[saag] SCITT WG summary

SCITT met on Tuesday @ IETF-124.  The major items coming out of the meeting are:

    • COSE Receipt Profiles
        • COSE CCF (Https://datatracker.ietf.org/doc/draft-birkholz-cose-receipts-ccf-profile/)
        • COSE MMR (Https://datatracker.ietf.org/doc/draft-bryce-cose-receipts-mmr-profile/)
The chairs would like an "on-list" discussion about the additional features of this profile and an explaination of how that benefits SCITT.
    • OCP HW assertions
Currently HW supply chain is out of scope of the charter; but HW
statements can easily be included in the SCITT statements, but the
WG cannot publish about it at this time. This leads to a
conversation about the SCRAPI and that it is currently a generic API
set; how does the WG want to handle area specific "enhancements" for
SCITT applications, or does the WG want to handle that, or let other
WGs/venues handle that. Orie currently has comments, on list, about
enhancements for SW supply chain analysis.
    • Should aspects of the payload be put into the CBOR header or not?
Henk will put to the list a question about if some signed statements
about the opaque payload should be included into the signed CBOR
envelope. This would enable some amount of analysis / graph
building to happen in a generic way (independent of the SCITT
applied use case: SW, HW, fish, etc.)


Complete notes are in the minutes.

Jon and Chris

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]