[SCITT] Action requested: Focused Working Group Last Call on Section 4 of the CCF Profile

Nicole Bates <nicolebates@microsoft.com> Fri, 25 September 2026 17:44 UTC

Received: from CH5PR02CU005.outbound.protection.outlook.com (mail-northcentralusazlp170120005.outbound.protection.outlook.com [IPv6:2a01:111:f403:c105::5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange secp256r1 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mx.ietf.org (Postfix) with ESMTPS id C5C6631; Fri, 25 Sep 2026 17:44:54 +0000 (UTC)
Authentication-Results: mx.ietf.org; dkim=pass header.d=microsoft.com header.s=selector2 header.b=ToGcwWzP; arc=pass ("microsoft.com:s=arcselector10001:i=1"); dmarc=pass (policy=reject) header.from=microsoft.com; spf=pass (mx.ietf.org: domain of nicolebates@microsoft.com designates 2a01:111:f403:c105::5 as permitted sender) smtp.mailfrom=nicolebates@microsoft.com
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Kr+ZkPhxuT5xKUHvB+HgkNB4X7OXHlebQc8D5D02bV6WN2RAuglQnDwE0MEzqVYYrd96yMZbPDcF3uEGAwNgLt668r+ABwEr8BJUHSGYxX6U6YSywLWkopDBnyA7iJFhd08bFmr0BWEMmHexqhvmBAB51028p0hwu16lHvrp4K8ZmnshuIbCftHN56DGeMI5d7Yb2HTo/0STbbycDjDQdNSLjNM+9Vc1fEMYgSMp4KDshUTwCnLrqPUfZj8rYdis4HqlQ++9ZqbiCBx1qJsd1lTNIOxPQAUhFyRG5dSsVjXYYfDOEVgtsTPKajafAVXi2fKVqAC3WeuL502I4JGtLA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Jp03H8DwmdIrgCpqu0vZePa0l+R3QWrjSJ5CJR+gSrQ=; b=dVH3zD2PMrGoprT671rrytvx+xXQ1woxNu613MMZIwFMe2yHRyKzsBkGDiwskQVt9bfvHbfKhpDTtrssXLVgn1TOZRJncrxHt+vuVCzMYKqfTunn2X1PX2eoMfjQhlhSoLDuidExJ4UqnkHLMGA26hCtsdAQeQVHS0CWBIFzCyc/fV20Lj+FOEa5QnMgGShv0VePqPHCzH3j9ktWD7fLQj1ji5XPLvXgmOycHnT85o97Ap3MZCQZJMzUv7RY19BocVAcqyUFGdny8Qm981vqjwy0HYOHbun4KSrfZqIa1D0VYf5yPkgDATo/4kty9TKYjcMYh2u0yOBzG9mHWlnyng==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Jp03H8DwmdIrgCpqu0vZePa0l+R3QWrjSJ5CJR+gSrQ=; b=ToGcwWzPthNFRNt3KLsnqOJdN+asBScsby6BR23771LmMLgFBuPMuwV5mt+DWeANTmMIDqhLlt1Fy8QQWYZb0N3Ysv28/CeUxtuSxG2m2IJvsYXXpxnl3uGrT9lPBTxGEwOco5JtP2g3Dh2bh2tLEZevq2x+nDUZ26UvR4uw9Mw=
Received: from SA1PR21MB6104.namprd21.prod.outlook.com (2603:10b6:806:4b0::7) by SA1PR21MB6586.namprd21.prod.outlook.com (2603:10b6:806:4a9::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.7; Fri, 25 Sep 2026 17:44:46 +0000
Received: from SA1PR21MB6104.namprd21.prod.outlook.com ([fe80::d9e5:bf4b:4483:7894]) by SA1PR21MB6104.namprd21.prod.outlook.com ([fe80::d9e5:bf4b:4483:7894%6]) with mapi id 15.21.0472.005; Fri, 25 Sep 2026 17:44:45 +0000
From: Nicole Bates <nicolebates@microsoft.com>
To: 'scitt' <scitt@ietf.org>
Thread-Topic: Action requested: Focused Working Group Last Call on Section 4 of the CCF Profile
Thread-Index: AQHdTRWNmEBHKUkM30CFpdvTHugrWg==
Date: Fri, 25 Sep 2026 17:44:45 +0000
Message-ID: <SA1PR21MB61048DF3E73A2AAAA07A330EA2802@SA1PR21MB6104.namprd21.prod.outlook.com>
References: <SA1PR21MB6104F2BECAE29404CFB07DF9A2802@SA1PR21MB6104.namprd21.prod.outlook.com>
In-Reply-To: <SA1PR21MB6104F2BECAE29404CFB07DF9A2802@SA1PR21MB6104.namprd21.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2026-09-25T17:44:45.933Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=1;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SA1PR21MB6104:EE_|SA1PR21MB6586:EE_
x-ms-office365-filtering-correlation-id: 14eb26a9-32e5-4e47-c5cc-08df1b2cafbd
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|10067099003|6133799003|7146999003|11063799006|56012099006|8096899003|18002099003|22082099003|38070700021;
