IETF Logo Mail Archive

Re: [sacm] CoSWID review

"Waltermire, David A. (Fed)" <david.waltermire@nist.gov> Tue, 19 November 2019 01:52 UTC

Return-Path: <david.waltermire@nist.gov>
X-Original-To: sacm@ietfa.amsl.com
Delivered-To: sacm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFDBD12004E; Mon, 18 Nov 2019 17:52:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nist.gov
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5k3I5GbdL0pS; Mon, 18 Nov 2019 17:52:18 -0800 (PST)
Received: from GCC02-DM3-obe.outbound.protection.outlook.com (mail-dm3gcc02on2072a.outbound.protection.outlook.com [IPv6:2a01:111:f400:7d04::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 620B112022A; Mon, 18 Nov 2019 17:52:18 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=E5fFmr6nLuNo7YKBLMdOOzuSNFfHP8pgr9DhJ+NVxE8JQdjDMX8457DO0tos/9wEa7JnSXItOMCQ6fmO5H+KChu+y+wUQNnTQpAi7coGWCkEgS/FZybVKZegzNYi9DQ8clsr63yq3RUk98wW8EBsq9TaPLcFB+XNLATSw5nDpbMDIEp25lzE70n1JiLubMeLoFW0lQRCTMuTIwPSD8H78lv4uJ+OuSdx0z0ODf5+Tgq/qHxCBK/KGWTh2K/ctwO2Q3nRPR3it6GEy/Xga1NxfvA+UIfaVXZx1GArTSBNimJBC/go262Lcl9A9ysOShEF/soCKFyUfbV8IaJ2gEAKTg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xaHfYMujn9hzAoLBLZYi6Qb5zd3DpX0dor4aEhdqJhY=; b=UsSEuE51zdajyeDkulqJ+ZKIk7qJC/lst8AulDWHwrLJeUWK7pzt5zejbaHjqks2JwYkpreY0oZqGpIFximbk74sxSlClOLUiA6800Y4H18WD+s3ZMKggL5QjthmrcIt8njA93Cm1b5tnE+RVzCazzuQnb1DF9OOGIQS7m+Pg0O3F4f0qlciNh/ViAxkbH3aX2SAMQa48fXSWNt3LnApCbYuCPzH/5KRiQi/ASbv0gVeM64W4IcKfWA0pn+xfQ2C96syOquMFRxZyNN8khG2COrvRvkKwcutt9Qx84x8cWMR5WuPRhLMESjyBQ/qcvMTeH7ZTlUeKqVaWUPZFirGqg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xaHfYMujn9hzAoLBLZYi6Qb5zd3DpX0dor4aEhdqJhY=; b=klcPeEyJDaSq6NyOL0wcv3GmItSHaqlgJLonZVtR501h9KimNPLA+74deBMqXH0ouVNtZqJyAKpsX8YiCywlw7oCG/xqMKuDALC1ZCM90b9THManSV5CpsVMLlzMdOVsd/0qceVzJ7sUFoP7ctp2wpBAMiYkOerloFiNnALnf9A=
Received: from BN7PR09MB2819.namprd09.prod.outlook.com (52.135.242.24) by BN7SPR01MB5.namprd09.prod.outlook.com (20.176.25.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2451.30; Tue, 19 Nov 2019 01:52:16 +0000
Received: from BN7PR09MB2819.namprd09.prod.outlook.com ([fe80::6d13:7512:b4df:e310]) by BN7PR09MB2819.namprd09.prod.outlook.com ([fe80::6d13:7512:b4df:e310%7]) with mapi id 15.20.2451.031; Tue, 19 Nov 2019 01:52:16 +0000
From: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
To: "cose@ietf.org" <cose@ietf.org>
CC: sacm <sacm@ietf.org>
Thread-Topic: [sacm] CoSWID review
Thread-Index: AQHVi0zu4YoCNvAGF0yJOMlWNNVbBKePD0jWgAHz1s+AANn+TYAAAOYr
Date: Tue, 19 Nov 2019 01:52:15 +0000
Message-ID: <BN7PR09MB28195DC7222FF17789AAC7EBF04C0@BN7PR09MB2819.namprd09.prod.outlook.com>
References: <CAHbuEH7OH_89+e4_BmXJN4LgxzTTQ9MtKF_03XK--a8K4AO11w@mail.gmail.com> <lejxf9f4owwm819gnwiwhlo0.1573973274271@email.android.com> <CAHcK3jMef-SK+AH4RC+EQs1LQ6wZCDAPGLCxqUyE+MFn=n-H+g@mail.gmail.com> <CAHbuEH75-jbPTqprpzjOdhRTVjtBcKy4+M6gW=zEog140ZEw5Q@mail.gmail.com>, <CAHbuEH6SjQRriP-2Sr4k12_hRk88VR3vpTsSW7phqEdKCJoRqg@mail.gmail.com>, <BN7PR09MB281982821C9CD2D11A5F546AF04C0@BN7PR09MB2819.namprd09.prod.outlook.com>
