Re: [sacm] [Suit] [Rats] CoSWID and EAT and CWT

[Michael Richardson <[e-mail]>]

Smith, Ned <[e-mail]> wrote:
    > The architecture slides presented at Singapore showed Attester-Verifier
    > interactions supporting multiple signed formats. Therefore, it could be
    > reasonable to consider [Co]SWID as yet another payload format the Verifier
    > needs to handle.

That's an interesting take on things.
My reading of CoSWID is that COSE signatures are almost an afterthought
(appendix A), and in any case, would be produced by manufacturers rather than
as evidence.

It seems that inclusion of an unsigned CoSWID into a SUIT Manifest is
appropriate as the manufacturer is authoritative for both.

    > Another consideration might question whether it makes sense for [Co]SWID to
    > be regarded as Evidence. Maybe it should be restricted to Endorsements?

I think that it makes more sense as Endorsement only, as such it falls
outside of the normative part of the RATS architecture.

    > The important distinction from the perspective of the RATS architecture is
    > that Endorsements (signed by a mfg – aka “Endorser”) are still Endorsements
    > even if they are stored on the Attester and conveyed to a Verifier over a
    > conveyance protocol that supports conveyance of Evidence. Evidence and
    > Endorsements are signed by different keys. How they are conveyed isn’t
    > interesting to the Verifier per se. except where freshness is a
    > consideration.

If the manufacturer-signed Endorsement is communicated within EAT, then it's
not a seperate token format. It's just payload for a Evidence carrying EAT.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-