[sacm] CoSWID and CWT

[Kathleen Moriarty <[e-mail]>]

Hello!

I have been thinking about this a bit more and am wondering if CoSWID could
just be the StringOrURI in a CWT.  This would let you add claims over time
to a CoSWID that are out-of-scope for Co-SWID and it would also put it into
the format of an EAT in case there were other interesting things to do
using that common format.  This would make it an easy adjustment of text
for the CoSWID document as well.  If more claims needed to be defined in
time, it would be quite simple to do it in the CWT rather than the CoSWID
with it's well defined scope.

Looking at the ROLIE descriptor document, it would need to support getting
EATs in this format as well as it specifically calls out getting a signed
or encrypted CoSWID in addition to a CoSWID.  The ROLIE descriptor document
also explicitly calls out what is not in a CoSWID.  There would likely be
some vendor specific claims added and this is possible in a CWT as well.

I hope that clarifies.  Is there a size restriction on the StringOrURI?
The signature would be on the CWT in this case.

-- 

Best regards,
Kathleen