[SCITT] Re: Issuer signature creation and TS verification

[Steve Lasker <[e-mail]>]

A.J.
> Going back to my question about normative text, does that mean for an alternative system with kid to be specified, one needs to document an alternative system later on with verification procedures to be conformant? It would seem that is implied by your analysis. That may be something we want to make more clear in this section then if so. I am curious if others on the list feel similarly.

What I think is being teased out is whether the use of x.509 should be defined in the architecture document, or it’s a referenced example. If someone is using x.509, or pgp, the specifics should be defined in profile documents. This way, as new identity types are used with SCITT, we don’t need to rev the architecture document. Each spec would define how the COSE headers would be implemented. This would enable pgp experts to define how they believe it should be represented, or other/new identity types to define their behavior.

I’d be supportive of changing the x.509 to an example within the architecture, as opposed to “the” rule for using x.509 within the architecture.

From: Dick Brooks <[e-mail]>
Sent: Wednesday, July 3, 2024 6:32 AM
To: 'A.J. Stein' <[e-mail]>; 'Steve Lasker' <[e-mail]>
Cc: 'Robin Bryce' <robin.bryce=[e-mail]>; 'scitt' <[e-mail]>
Subject: RE: [SCITT] Re: Issuer signature creation and TS verification

Steve,

What identifier would be used for a PGP signature?

Thanks,

Dick Brooks
[cid:image001.png@01DACE03.A1F8C5B0]  [cid:image002.png@01DACE03.A1F8C5B0]  [cid:image003.png@01DACE03.A1F8C5B0]
Active Member of the CISA Critical Manufacturing Sector,
Sector Coordinating Council – A Public-Private Partnership

Never trust software, always verify and report!<https://reliableenergyanalytics.com/products> ™
https://businesscyberguardian.com/
Email: [e-mail]<mailto:[e-mail]>
Tel: [phone]


From: A.J. Stein <[e-mail]<mailto:[e-mail]>>
Sent: Wednesday, July 3, 2024 12:19 AM
To: Steve Lasker <[e-mail]<mailto:[e-mail]>>
Cc: Robin Bryce <robin.bryce=[e-mail]<mailto:robin.bryce=[e-mail]>>; scitt <[e-mail]<mailto:[e-mail]>>
Subject: [SCITT] Re: Issuer signature creation and TS verification


On Tue, Jul 2, 2024 at 11:03 PM Steve Lasker <[e-mail]<mailto:[e-mail]>> wrote:
What this is saying, in summary is:

  *   You must have an issuer identifier, but no specific type is required
  *   If you use x.509, you must use x5t
This is essentially a profile, without specifying a profile, or an example would be a simple step

Thanks, Steve. Going back to my question about normative text, does that mean for an alternative system with kid to be specified, one needs to document an alternative system later on with verification procedures to be conformant? It would seem that is implied by your analysis. That may be something we want to make more clear in this section then if so. I am curious if others on the list feel similarly.