x-microsoft-antispam-message-info: /Kk2pV45714ivAaHeXNiPzZ0lqMUCPX7gjDRbeh0iPTjDr9sxaHmNXCs3eeVGbN24EY2bggbvSErazkBUq+t05QVerTUmT/CyIo+P9qCqwy5fvIzayauvUdk86mdt0LmbYDAPLeBs0NC+QMqW/gNkThERcWOOUQelgJzinkGsVpS2Mz4R88aBjU2Rm0PnUFe16e1Qa5hsIAWPPjj/tvysNILTC6JXfTWJxF5rV60bqRVFu3CfcreHA7M6oB6cMhpPvDyKMWA6iaL5bqKk+7RvUBLIfkStxUfdYDIixreWxDhEgrEm1dQtLYYRdn/Z5whgoVT8jqJRbUlabKANJTbp2DAL9mCRbYobmOk34uYchuFXpB/4v3GqraEPMjC7LNAe/ymyNuQV2pR3wEbvnOG0M9kRD1xnaBUPASq3/JtH3Xc9CNznU5uTwbGuqPXNbxaq+EnwY2KwRNQliau9LHF4AGrINQDzwsoMENfbyfRRce87a8neZtrassCZtxdMoNpnFPflVC8AWG+jgp3FABFddMBFtY1GbDFJq7+NQq/ow77HRXpHwJJu7JfizcmrCIT6cQM67GhWt8JQSUD5DzCi23E8p6sp22X7Pw9TiS1olLyDEPIc3B2ZuwaMoKQYNkPhfjv7j3PdzCxWQLVKIfSJnYex8pnyeAGmgb4Gpq7zcIW7wRAUlGdZ/Vf45MuuHv3yPuF3iXJQplmVhjBUWfnywdNqvRqd3AZjLdz8okK8sY=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR21MB6104.namprd21.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(10067099003)(6133799003)(7146999003)(11063799006)(56012099006)(8096899003)(18002099003)(22082099003)(38070700021);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 0rJcqnmbTPr+sfMdhqf9dAQouqhj0JLn8floXduO1KDwuVgqqzkJ4Fni5CzOV3mKkopneUyl/ypWwVm7+lDiwHG3a49FN/241UsbuBTQ171ht0leK+N6OPhlLWa6JN8BHELYuqm+uINQfajNisNy7WwEdDcV0Blp+uW3bk49AW8TZxE0njv+0wepFFQNLfzW+VmOfeCJhkUOuI2REus8QOkSiZUwX12TjA2HbKglG5kNA7tp+r8YyXwpKKMFQ3DWA4BcXexdhu5o3kmZui0Go0XTGMjtroHht7ReCJrrLQWPFLSIJHukpr17YJe6pxoAulcTJTand/HIHSL6EYMCr0XzeSaYulp7iNU0i/U6e+CS0hze2ldSYjjKxT2ixH8P4NPCB1dWfthXkSnvAW3p8UMOaX21OTzJAM0Vcf3pbYvj7b72z9QR4xK2UvBkVZv44XTM5DMnB4QCWMYJI1QJoW7seZeKfTf/QGAJKEAYdTo8uJ94a46wtJO8gzsTqJ1tuGGVTk7RmcorfpYfNmVVWWx3tN2EVGVD9v2ho+F/KYPUc6Py8i01csoqvfaisXoRHgBrcseLl24un4yTMa6sh5rM42cWRxuv2HiIM24xI4BaUUBjQChuJ6LW9AeaZ3EHaBMqVmnsflyVGtNqNiHkXbA3r+3lfBfLPaRKVD0CDqTl/AtWAhm0PzOH0cb1jopaGznRKFT3sPm1ctgFdclWbm78CvzZ9uOJWdhDfuIasgeoqLXqfbeH+04JfisiEs0cov3/vYMt3tdZhAcoGbnF3g+hp/3BKO5ypWKVwyZP5Qoa3AXa/hsprmNhhlfai2E/hI3M/AIchy5DllFH1AVvq2NM1PNJdwGivlb+gw9ejAHn45UETtnxqI4/A8h0hqkX1on+wz3q0orAWBarU0Cc63xH5I4lCvAeEXu2A6yMun30dRuXbC9fyPZCUBL32t+jlhtNEZNpQMt+97nrtLRNJ1HX/rzu+1TO13TOOJk6bADCWbCCbKnUVNnjrTWZyTKM5tIMj9JzU38OxFm1Uac9hFwlycXN2K4AWBrcWNb2Tzco0ARr0Zl3bm43jHLQwOhWfLFy6WJeDeqLOCapB/SPeP9j0ip5zcjEXBtG+YNPNW29WY5J040cR3FAUj48jyuh+XYWU/ShHtkOkHGiXkdvMkc58BXomUr29eBFI5cGZjwRxEuSulpsCpdJ4wL+noKDJ4ZzdBbnxqSLPK9YZSMWqXmIvSJXkYWsCLV+7sgo9SBvNYjxbKfYn2H55puWGSBVOKKmSFRPrv0XiIO03QUYrzFjysZTCefqeNBU7D4RfxMDbysGy5+bVIm5hhMOA78W5NdPLN17qhkBR7vffsSTfiCtisaZyXts/mbEbJKBV2DFMh+zn23jV94lXL0bxbHykZM39BAojVFyc6nT73btoIYH1Q2vHpNswJd408WtbCAurMrXNz4fy0iMFDhmLpqthbXQrz/EV094rpTdEvuexN3IwlMkbjaIz0U1OpSDpySF0l9yYM/9fI2x3tEaxmgJv9CeQ+90eCxq36JXfYPLrGLzjE2C8u3PanQFgnAZfdDYqWoao9C8Yz3zbZhDnqGVgWRXUdVAXXFN2cTZGSvTLgr1i2WpMkdRYqbQB/9IhX1uzAIGKHlvax3Xv+45KazyyvSNpVJzROf3CG1Hx7xqaA==
Content-Type: multipart/alternative; boundary="_000_SA1PR21MB61048DF3E73A2AAAA07A330EA2802SA1PR21MB6104namp_"
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SA1PR21MB6104.namprd21.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 14eb26a9-32e5-4e47-c5cc-08df1b2cafbd
X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Sep 2026 17:44:45.0637 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: LpNX5foeKYTu70wN9ZnycouP0Sh5IqTBtY1JG2COh+kbS2DtMmuc1O2ySCMJ5o61rNyvoaWfGyaFmKIHvEw23DVXpWRXJYIZt21gPJSZOR4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR21MB6586
X-Spamd-Bar: ------
X-MailFrom: nicolebates@microsoft.com
X-Mailman-Rule-Hits: header-match-scitt.ietf.org-3
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-scitt.ietf.org-0; header-match-scitt.ietf.org-1; header-match-scitt.ietf.org-2
Message-ID-Hash: QNZWDRO2QRWNRX6S5PBZYUG4TF7UXEPQ
X-Message-ID-Hash: QNZWDRO2QRWNRX6S5PBZYUG4TF7UXEPQ
X-Mailman-Approved-At: Fri, 25 Sep 2026 17:45:44 +0000
CC: "scitt-chairs@ietf.org" <scitt-chairs@ietf.org>
X-Mailman-Version: 3.3.10
Precedence: list
Subject: [SCITT] Action requested: Focused Working Group Last Call on Section 4 of the CCF Profile
List-Id: "Supply Chain Integrity, Transparency, and Trust" <scitt.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/scitt/mV6rwaJ3doCJDjK0zo9Y2IcGS60>
List-Archive: <https://mailarchive.ietf.org/arch/browse/scitt>
List-Help: <mailto:scitt-request@ietf.org?subject=help>
List-Owner: <mailto:scitt-owner@ietf.org>
List-Post: <mailto:scitt@ietf.org>
List-Subscribe: <mailto:scitt-join@ietf.org>
List-Unsubscribe: <mailto:scitt-leave@ietf.org>

