Re: [sacm] [Rats] CoSWID and EAT and CWT

I think there are two conversations that could make sense (1) definition of a software integrity claim that can be asserted by an Attester as Evidence; (2) definition of a software integrity claim that can be asserted by an Endorser (aka supply chain entity) as Endorsement.

In (1) there is interest in an EAT token definition that likely will result in a JWT/CWT realization and signature. Possibly it makes sense to include an unsigned CoSWID / SWID structure inside a JWT/CWT or it makes sense to deviate from the JWT/CWT realization but keep the information and data model claims definition but allow use of CoSWID native signatures.
In (2) this is technically out of scope for RATS. However, it could result in a CoSWID / SWID structure using the built in signature method. It isn’t known yet if a token (CWT/JWT) realization makes sense for Endorsers.

From: RATS <rats-bounces@ietf.org> on behalf of "Waltermire, David A. (Fed)" <david.waltermire=40nist.gov@dmarc.ietf.org>
Date: Thursday, November 21, 2019 at 5:24 AM
To: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Cc: "rats@ietf.org" <rats@ietf.org>, Ira McDonald <blueroofmusic@gmail.com>, sacm <sacm@ietf.org>, Laurence Lundblade <lgl@island-resort.com>
Subject: Re: [Rats] [sacm] CoSWID and EAT and CWT

Ok. Can you send some text?

Thanks,
Dave

-------- Original Message --------
From: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Date: Thu, November 21, 2019 7:38 PM +0800
To: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
CC: Ira McDonald <blueroofmusic@gmail.com>, rats@ietf.org, sacm <sacm@ietf.org>, Laurence Lundblade <lgl@island-resort.com>
Subject: Re: [sacm] [Rats] CoSWID and EAT and CWT

Sent from my mobile device

On Nov 20, 2019, at 11:29 PM, Waltermire, David A. (Fed) <david.waltermire@nist.gov> wrote:
It sounds like having a CWT claim that contains an entire CoSWID is a path forward. It may also make sense to do something similar for ISO SWID tags.

Am I right in thinking that this CWT work can be done in RATS, referencing CoSWID once it is published as a normative reference? This would allow CoSWID to go forward to the IESG, while the CoSWID CWT claim is worked in parallel in RATS.

Kathleen, if this is true, does this way forward address your CWT-related comments?

Hi Dave,

I think the signature may have to be on the CWT as opposed to on the claim that is the CoSWID or SWID.  We can define it fully in another draft, but should state it here so that option is understood.  It’s a simple write up, I think.

Thank you,
Kathleen

Regards,
Dave

________________________________
From: sacm <sacm-bounces@ietf.org> on behalf of Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Sent: Wednesday, November 20, 2019 9:10 PM
To: Ira McDonald <blueroofmusic@gmail.com>
Cc: rats@ietf.org <rats@ietf.org>; sacm <sacm@ietf.org>; Laurence Lundblade <lgl@island-resort.com>
Subject: Re: [sacm] [Rats] CoSWID and EAT and CWT

Great, thanks Laurence.  If that's easier I think having the CoSWID in one claim should be ok and would have the same result as the suggestion I made.  Changing the CoSWID format is a big enough process that it shouldn't happen very often.

Best regards,
Kathleen

On Wed, Nov 20, 2019 at 8:00 PM Ira McDonald <blueroofmusic@gmail.com<mailto:blueroofmusic@gmail.com>> wrote:
Hi Laurence,

That seems like a good suggestion for a simple way to integrate CoSWID content
into EAT.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Access Protocol SG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic<https://gcc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsites.google.com%2Fsite%2Fblueroofmusic&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C85a323f673924389c45e08d76e7745e5%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637099330879448050&sdata=HNKKsYDUx5jZoxujKDqJicqUBZ9oe9mxXcTjJ1JlhHM%3D&reserved=0>
http://sites.google.com/site/highnorthinc<https://gcc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsites.google.com%2Fsite%2Fhighnorthinc&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C85a323f673924389c45e08d76e7745e5%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637099330879448050&sdata=PPUqVo1NgGXTgtO10NkLvTHqh5OEqfAeoObWvguIzwY%3D&reserved=0>
mailto: blueroofmusic@gmail.com<mailto:blueroofmusic@gmail.com>
PO Box 221  Grand Marais, MI 49839  906-494-2434

On Wed, Nov 20, 2019 at 7:35 PM Laurence Lundblade <lgl@island-resort.com<mailto:lgl@island-resort.com>> wrote:
Hi,

I’m not on the SACM list, but did look at the archive. Hopefully I’m not out of sync.

My thought is to register one claim for CWT that is an entire CoSWID (in CDDL the concise-swid-tag).

That way CoSWID can grow and develop on its own without lots of adds and subtracts to the CWT registry. It has its own IANA registry with its own experts and such. Seems like the coupling / factoring is about right.

This would also be the way I’d like to have it in EAT attestation. We’ve done a mini version of this with the location claim<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-rats-eat-01%23section-3.8&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C85a323f673924389c45e08d76e7745e5%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637099330879458044&sdata=ssqf1hrDm3bHXDTpewMd%2BhxK9Yh7mNDfmJH%2B9Lk8JsM%3D&reserved=0>.

Then if you just want to sign a CoSWID CWT style, this works pretty well too. It has a slight overhead compared to having all the CoSWID data items as direct CWT claims in that it will have an additional map layer, but that is only about three bytes.

LL

_______________________________________________
RATS mailing list
RATS@ietf.org<mailto:RATS@ietf.org>
https://www.ietf.org/mailman/listinfo/rats<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Frats&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C85a323f673924389c45e08d76e7745e5%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637099330879458044&sdata=K4z%2BpZK5s6Ng%2B7amizoONuHllxjshmG5aTzP3yO8adU%3D&reserved=0>
_______________________________________________
sacm mailing list
sacm@ietf.org<mailto:sacm@ietf.org>
https://www.ietf.org/mailman/listinfo/sacm<https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsacm&data=02%7C01%7Cdavid.waltermire%40nist.gov%7C85a323f673924389c45e08d76e7745e5%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637099330879468039&sdata=JviOvpKGQLNyMiV2fEFSE1qZA3XosOoECBCQuiTK4Lo%3D&reserved=0>

--

Best regards,
Kathleen