Subject: [sacm] CoSWID review

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 25 Oct 2019 11:56:39 -0400

Hello!

Thank you for your extensive work on this document!  If it gains wide
adoption, it could be quite helpful to industry and software security
management.  I support publication of this document and have some comments
and concerns to be addressed.  I did not go through all sections thoroughly
yet, so I may come back with additional comments.

Section 4,
Consider another comma in the first sentence of this text after component:

Software Patching.  When a new patch is applied to the software
         component a new patch tag is provided, supplying details about
         the patch and its dependencies.

Section 2.4:
I see rel(ation) only appears in this section.  I had to poke a bit and see
that (I think) you just mean for rel to expand to relation and rel is used
elsewhere.  Would it be more clear to just define that?  If this is how it
is in SWID, ignore the comment.  I'm just thinking about other
reviewers/readers.  It's defined in 2.7 just as rel.  It's helpful to know
that's short for relation, but if that's all you mean, how about rel
(relation) so it doesn't look like more than it is?

Section 2.6:
A Thumbprint is specified in this section, should this be referenced for
clarity on hashes with COSE for object identification:
https://datatracker.ietf.org/doc/draft-ietf-cose-hash-algs/
Would it be better to tie to the COSE set of supported algorithms (they
likely match, but I didn't verify)?

Section 5:
It might be helpful to list what is being requested at the start of the
IANA section
X registries are established with this request with initial entries for X
registries. Values for Z existing registries are requested.

5.1:
s/This document uses integer/This registry uses integer/

Section 5.2.5:

s/This document defines a new a new a/This document establishes a/

Security Considerations:

I'm wondering why CWT [RFC8392] was not used or recommended for signing. Is
it that the other method fits better within SWIMA?

If CWTs are to be proliferated the way JWTs have been, I suspect it will be
easier for CoSWID to gain traction.  I think it would be good to list use
of a CWT as an option, then registering the claims that one might use for
let's say having the CWT be an EAT and be a remote attestation.  I think
adoption may be better if these are tied together and made simple for
regular readers who will likely start to come across CWTs as opposed to
just signing with one or more signers.  I think what you have us good, but
having both as options would be better.

The claims about the signature may vary from the data in the CoSWID, so
this could be potentially useful.

Thank you!
-- 

Best regards,
Kathleen