Re: [sacm] [Rats] CoSWID and EAT and CWT

Hi Laurence, hi thomas,
hi list,

Thomas, thank you for the nice example write-up! And Laurance, thank you 
for the write-up of an example of a COSE signed EAT including an 
unsigned payload coswid tag.

This is a write-up one option 3.) in issue #46.

Option 4.) would wrap the CoSWID map in a COSE before putting it into an 
EAT using another key (let's say 22 instead of 21 - that's just an 
example). A reason could be that an external entity, such as the SIWD 
role software-creator [1], created the tag and signed it. Other keys 
would follow for XML encoding, type of resource collection, as outlined 
in #46.

Viele Grüße,

Henk

[1] https://tools.ietf.org/html/draft-ietf-sacm-coswid-13#section-4.2

On 27.11.19 01:48, Laurence Lundblade wrote:
> Looks good, Thomas
> 
> Here’s a signed EAT with the CoSWID as a claim with label 21.
> 
> In EATs with submods, there would likely be a CoSWID per submod (not 
> shown below).
> 
> LL
> 
> 
> 18(
>      [
>          / protected parameters, bstr wrapped / << {
>              / alg / 1: -7 / ECDSA 256 /
>          } >>,
> 
>          / unprotected parameters / {
>              / kid / 4: h'4173796d6d657472696345434453413
>                            23536' / 'AsymmetricECDSA256' /
>          },
> 
> 
>          / COSE payload, the EAT, bstr wrapped / << {
>              / nonce  /
> 
>              7:h'948f8860d13a463e8e',
>      
> 
>              / UEID /
> 
>              8:h'0198f50a4ff6c05861c8860d13a638ea4fe2f',
>      
> 
>              / boot_state (based on the -01 draft) /
> 
>              12:{true, true, true, true, false},
>      
> 
>              / time stamp /
> 
>              6:1526542894,
> 
> / The CoSWID /
> 
> 21: {
> 
> / tag-id, globally unique identifier for the software component /
> 
>            0: "trustedfirmware.org/TF-M <http://trustedfirmware.org/TF-M>",
> 
> 
>            / tag-version (here: 0, i.e. initial tag) /
> 
>            12: 0,
> 
> 
>            / software component name /
> 
>            1: "TF-M",
> 
> 
>            / version of the software component /
> 
>            13: "1.0.0-rc1+build.123",
> 
> 
>            / (optional) version scheme (here: semver) /
> 
>            14: 16384,
> 
> 
>            / entity, i.e. organizations responsible for producing or
>         releasing
> 
>              the software component /
> 
>            2: {
> 
>              / entity name /
> 
>              31: "Linaro Limited",
> 
> 
>              / entity role (here: software creator) /
> 
>              33: 2,
> 
> 
>              / thumbprint of the entity public key (algo -- here;
>         SHA-256 -- and value) /
> 
>              34: [
> 
>                1,
> 
>               
>         h'5e73c2e6a96be594e56b218418a3ea03f1397934a2517d781855195fe3c5916b'
> 
>              ]
> 
>        },
> 
> 
>     / payload /
>        6: {
> 
>     / filesystem item (name and hash) /
>          17: {
> 
>     24: "tfm.bin",
>            7: [
>              1,
>             
>     h'4a039f284d8ad68ca5b4d1592977c7c964c4abb5d08d87e4a0346b80cce5c74d'
>            ]
> 
>     }
> 
>          }
>        }
> 
>     } >>,
> 
> 
>         / signature / h'5427c1ff28d23fbad1f29c4c7c6a555e601d6fa29f
>                         9179bc3d7438bacaca5acd08c8d4d4f96131680c42
>                         9a01f85951ecee743a52b9b63632c57209120e1c9e
>                         30'
> 
>     ]
> 
> )
> 
> 
> 
> 
> 
>> On Nov 26, 2019, at 3:51 PM, Thomas Fossati <Thomas.Fossati@arm.com 
>> <mailto:Thomas.Fossati@arm.com>> wrote:
>>
>> Hi Hannes,
>>
>> On 22/11/2019, 00:08, Hannes.Tschofenig@arm.com 
>> <mailto:Hannes.Tschofenig@arm.com>> wrote:
>>> Hi all
>>>
>>> Can someone send an example around how this would actually look like?
>>
>> For something such as TF-M, it should look like this:
>>
>> {
>>  / tag-id, globally unique identifier for the software component /
>>  0: "trustedfirmware.org/TF-M <http://trustedfirmware.org/TF-M>",
>>
>>  / tag-version (here: 0, i.e. initial tag) /
>>  12: 0,
>>
>>  / software component name /
>>  1: "TF-M",
>>
>>  / version of the software component /
>>  13: "1.0.0-rc1+build.123",
>>
>>  / (optional) version scheme (here: semver) /
>>  14: 16384,
>>
>>  / entity, i.e. organizations responsible for producing or releasing
>>    the software component /
>>  2: {
>>    / entity name /
>>    31: "Linaro Limited",
>>
>>    / entity role (here: software creator) /
>>    33: 2,
>>
>>    / thumbprint of the entity public key (algo -- here; SHA-256 -- and 
>> value) /
>>    34: [
>>      1,
>>      h'5e73c2e6a96be594e56b218418a3ea03f1397934a2517d781855195fe3c5916b'
>>    ]
>>  },
>>
>>  / payload /
>>  6: {
>>    / filesystem item (name and hash) /
>>    17: {
>>      24: "tfm.bin",
>>      7: [
>>        1,
>>        h'4a039f284d8ad68ca5b4d1592977c7c964c4abb5d08d87e4a0346b80cce5c74d'
>>      ]
>>    }
>>  }
>> }
>>
>> At least this would be my interpretation of the CoSWID draft.  I'm a bit
>> unsure whether a "filesystem" item is the most appropriate payload for a
>> firmware thingy.  Surely Henk can suggest something better.
>>
>> Cheers!
>>
>>
>> IMPORTANT NOTICE: The contents of this email and any attachments are 
>> confidential and may also be privileged. If you are not the intended 
>> recipient, please notify the sender immediately and do not disclose 
>> the contents to any other person, use it for any purpose, or store or 
>> copy the information in any medium. Thank you.
>> _______________________________________________
>> RATS mailing list
>> RATS@ietf.org <mailto:RATS@ietf.org>
>> https://www.ietf.org/mailman/listinfo/rats
>>
> 
> 
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm
> 