Subject: [OPSAWG] MUD and SBoM integration

From: L Jean Camp <[email-masked]>
Date: Mon, 26 Apr 2021 14:27:29 -0400

I am particularly interested in these two question in
draft-ietf-opsawg-sbom-access-00

>Do we need to be more specific in how to authenticate and retrieve SBOMs?
This is a very interesting question, in particular because the use of HTTP
and HTTPS in the document.

Would it be unreasonable to replace HTTP with  HTTPS as a default, with a
potential MIGHT for HTTP as a clearly suboptimal option?

>What are the implications if the MUD URL is an extension in a certificate
(e.g. an IDevID cert)?
of course, these expire leading the question below, also it seems like this
is a good KeyUsage extension?

>Are there other retrieval mechanisms that need to be specified?
I would like to propose that there MIGHT be an option for companies to
demand upon purchase or manufacturers to offer upon release an archival
data source beyond URI and presumptively the Internet archive.  Having an
option defined here, now, could be a valuable feature, particularly for the
"contact" option.

I say this because one the major issue that seems to be critical for
longer-lived IoT and CPS devices is the ability to access an updated or
relevant SBoM or MUD_file; for example, when one company purchases another
-- and that previous company has devices that did have SBoMs or were
MUD-complaint but that data is no longer available as the QR codes are
long-lost or the contact long-gone. A thoughtful MIGHT here could be quite
valuable.

Thanks for your time and consideration.

Here are some things about the intro that impinge the larger questions
above.

In terms of specifics, the first proposal references COAP and HTTP. I
believe that should be HTTPS for a security-critical supply chain issue or
least identify it as an option that might be useful.  It seems as if HTTP
and HTTPS are used interchangeably.

The second condition says, "In the second case, when a device does not have
an appropriate  interface to retrieve an SBOM, but one is directly
available from the manufacturer, a URI to that information must be
discovered."

Is that case shouldn't the "but" be "And" because otherwise it seems like
the existence of MUST seems to be a logical difference with the existence
of the third, more private option where the manufacturer may choose to
share an SBoM, for example, during licensing. It may not be accessible to
the public and universally locatable yet it would be directly available.
-- 
Prof. L. Jean Camp
http://www.ljean.com

Research Gate: https://www.researchgate.net/profile/L_Camp
DBLP: http://dblp.uni-trier.de/pers/hd/c/Camp:L=_Jean
SSRN: https://papers.ssrn.com/sol3/cf_dev/AbsByAuth.cfm?per_id=262477
Scholar: https://scholar.google.com/citations?user=wJPGa2IAAAAJ
<https://scholar.google.com/citations?user=wJPGa2IAAAAJ&hl=en&oi=ao>
Make a Difference
http://www.ieeeusa.org/policy/govfel/congfel.asp