In-Reply-To: <BN7PR09MB281982821C9CD2D11A5F546AF04C0@BN7PR09MB2819.namprd09.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=david.waltermire@nist.gov;
x-originating-ip: [2001:67c:370:128:440f:2dc1:3eca:7ca4]
x-ms-publictraffictype: Email
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 5ef3c90b-778e-4e21-9e7a-08d76c931acb
x-ms-traffictypediagnostic: BN7SPR01MB5:
x-microsoft-antispam-prvs: <BN7SPR01MB5AE838C97920D642192EAF04C0@BN7SPR01MB5.namprd09.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:8882;
x-forefront-prvs: 022649CC2C
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(39860400002)(396003)(346002)(136003)(366004)(199004)(189003)(4326008)(105004)(450100002)(71200400001)(71190400001)(8936002)(33656002)(8676002)(81166006)(81156014)(9686003)(2351001)(19627405001)(64756008)(76176011)(52536014)(66446008)(102836004)(66556008)(1730700003)(66946007)(2906002)(76116006)(91956017)(316002)(6506007)(53546011)(6116002)(186003)(2940100002)(606006)(14444005)(7696005)(256004)(5660300002)(66476007)(2501003)(99286004)(966005)(478600001)(86362001)(6306002)(46003)(11346002)(229853002)(476003)(6436002)(14454004)(74316002)(25786009)(7736002)(55016002)(5640700003)(486006)(6916009)(446003)(54896002)(6246003)(236005); DIR:OUT; SFP:1102; SCL:1; SRVR:BN7SPR01MB5; H:BN7PR09MB2819.namprd09.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: d0/Ksn5Cn22T6vUUeH5ZmTdW3/2zVJlMJT2RcQtd4bqTDENcG6DRs8sueNJBRg7kjfuTT9c06nKlIvFlNJcT44GKULGq3tuo5GdI3iUoX+hAmmFXZTA997WA/fvnhQciYdtj+x6ABWiIvynAfZEFiB73PsQy2yQSsusNfWMdPC3sGcEEcPYqb/999nmmb9bu1iGdbI/LvtlP1c3yW3KWKe5R0C34q5Co5UqHzOTu/PrKN6Z2783nc/B/5uNhexle8l5AUegcvriEiu9O70PUbCx9uFauaGvGGoprZlHMA4LI7jzJ2a3FIVVetLJb1sJjtONrN2S8/RIXMqQBMJQBayWGEZJKgh6q3gFkX7UQfJhFIJ98CN6JmBZogaHjDm0+VHARDgDvxwfa+uJGxCsh3xDdRHFtkOGtyQbDLgKn3frV+pIISI8fFiAtTXjFjSiH
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_BN7PR09MB28195DC7222FF17789AAC7EBF04C0BN7PR09MB2819namp_"
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-Network-Message-Id: 5ef3c90b-778e-4e21-9e7a-08d76c931acb
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Nov 2019 01:52:15.9600 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: E3UaBZWGfIE0O0JCWWZXfBce2ODv89wANIGEcvFsHWjAiA0D+t9sDs5Vf8uIBYbwlheY8RU9sBd9pq5yNdrnxw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7SPR01MB5
Archived-At: <https://mailarchive.ietf.org/arch/msg/sacm/_UNiDXwvcfOPfkBwcdMC2ZRlCh0>
Subject: Re: [sacm] CoSWID review
X-BeenThere: sacm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: SACM WG mail list <sacm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sacm>, <mailto:sacm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sacm/>
List-Post: <mailto:sacm@ietf.org>
List-Help: <mailto:sacm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sacm>, <mailto:sacm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 19 Nov 2019 01:52:24 -0000

