Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Addressing IESG evaluation feedback #48

Merged
merged 78 commits into from Mar 21, 2022
Merged
Changes from 1 commit
Commits
Show all changes
78 commits
Select commit Hold shift + click to select a range
425ee58
Nits from Éric during IESG evaluation
henkbirkholz Feb 9, 2022
36f9c52
fixed redundant BCP 26 / RFC 8126 ref
henkbirkholz Feb 9, 2022
29057dd
fixing the correct ref entry helps...
henkbirkholz Feb 9, 2022
d59efeb
Adressing Ben's comment (1)
henkbirkholz Feb 17, 2022
9a8c6fa
Addrssing Ben's commnet (8). What a curious oversight.
henkbirkholz Feb 17, 2022
e4aef22
partially addressed Ben's comment #2
henkbirkholz Feb 21, 2022
5744d3b
markdown...
cabo Feb 21, 2022
24e72c9
More updates for Ben#2
cabo Feb 21, 2022
70f3434
Ben#3
cabo Feb 21, 2022
be1172c
Ben #5, IANA
cabo Feb 21, 2022
719ebf5
Ben #7
cabo Feb 21, 2022
767f235
Ben #4
cabo Feb 21, 2022
7842f12
Ben #4
cabo Feb 21, 2022
268bdc2
Fix trailing whitespace
cabo Feb 21, 2022
4106069
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Feb 21, 2022
4bbab0e
double quote for merge
henkbirkholz Feb 21, 2022
99df02b
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Feb 21, 2022
29ffe13
size and stack update
henkbirkholz Feb 25, 2022
ba33b21
payload and evidence (commment on section 2.3)
henkbirkholz Feb 25, 2022
c5fd9c6
removed the weird monotonic
henkbirkholz Feb 25, 2022
54d2e0c
SHOULD contraints consequences (comment on section 2.4)
henkbirkholz Feb 25, 2022
63ef9aa
more consequences on violating constraints
henkbirkholz Feb 25, 2022
0a24720
uri-schemes in reg-id
henkbirkholz Feb 25, 2022
e3f8af0
Switch do domainprefix/name
cabo Mar 2, 2022
f220b96
some things
henkbirkholz Mar 2, 2022
f353714
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Mar 2, 2022
5d7d392
Sec-cons for relative paths
cabo Mar 2, 2022
f1c49bd
Clarify that artifact is an absolute filesystem path
cabo Mar 2, 2022
87fdb84
Clarify base of relative URIs
cabo Mar 2, 2022
eb36b07
typo
cabo Mar 2, 2022
d1ca428
Ben re media-type (Section 2.7)
cabo Mar 2, 2022
8d2ec78
Ben 2.8: String comparison is byte-by-byte
cabo Mar 2, 2022
6df2d87
Ben 2.8: Generator can be a tag-id
cabo Mar 2, 2022
7a3d853
Ben 2.8: Generator can be a tag-id
cabo Mar 2, 2022
93dff88
Ben 2.9.1 ("current" in registry)
cabo Mar 2, 2022
45f0c5f
comment on Section 2.9.1 "parity"
henkbirkholz Mar 2, 2022
ed89780
ownership change in .cddl, too
cabo Mar 2, 2022
7693748
comment file version (index 21)
henkbirkholz Mar 3, 2022
0cd0830
added location to evidence-entry based on the comment on location (in…
henkbirkholz Mar 3, 2022
d77003f
corresponding change in full cddl
henkbirkholz Mar 3, 2022
457ad58
clarify interdependence of location values
cabo Mar 3, 2022
273405b
comment on type (index 29)
henkbirkholz Mar 3, 2022
dab54e7
Explain that indexed label values have a reserved 0
cabo Mar 3, 2022
0ca68e4
Clarify version scheme ordering
cabo Mar 3, 2022
a6a4508
Mark index 30 as unassigned
cabo Mar 3, 2022
8227258
Clarify the use of IDNA labels in domainprefix/name
cabo Mar 3, 2022
c94b7f8
comment on Section 6.2.2
henkbirkholz Mar 3, 2022
55ce7fa
also no "initially"
henkbirkholz Mar 3, 2022
1a1ccf6
made a span a block
henkbirkholz Mar 3, 2022
01d2e0e
Use "criteria" in place of "guidelines" that are more like "rules"...
cabo Mar 3, 2022
00ffc80
SHOULD -> MUST for squatting
cabo Mar 3, 2022
4092a79
Reference 9052-to-be instead of 8152
cabo Mar 3, 2022
af2cb66
Fragment identifier considerations
cabo Mar 3, 2022
54f1e60
Conditionalize magic number
cabo Mar 3, 2022
8ed87fc
Silence xml2rfc a bit more
cabo Mar 3, 2022
904ffe4
fix irregularity
cabo Mar 3, 2022
a6894df
already fixed, typo
cabo Mar 3, 2022
4b09d9e
Ben re 6.7 (-> better define tag-id)
cabo Mar 3, 2022
a46ed91
removed prescriptive key identifier content
henkbirkholz Mar 6, 2022
a9e75a8
improved Section 8 header
henkbirkholz Mar 6, 2022
e3bb265
added an up to date COSE countersign reference
henkbirkholz Mar 6, 2022
4f30db6
Spell checker
cabo Mar 6, 2022
e742103
Discuss cross-algorithm attacks on hashes
cabo Mar 6, 2022
8ba0e9d
added SecCon on suppressed new tags
henkbirkholz Mar 6, 2022
5a4f7d8
Add some seccons references
cabo Mar 6, 2022
497482f
Discuss disclosure, particularly via entitlement keys
cabo Mar 6, 2022
3b03432
Explain that signed ≠ true
cabo Mar 6, 2022
c6ca7fc
Secure key/entity database
cabo Mar 6, 2022
7a63cbe
veracity -> + suitability
cabo Mar 6, 2022
4d732df
use, not create revocation information
cabo Mar 6, 2022
6eced39
tags aren't confidential, but which apply is
cabo Mar 6, 2022
7a2adf0
tag-id collision as an attack
cabo Mar 6, 2022
52063fb
easily discoverable -> by authorized applications and users on an
cabo Mar 6, 2022
d6c7b7b
moved X.1520 to informative
henkbirkholz Mar 6, 2022
8ce75cb
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Mar 6, 2022
cdeea43
Ben's nits
cabo Mar 6, 2022
46f25c0
typo
cabo Mar 6, 2022
75e19f4
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Mar 6, 2022
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
@@ -298,7 +298,7 @@ notation explicitly relates to XML SWID tags; an attribute referred to by its na
KebabCase notation explicitly relates to CBOR CoSWID tags. This approach simplifies the
composition of further work that reference both XML SWID and CBOR CoSWID documents.

