Subject: [sacm] CWT text for CoSWID draft

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 2 Dec 2019 11:57:26 -0500

Hello!

As promised, here are a couple of lines that could be added into the CoSWID
draft to state that it would be possible to use a CWT, but have the
document retain the direct signature capability.

Appendix A:

OLD:
   The ISO-19770-2:2015 XML schema uses XML DSIG to support
   cryptographic signatures.  CoSWID tags require a different signature
   scheme than this.  COSE (CBOR Object Signing and Encryption) provides
   the required mechanism [RFC8152].  Concise SWID can be wrapped in a
   COSE Single Signer Data Object (COSE_Sign1) that contains a single
   signature.  The following CDDL defines a more restrictive subset of

NEW:
   The ISO-19770-2:2015 XML schema uses XML DSIG to support
   cryptographic signatures.  CoSWID tags require a different signature
   scheme than this as the format is CBOR.  COSE (CBOR Object Signing and
Encryption) provides
   the required mechanism [RFC8152] to directly apply a signature and will
be detailed below.  Alternatively, a CBOR Web Token (CWT) [RFC8392], where
the CoSWID would be a claim, and may be useful when combined with
additional claims requiring a signature.

  Concise SWID can be wrapped in a
   COSE Single Signer Data Object (COSE_Sign1) that contains a single
   signature.  The following CDDL defines a more restrictive subset of

A variation would be fine.  The point is just that something simple is
enough and if a specific document is needed, it can be a separate document
that comes later.

Thank you!
-- 

Best regards,
Kathleen