Re: [sacm] Usage of CWT Discussion

Thanks, Tony.

The use case I was interested in with this would be that the originator of
the software provided their signature over the CoSWID value using an EAT.
This could be interesting to reuse a format that is likely to be widely
used, just for the signature verification and use of nested packages
(verify the expected private key was used to sign the CoSWID).  You'd just
be verifying the signature as being from the originator and perhaps some
other claims may get added around the security testing or provenance.

Best regards,
Kathleen

On Tue, Nov 19, 2019 at 2:28 AM Anthony Nadalin <tonynad=
40microsoft.com@dmarc.ietf.org> wrote:

> The pre-defined optional claims are there so that profiles that want to
> use them can when they make sense. There is no requirement that profiles
> use any of the pre-defined claims. SACM can register their own entirely new
> set of claims in the IANA CWT Claims registry at
> https://www.iana.org/assignments/cwt/cwt.xhtml if they choose to Or they
> can use some standard claims and some profile-defined claims.
>
>
>
> So I see no reason not to just support CWT with the exiting claims you
> have and register them as CWT claims
>
>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm
>

-- 

Best regards,
Kathleen