SCITT Working Group,

The CCF Profile previously completed Working Group Last Call, but the CCF specific consistency proof format and verification algorithm now defined in Section 4 of draft 05 were not part of that review. At the Area Director’s request, the chairs are conducting a focused Working Group Last Call on Section 4 only.

Please review Section 4 and respond to the list by Friday, October 9, 2026, indicating whether:

• You support Section 4 and believe the document is ready to advance; or
• You believe changes to Section 4 are required before the document advances. Please describe the specific changes or concerns.

The other sections are not being reopened because they were reviewed and accepted through the previous Working Group Last Call. This focused confirmation is needed before the document can continue through the publication process.


Draft 04 discussed consistency proofs and the need to audit consistency between CCF ledger states, but it did not define a CCF specific consistency proof format or verification algorithm. Draft 05 adds that material in Section 4, including:

• The CCF consistency proof representation and canonical anchor
• Section 4.1, defining the COSE_Sign1 encoding and header requirements for consistency receipts
• Section 4.2, defining the consistency proof verification algorithm

Section 4 defines how a verifier can determine whether an older CCF ledger state is consistent with a newer state, complementing the inclusion proofs already reviewed by the Working Group.

Please consider whether the consistency proof definition is technically correct, complete, and sufficiently clear for interoperable implementation. Feedback would be particularly helpful on:

• The proof representation and canonical anchor definition
• Computation of the older and newer Merkle roots
• Use of a previously trusted older root
• COSE signature and detached payload processing
• Handling of multiple consistency proofs

Draft 05:
https://datatracker.ietf.org/doc/draft-ietf-scitt-receipts-ccf-profile/

Diff from draft 04 to draft 05:
https://author-tools.ietf.org/iddiff?url1=draft-ietf-scitt-receipts-ccf-profile-04&url2=draft-ietf-scitt-receipts-ccf-profile-05&difftype=--html


Thank you,

Nicole
For the SCITT chairs