[sacm] [sacmwg/draft-ietf-sacm-coswid] COSE and CBOR tags (#42)

[Laurence Lundblade <[e-mail]>]

I think what we're after for CoSWID+COSE is almost exactly the same as CWT+UCCS. It's not exactly the same because UCCS uses a different tag number than CWT and CoSWID doesn't.

I think we want to allow all variants of COSE signing, encryption and MAC just like CWT does. 

```
concise-swid-tag — Naked, no COSE, not CBOR tag, like a UCCS

#6.1398229316(concise-swid-tag) - Just a CoSWID tag, no COSE, like a CWT with no COSE

#6.1398229316(#6.18(COSE-Sign1<concise-swid-tag>)) A CoSWID tag with signing

#6.1398229316(#6.17(COSE-Mac01<concise-swid-tag>))

#6.1398229316(#6.18(COSE-Sign1(#6.96(cose_encrypt<concise-swid-tag>)))

…plus lots more combos of signing, encrypting and mac’ing 

#6.18(COSE-Sign1<concise-swid-tag>) Signing not a CoSWID CBOR tag

#6.17(COSE-Mac01<concise-swid-tag>) Mac, not a CoSWID CBOR tag

#6.18(COSE-Sign1(#6.96(cose_encrypt<concise-swid-tag>)) Signed and encrypted not a CoSWID CBOR tag

…plus the same combos of signing, encrypting and mac'ing
```

What is NOT allowed, like CWT disallows, are these:

```
#6.1398229316(COSE-Sign1<concise-swid-tag>)

#6.1398229316(COSE-Mac01<concise-swid-tag>)

#6.1398229316(COSE-Sign1<cose_encrypt<concise-swid-tag>>)
```

Are we in agreement on this?

An implementor should be able to use the same COSE code that recursively removes COSE layers it identifies by the COSE tags to get to the final payload just like in CWT. Maybe even exactly the same COSE code.

I think section 7 and 8 get close to this, but are not exactly right. They don't allow for encryption or mac. I think the CWT description of this is solid and correct though it doesn't use CDDL and doesn't cover UCCS.

My thought for bringing CoSWID into EAT is to have a claim that is explicitly a CoSWID so #6.1398229316() is never used. If it is COSE is used then it is a COSE tag. If COSE is not used then it is a concise-swid-tag. It is naked.



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/issues/42