Re: [sacm] [sacmwg/draft-ietf-sacm-coswid] Addressed comments from WGLC reviewers. (#13)

[Alex Nelson <[e-mail]>]

ajnelson-nist commented on this pull request.



> @@ -1405,14 +1451,17 @@ security considerations regarding SWID/CoSWID tags focus on the application
 of SWID/CoSWID tags to address security challenges, and the possible
 disclosure of the results of those applications.
 
-A signed SWID/CoSWID tag whose signature has been validated can be relied upon to be
-unchanged since it was signed.  If the SWID/CoSWID tag was created by the
-software provider, is signed, and the software provider can be authenticated as the originator of the signature, then the tag can be considered authoritative.
-In this way, an authoritative SWID/CoSWID tag contains information about a software component provided by the maintainer of the software component, who is expected to be an expert in their own software. Thus, authoritative SWID/CoSWID tags can be trusted to represent authoritative information about the software component.  Having an authoritative SWID/CoSWID tag can be useful when the information in the
-tag needs to be trusted, such as when the tag is being used to convey
-reference integrity measurements for software components.  By contrast, the data contained in unsigned
+A tag is cnsidered "authoritative" if the SWID/CoSWID tag was created by the

Typo: "cnsidered".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#pullrequestreview-266354423