Re: [sacm] [Rats] CoSWID and EAT and CWT

Hi Henk,

I am not entirely following you, so I am not stating agreement yet.

On Fri, Nov 22, 2019 at 12:06 PM Henk Birkholz <
henk.birkholz@sit.fraunhofer.de> wrote:

> Hi Kathleen,
> hi SACM, SUIT & RATS list,
>
> the corresponding *SWID authors discussed this issue and are proposing:
>
> > https://github.com/ietf-rats-wg/eat/issues/46
>
> This includes an extended scope to include the option of SUIT Manifest
> related Claim values, next to various *SWID Claim values. We permutated
> "signed" & "not-signed" as well as "payload tags" and "evidence tags"
> for *SWID tags in this proposal. The authors are convinced that the
> "not-signed" variants are of essence (as CWT does not allow "not-signed
> CBOR items", but also do not imply any implications to the SUIT Manifest
> Claim definition (although there are strong similarities and there could
> be some).
>

Can you write the above again?  Are you saying this in terms of a CWT?
Wouldn't the claims and the text value in a CWT be represented as-is, then
signed, so you'd get what you are saying is needed?

>
> The current *SWID contributors prefer this contribution as a parallel
> effort to the EAT I-D, SUIT Manifest I-D, the CoSWID I-D and existing
> ISO XML SWID standard. This proposal includes the primitive to not delay
> corresponding IETG I-D in their respective WGs.
>

Are you saying you don't want to add text stating the use of a CWT is a
possible alternative, as that is what was requested.  I offered to write a
separate document to put the CoSWID in a CWT in SACM as I think that's the
right home, referencing EAT work.

>
> Having said that, we would like to get feedback for the proposal
> references above.
>
> If there is no dissent or push-back on either the SUIT, SACM, and RATS
> lists, our proposed way forward is a unified creation of EAT Claim Sets
> in the RATS WG that enables the use of various *SWID variants & the SUIT
> Manifest as payloads for RATS via the RATS EAT I-D.
>

I think this should be in SACM.  And I've offered to help.  I do think that
a little text saying it's possible should be in the CoSWID draft and will
provide that soon as not to delay progress of the CoSWID document.

