[SCITT] Re: SCITT WG: IETF 127 Agenda Planning

[Nicholas Templeman <[e-mail]>]

Nicole, Henk, all,

Support for Henk's second item, the re-chartering discussion on relation
semantics between statements, and one implementation data point for it. I am not
asking for a slot of my own, and our interoperability work belongs in the
hackathon unless it raises a decision for the group.

The data point bears on how a relation by digest is stated. Working the CCF 2.2
data-hash axis for the joint interop report, we minted one signed statement and
re-encoded it 64 ways using six CBOR encoding freedoms. All 64 carried one
identical Sig_structure and one valid signature, produced 64 distinct data-hash
values, and none was rejected by a stock decoder; 31 were silently repaired on
read. The prior art that closes the class is
draft-mih-sokolov-scitt-payload-binding-02, section 4.4, which Anton Sokolov
wrote before the measurement. For the re-chartering question the consequence is
narrow: a statement that says it references another statement by digest has to
say which bytes the digest is over, or two verifiers can hold the same relation
and disagree about whether it resolves.

Mikhail's audit-coverage case is one we meet from the other side. Our withdrawal
records share the subject of the statements they withdraw and fall outside any
set an earlier audit statement covered, and a generic verifier has no way to see
that from the headers today. So the decision I would want from the discussion is
the same as Konrad's: whether references of that kind, content-type agnostic and
readable without interpreting the payload, are in the proposed scope.

Two declarations so that nothing above is over-read. Council of AI is not a
Transparency Service and mints no Receipts, and both digests in that measurement
were recomputed from the published bytes rather than read off the implementation
that produced them.

Nicholas Templeman
Council of AI (csoai.org)