In most cases, mapping attribute names between SWID and CoSWID can be done automatically by converting between CamelCase and KebabCase attribute names. However, some CoSWID CDDL attribute names show greater variation relative to their corresponding SWID XML Schema attributes. This is done when the change improves clarity in the CoSWID specification. For example, the "name" and "version" SWID fields corresponds to the "software-name" and "software-version" CoSWID fields, respectively. As such, it is not always possible to mechanically translate between corresponding attribute names in the two formats. In such cases, a manual mapping will need to be used. These cases are specifically noted in this and subsequent sections using an {{-xpath}} where a manual mapping is needed.
In most cases, mapping attribute names between SWID and CoSWID can be done automatically by converting between CamelCase and KebabCase attribute names. However, some CoSWID CDDL attribute names show greater variation relative to their corresponding SWID XML Schema attributes. This is done when the change improves clarity in the CoSWID specification. For example, the "name" and "version" SWID fields corresponds to the "software-name" and "software-version" CoSWID fields, respectively. As such, it is not always possible to mechanically translate between corresponding attribute names in the two formats. In such cases, a manual mapping will need to be used. XPath expressions {{-xpath}} need to use SWID names, see {{uri-scheme-swidpath}}.

The 57 human-readable text labels of the CDDL-based CoSWID vocabulary are mapped to integer indices via a block of rules at the bottom of the definition. This allows a more concise integer-based form to be stored or transported, as compared to the less efficient text-based form of the original vocabulary.

@@ -679,7 +679,7 @@ The following describes each member of this map.
URI needs to be resolved in the context of the endpoint by software
that can lookup other SWID or CoSWID tags. For example, "swid:2df9de35-0aff-4a86-ace6-f7dddd1ade4c" references the tag with the tag-id value "2df9de35-0aff-4a86-ace6-f7dddd1ade4c".
- a URI with "swidpath:" as the scheme, which refers to another software tag via an
XPATH query {{-xpath}}. This scheme is provided for compatibility with {{SWID}}. This specification does not define how to resolve an XPATH query in the context of CBOR.
XPATH query {{-xpath}} that matches items in that tag ({{uri-scheme-swidpath}}). This scheme is provided for compatibility with {{SWID}}. This specification does not define how to resolve an XPATH query in the context of CBOR, see {{uri-scheme-swidpath}}.