Best regards,
Kathleen

>
> In summary, we would like to create this interop I-D in concert and
> welcome every joint effort in this domain.
>
> Viele Grüße,
>
> Henk
>
> On 21.11.19 12:37, Kathleen Moriarty wrote:
> >
> >
> > Sent from my mobile device
> >
> >> On Nov 20, 2019, at 11:29 PM, Waltermire, David A. (Fed)
> >> <david.waltermire@nist.gov> wrote:
> >>
> >> 
> >> It sounds like having a CWT claim that contains an entire CoSWID is a
> >> path forward. It may also make sense to do something similar for ISO
> >> SWID tags.
> >>
> >> Am I right in thinking that this CWT work can be done in RATS,
> >> referencing CoSWID once it is published as a normative reference? This
> >> would allow CoSWID to go forward to the IESG, while the CoSWID CWT
> >> claim is worked in parallel in RATS.
> >>
> >> Kathleen, if this is true, does this way forward address your
> >> CWT-related comments?
> >
> > Hi Dave,
> >
> > I think the signature may have to be on the CWT as opposed to on the
> > claim that is the CoSWID or SWID.  We can define it fully in another
> > draft, but should state it here so that option is understood.  It’s a
> > simple write up, I think.
> >
> > Thank you,
> > Kathleen
> >>
> >> Regards,
> >> Dave
> >>
> >>
> >>
> >>
> >>
> >> ------------------------------------------------------------------------
> >> *From:* sacm <sacm-bounces@ietf.org> on behalf of Kathleen Moriarty
> >> <kathleen.moriarty.ietf@gmail.com>
> >> *Sent:* Wednesday, November 20, 2019 9:10 PM
> >> *To:* Ira McDonald <blueroofmusic@gmail.com>
> >> *Cc:* rats@ietf.org <rats@ietf.org>; sacm <sacm@ietf.org>; Laurence
> >> Lundblade <lgl@island-resort.com>
> >> *Subject:* Re: [sacm] [Rats] CoSWID and EAT and CWT
> >> Great, thanks Laurence.  If that's easier I think having the CoSWID in
> >> one claim should be ok and would have the same result as the
> >> suggestion I made.  Changing the CoSWID format is a big enough process
> >> that it shouldn't happen very often.
> >>
> >> Best regards,
> >> Kathleen
> >>
> >> On Wed, Nov 20, 2019 at 8:00 PM Ira McDonald <blueroofmusic@gmail.com
> >> <mailto:blueroofmusic@gmail.com>> wrote:
> >>
> >>     Hi Laurence,
> >>
> >>     That seems like a good suggestion for a simple way to integrate
> >>     CoSWID content
> >>     into EAT.
> >>
> >>     Cheers,
> >>     - Ira
> >>
> >>     Ira McDonald (Musician / Software Architect)
> >>     Co-Chair - TCG Trusted Mobility Solutions WG
> >>     Co-Chair - TCG Metadata Access Protocol SG
> >>     Chair - Linux Foundation Open Printing WG
> >>     Secretary - IEEE-ISTO Printer Working Group
> >>     Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
> >>     IETF Designated Expert - IPP & Printer MIB
> >>     Blue Roof Music / High North Inc
> >>     http://sites.google.com/site/blueroofmusic
> >>     <
> https://gcc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsites.google.com%2Fsite%2Fblueroofmusic&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C92a2dcbadd8d47661b9608d76e282847%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C1%7C637098991070417006&sdata=GDIVVIesvqqXnuU6TtLbK7GJ4eI1b1EcYSPoXsHlj04%3D&reserved=0
> >
> >>     http://sites.google.com/site/highnorthinc
> >>     <https://gcc01.safelinks.protection..
> outlook.com/?url=http%3A%2F%2Fsites.google.com%2Fsite%2Fhighnorthinc&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C92a2dcbadd8d47661b9608d76e282847%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C1%7C637098991070417006&sdata=7z%2BoMcYSSFD8hAYHmELqNoyGAxTBE9gknbV6kAzKWX8%3D&reserved=0
> >
> >>     mailto: blueroofmusic@gmail.com <mailto:blueroofmusic@gmail.com>
> >>     PO Box 221  Grand Marais, MI 49839  906-494-2434
> >>
> >>
> >>
> >>     On Wed, Nov 20, 2019 at 7:35 PM Laurence Lundblade
> >>     <lgl@island-resort.com <mailto:lgl@island-resort.com>> wrote:
> >>
> >>         Hi,
> >>
> >>         I’m not on the SACM list, but did look at the archive.
> >>         Hopefully I’m not out of sync.
> >>
> >>         My thought is to register one claim for CWT that is an entire
> >>         CoSWID (in CDDL the concise-swid-tag).
> >>
> >>         That way CoSWID can grow and develop on its own without lots
> >>         of adds and subtracts to the CWT registry. It has its own IANA
> >>         registry with its own experts and such. Seems like the
> >>         coupling / factoring is about right.
> >>
> >>         This would also be the way I’d like to have it in EAT
> >>         attestation. We’ve done a mini version of this with the
> >>         location claim
> >>         <
> https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-rats-eat-01%23section-3.8&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C92a2dcbadd8d47661b9608d76e282847%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C1%7C637098991070426961&sdata=%2Fhi008Am2dlY6tBQHdPVVGZzEcWNmqd5MvgPOM14jE8%3D&reserved=0
> >.
> >>
> >>         Then if you just want to sign a CoSWID CWT style, this works
> >>         pretty well too. It has a slight overhead compared to having
> >>         all the CoSWID data items as direct CWT claims in that it will
> >>         have an additional map layer, but that is only about three
> bytes.
> >>
> >>         LL
> >>
> >>         _______________________________________________
> >>         RATS mailing list
> >>         RATS@ietf.org <mailto:RATS@ietf.org>
> >>         https://www.ietf.org/mailman/listinfo/rats
> >>         <
> https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Frats&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C92a2dcbadd8d47661b9608d76e282847%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C1%7C637098991070426961&sdata=fdpXMIU%2BNkMSn3RJ4X5AsSuMU7pbokHXltsX8ZYP9E0%3D&reserved=0
> >
> >>
> >>     _______________________________________________
> >>     sacm mailing list
> >>     sacm@ietf.org <mailto:sacm@ietf.org>
> >>     https://www.ietf.org/mailman/listinfo/sacm
> >>     <
> https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsacm&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C92a2dcbadd8d47661b9608d76e282847%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C1%7C637098991070436893&sdata=okSPAqVHj9KBxPtViQdnffsfhlMF4t0%2F87PXXY78fA0%3D&reserved=0
> >
> >>
> >>
> >>
> >> --
> >>
> >> Best regards,
> >> Kathleen
> >
> > _______________________________________________
> > sacm mailing list
> > sacm@ietf.org
> > https://www.ietf.org/mailman/listinfo/sacm
> >
>

-- 

Best regards,
Kathleen