Subject: [Teep] Component IDs in TEEP

From: Dave Thaler <[email-masked]>
Date: Thu, 19 Nov 2020 23:42:33 +0000

Following up on our IETF meeting discussion of the SUIT Component Identifier...
In going over my notes, I wanted to bring up one point that wasn't mentioned in the meeting.

1.      TEEP depends on both RATS (for EATs) and SUIT (for manifests).

2.      EATs, manifests, and TEEP messages all identify a trusted component via some version-independent identifier, in addition to a version.

3.      The RATS WG (per Laurence) plans to use CoSWIDs as the way to identify components in EATs.

4.      The SUIT WG (per Brendan) requires a Component Identifier (an array of ids) and makes a CoSWID optional in addition.

5.      That means you currently must implement both SUIT Component Ids (for manifests) and CoSWIDs (for EATs), not just one or the other.

Do we really want to require even constrained devices to implement both ways of identifying components?
Or do we want an approach like SUIT took where one is mandatory and the other is optional?

Dave

---

From: Akira Tsukamoto <[email-masked]>
Date: Fri, 20 Nov 2020 11:03:55 +0900

Hi,

> Or do we want an approach like SUIT took where one is mandatory and the other is optional?

I prefer the above, mandating only one way of identifying components.

-Akira

On 11/20/2020 8:42 AM, Dave Thaler wrote:
> Following up on our IETF meeting discussion of the SUIT Component Identifier…
> 
> In going over my notes, I wanted to bring up one point that wasn’t mentioned in the meeting.
> 
> 1.TEEP depends on both RATS (for EATs) and SUIT (for manifests).
> 
> 2.EATs, manifests, and TEEP messages all identify a trusted component via some version-independent identifier, in addition to a version.
> 
> 3.The RATS WG (per Laurence) plans to use CoSWIDs as the way to identify components in EATs.
> 
> 4.The SUIT WG (per Brendan) requires a Component Identifier (an array of ids) and makes a CoSWID optional in addition.
> 
> 5.That means you currently /must/ implement both SUIT Component Ids (for manifests) /and/ CoSWIDs (for EATs), not just one or the other.
> 
> Do we really want to require even constrained devices to implement /both/ ways of identifying components?
> 
> _______________________________________________
> TEEP mailing list
> [email-masked]
> https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep&amp;data=04%7C01%7Cakira.tsukamoto%40aist.go.jp%7C25c927152097456a290408d88ce4d064%7C18a7fec8652f409b8369272d9ce80620%7C0%7C1%7C637414261669374998%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=Oj1sfFMYt7iL6ZAeLarXAW86b0V9qqEy%2BImtnFk%2FL9Q%3D&amp;reserved=0
>