Re: [sacm] [Rats] CoSWID and EAT and CWT

[Thomas Fossati <[e-mail]>]

Hi Hannes,

On 22/11/2019, 00:08, [e-mail]> wrote:
> Hi all
>
> Can someone send an example around how this would actually look like?

For something such as TF-M, it should look like this:

{
  / tag-id, globally unique identifier for the software component /
  0: "trustedfirmware.org/TF-M",

  / tag-version (here: 0, i.e. initial tag) /
  12: 0,

  / software component name /
  1: "TF-M",

  / version of the software component /
  13: "1.0.0-rc1+build.123",

  / (optional) version scheme (here: semver) /
  14: 16384,

  / entity, i.e. organizations responsible for producing or releasing
    the software component /
  2: {
    / entity name /
    31: "Linaro Limited",

    / entity role (here: software creator) /
    33: 2,

    / thumbprint of the entity public key (algo -- here; SHA-256 -- and value) /
    34: [
      1,
      h'5e73c2e6a96be594e56b218418a3ea03f1397934a2517d781855195fe3c5916b'
    ]
  },

  / payload /
  6: {
    / filesystem item (name and hash) /
    17: {
      24: "tfm.bin",
      7: [
        1,
        h'4a039f284d8ad68ca5b4d1592977c7c964c4abb5d08d87e4a0346b80cce5c74d'
      ]
    }
  }
}

At least this would be my interpretation of the CoSWID draft.  I'm a bit
unsure whether a "filesystem" item is the most appropriate payload for a
firmware thingy.  Surely Henk can suggest something better.

Cheers!


IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.