COSE WG,

I accidently sent the last email early. Please ignore it.

Kathleen provided comments below on draft-ietf-sacm-coswid suggesting that we use the COSE proposed algorithm identifiers for hashes in CoSWID. We are currently using the entries in the IANA Named Information Hash Algorithm Registry. It would be great to align with the COSE hash algorithms, but I can't figure out a way to point to only the hash algorithms in the COSE Algorithms registry. We can point to the draft-ietf-cose-hash-algs once its published as an RFC, but this would be less agile in the face of future updates to COSE hash algorithms. It would very useful if the COSE Algorithms registry has a column for algorithm type. That way we could select only the hash algorithms.

Do you have any suggestions on how we might move forward?

Regards,
Dave Waltermire

________________________________
From: Waltermire, David A. (Fed) <david.waltermire@nist.gov>
Sent: Monday, November 18, 2019 8:39 PM
To: cose@ietf.org <cose@ietf.org>
Cc: sacm <sacm@ietf.org>
Subject: Fw: [sacm] CoSWID review




On Sun, Nov 17, 2019 at 6:45 AM Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com<mailto:kathleen.moriarty.ietf@gmail.com>> wrote:
Hi Dave,

On Sun, Nov 17, 2019 at 3:02 AM Dave Waltermire <davewaltermire@gmail.com<mailto:davewaltermire@gmail.com>> wrote:
Kathleen,

Thank you for the review. I have addressed your comments in the latest draft. Some comments on your comments are inline below.

From: sacm <sacm-bounces@ietf.org<mailto:sacm-bounces@ietf.org>> on behalf of Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com<mailto:kathleen.moriarty.ietf@gmail.com>>
Date: Fri, October 25, 2019 11:57 PM +0800
To: "<sacm@ietf.org<mailto:sacm@ietf.org>>" <sacm@ietf.org<mailto:sacm@ietf.org>>
Subject: [sacm] CoSWID review


Section 2.6:
A Thumbprint is specified in this section, should this be referenced for clarity on hashes with COSE for object identification: https://datatracker.ietf.org/doc/draft-ietf-cose-hash-algs/<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-cose-hash-algs%2F&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C75ba45cd96ab47c1496808d76c23fd62%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637096774138383674&sdata=7FGlZBW3KNZeR7ur3baxZKvGm5m8jYR%2BdQnng6L1%2Bmc%3D&reserved=0>
Would it be better to tie to the COSE set of supported algorithms (they likely match, but I didn't verify)?

The IANA COSE Algorithms registry contains other types of algorithms beyond hash algorithms. To use this registry, we would need to list the hash-specific algorithms, which is less ideal. Its a shame this registry isn't broken out by algorithm type, which would make this decision easy. With the IANA "Named Information Hash Algorithm Registry", we get only hash algorithms, which is what we are looking for. Can you live with use of the  IANA "Named Information Hash Algorithm Registry"?

COSE is open as is their main draft.  This is a problem that can likely be solved this week...  Talk to Jim. Let me and the list know what's possible.

v2.23.0 | Report a Bug | By Email