- media (index 10): A hint to the consumer of the link to what target platform the link is applicable to. This item represents a
query as defined by the W3C Media Queries Recommendation (see {{-css3-mediaqueries}}). As highlighted in media defined in {{model-concise-swid-tag}}, support for media queries are included here for interoperability with {{SWID}}, which does not provide any further requirements for media query use. Thus, this specification does not clarify how a media query is to be used for a CoSWID.
@@ -1094,7 +1094,7 @@ defined going forward.
{: #uri-scheme-swid}
## "swid" URI Scheme

There is a need for a scheme name that can be used in URIs that point to a specific software tag by that tag's tag-id, such as the use of the link entry as described in {{model-link}}) of this document. Since this scheme is used both in a standards track document and an ISO standard, this scheme needs to be used without fear of conflicts with current or future actual schemes. In {{swid-reg}}, the scheme "swid" is registered as a 'permanent' scheme for that purpose.
There is a need for a scheme name that can be used in URIs that point to a specific software tag by that tag's tag-id, such as the use of the link entry as described in {{model-link}}. Since this scheme is used both in a standards track document and an ISO standard, this scheme needs to be used without fear of conflicts with current or future actual schemes. In {{swid-reg}}, the scheme "swid" is registered as a 'permanent' scheme for that purpose.

URIs specifying the "swid" scheme are used to reference a software tag by its tag-id. A tag-id referenced in this way can be used to identify the tag resource in the context of where it is referenced from. For example, when a tag is installed on a given device, that tag can reference related tags on the same device using URIs with this scheme.

@@ -1109,19 +1109,24 @@ swid:2df9de35-0aff-4a86-ace6-f7dddd1ade4c
{: #uri-scheme-swidpath}
## "swidpath" URI Scheme

There is a need for a scheme name that can be used in URIs to identify a collection of specific software tags with data elements that match an XPath expression, such as the use of the link entry as described in {{model-link}}) of this document.
Since this scheme is used both in a standards track document and an ISO standard, this scheme needs to be used without fear of conflicts with current or future actual schemes.
In {{swidpath-reg}}, the scheme "swidpath" is hereby registered as a
'permanent' scheme for that purpose.
There is a need for a scheme name that can be used in URIs to identify a collection of specific software tags with data elements that match an XPath expression, such as the use of the link entry as described in {{model-link}}.
The scheme named "swidpath" is used for this purpose in {{SWID}}, but not registered.
To enable usage without fear of conflicts with current or future actual schemes, the present document registers it as a
'permanent' scheme for that purpose (see {{swidpath-reg}}).

URIs specifying the "swidpath" scheme are used to reference the data that must be found in a given software tag for that tag to be considered a matching tag to be included in the identified tag collection. Tags to be evaluated include all tags in the context of where the tag is referenced from. For example, when a tag is installed on a given device, that tag can reference related tags on the same device using a URI with this scheme.
URIs specifying the "swidpath" scheme are used to filter tags out of a base collection, so that matching tags are included in the identified tag collection.
The XPath expression {{-xpath}} references the data that must be found in a given software tag out of base collection for that tag to be considered a matching tag.
Tags to be evaluated (the base collection) include all tags in the context of where the "swidpath URI"" is referenced from.
For example, when a tag is installed on a given device, that tag can reference related tags on the same device using a URI with this scheme.

For URIs that use the "swidpath" scheme, the requirements apply.
For URIs that use the "swidpath" scheme, the following requirements apply:

The scheme specific part MUST be an XPath expression as defined by {{-xpath}}. The included XPath expression will be URI encoded according to {{RFC3986}} Section 2.1.
* The scheme specific part MUST be an XPath expression as defined by {{-xpath}}. The included XPath expression will be URI encoded according to {{RFC3986}} Section 2.1.

This XPath is evaluated over SWID or CoSWID tags found on a system. A given tag MUST be considered a match if the XPath evaluation result value has an effective boolean value of "true" according to {{-xpath}} Section 2.4.3.
* This XPath is evaluated over SWID tags, or COSWID tags transformed into SWID tags, found on a system. A given tag MUST be considered a match if the XPath evaluation result value has an effective boolean value of "true" according to {{-xpath}} Section 2.4.3.

<!-- In other words: If SWID tags were cars, the XPath says "automatic
transmission" and yields a set of cars. -->

{: #iana}
# IANA Considerations