Re: [Suit] New preliminary information model draft

I believe MFT10 and its mitigations still confuse

— is the sender *authorized* to make claims about the firmware image at hand for device X
— does the sender *intend* to make a claim about this firmware destined for device X

The first one can be supported by ACLs.
But the sender may very well be authorized to make a claim, it may just not want to, pertaining to device X.

In general, signed claims may need destination verification.

In a CWT, this is often done with the “aud” claim field.
I have not made up my mind if something like that is enough here as well or we need something more well structured for destination verification.

Grüße, Carsten

> On Jun 13, 2018, at 16:23, Brendan Moran <Brendan.Moran@arm.com> wrote:
> 
> I have uploaded a new information model draft to the suit-wg repo: 
> https://github.com/suit-wg/information-model/blob/v01/draft-ietf-suit-information-model.md
> 
> You can see the diff using Github’s comparison tool:
> https://github.com/suit-wg/information-model/compare/master...v01
> 
> Best Regards,
> Brendan
> 
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit