8:42 AM Thomas Fossati <[e-mail]<mailto:[e-mail]>> wrote:
On Mon, Apr 29, 2024 at 1:44 PM Tschofenig, Hannes
<hannes.tschofenig=[e-mail]<mailto:[e-mail]>> wrote:
>
> Given the current situation I believe that this is the best option we have.

+1

_______________________________________________
RATS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/rats
_______________________________________________
RATS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/rats