Re: [Suit] draft-ietf-suit-report: result code values?

Hi Dave,

draft-ietf-suit-report defines a capability report document. I believe
this is what you're looking for.

The SUIT_Capability_Report is defined as follows:

   SUIT_Capability_Report = {
     suit-component-capabilities        => [+ SUIT_Component_Capability ]
     suit-command-capabilities          => [+ int],
     suit-parameters-capabilities       => [+ int],
     suit-crypt-algo-capabilities       => [+ int],
     ? suit-envelope-capabilities       => [+ int],
     ? suit-manifest-capabilities       => [+ int],
     ? suit-common-capabilities         => [+ int],
     ? suit-text-component-capabilities => [+ int],
     ? suit-text-capabilities           => [+ int],
     ? suit-dependency-capabilities     => [+ int],
     * [+int]                           => [+ int],
     $$SUIT_Capability_Report_Extensions
   }

The relevant part here is:
suit-crypt-algo-capabilities       => [+ int],

This is a list of all the COSE Algorithms
(https://www.iana.org/assignments/cose/cose.xhtml#algorithms) that are
supported by the reporting Manifest Processor.

suit-crypt-algo-capabilities can be used to determine which profiles
are supported. Profiles are defined as:

suit-sha256-hmac-a128kw-a128ctr = [-16, 5, -3, -65534]
suit-sha256-es256-ecdh-a128ctr = [-16, -7, -25, -65534]
suit-sha256-eddsa-ecdh-a128ctr = [-16, -8, -25, -65534]
suit-sha256-es256-ecdh-a128gcm = [-16, -7, -25, 1]
suit-sha256-eddsa-ecdh-chacha-poly = [-16, -8, -25, 24]
suit-sha256-hsslms-a256kw-a256ctr = [-16, -46, -5, -65532]

These are each a list of COSE algorithm identifiers: Hash,
Signature/MAC, KEX/KEM, Encryption

A profile is supported if each of the COSE algorithm identifiers in
the profile is present in suit-crypt-algo-capabilities.

The SUIT_Capability_Report is not currently carried in every
SUIT_Report. Maybe it should be? Under what circumstances would a
SUIT_Report carry a SUIT_Capability_Report?

Best Regards,
Brendan

On Sun, Nov 5, 2023 at 3:04 PM
<dthaler1968=40googlemail.com@dmarc.ietf.org> wrote:
>
> > -----Original Message-----
> > From: dthaler1968@googlemail.com <dthaler1968@googlemail.com>
> > Sent: Sunday, November 5, 2023 3:40 PM
> > To: suit@ietf.org
> > Subject: draft-ietf-suit-report: result code values?
> >
> > draft-ietf-suit-report-07 has:
> >
> > > SUIT_Report = {
> > >   suit-reference              => SUIT_Reference,
> > >   ? suit-report-nonce         => bstr,
> > >   suit-report-records         => [ * SUIT_Record /
> system-property-claims
> > ],
> > >   suit-report-result          => true / {
> > >     suit-report-result-code   => int, ; could condense to enum later
> > >     suit-report-result-record => SUIT_Record,
> > >   }
> > >   $$SUIT_Report_Extensions
> > > }
> > [...]
> > > The suit-report-result-code indicates the reason for the failure.
> > > Values
> > are expected
> > > to be CBOR parsing failures, Schema validation failures, COSE
> > > validation
> > failures or
> > > SUIT processing failures.
> >
> > However I don't see any actual values defined.  What should this field
> > contain?
> > E.g., if an unsupported suit-cose-profile was used in the manifest, what
> > should the SUIT record have?
> >
> > Dave Thaler
>
> Another question: does SUIT reports intend to have a way to express
> what suit-cose-profiles are supported when an unsupported one was
> tried?  If not, TEEP or other transports can have a way to express this
> but don't want to duplicate.
>
> Dave
>
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit