Subject: [sacm] [sacmwg/draft-ietf-sacm-coswid] tasks assigned to Henk (#45)

From: Henk Birkholz <[email-masked]>
Date: Fri, 15 Oct 2021 05:00:05 -0700

this is missing an answer to &quot;Can the tag-id be a digest of the source file?&quot;, which requires a reply to the list
You can view, comment on, or merge this pull request online at:

  https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45

-- Commit Summary --

  * <a href="https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45/commits/539483a6af105c185de9c5f32089c91cd2ad0b6f">tasks assigned to Henk</a>

-- File Changes --

    M draft-ietf-sacm-coswid.md (11)

-- Patch Links --

https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45.patch
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45

---

From: Henk Birkholz <[email-masked]>
Date: Fri, 15 Oct 2021 06:55:30 -0700

@henkbirkholz pushed 1 commit.

86c988d2ac99d96b529f601422ceaa33c3079544  adding Charles' output to this branch

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45/files/539483a6af105c185de9c5f32089c91cd2ad0b6f..86c988d2ac99d96b529f601422ceaa33c3079544

---

From: Henk Birkholz <[email-masked]>
Date: Fri, 15 Oct 2021 07:00:16 -0700

179e2c18887f955b82cf5ef420943edf7997bccc  fixed author email

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45/files/86c988d2ac99d96b529f601422ceaa33c3079544..179e2c18887f955b82cf5ef420943edf7997bccc

---

From: David Waltermire <[email-masked]>
Date: Mon, 18 Oct 2021 06:49:04 -0700

@david-waltermire-nist commented on this pull request.

> @@ -1641,28 +1639,30 @@ A signed CoSWID tag (see {{coswid-cose}}) whose signature has been validated can
 
 When an authoritative tag is signed, the originator of the signature can be verified. A trustworthy association between the signature and the originator of the signature can be established via trust anchors. A certification path between a trust anchor and a certificate including a public key enabling the validation of a tag signature can realize the assessment of trustworthiness of an authoritative tag. Verifying that the software provider is the signer is a different matter. This requires an association between the signature and the tag's entity item associated corresponding to the software provider. No mechanism is defined in this draft to make this association; therefore, this association will need to be handled by local policy.
 
+Loss of control of signing credentials used to sign CoSWID tags would create doubt about the authenticity and integrity of any CoSWID tags signed using the compromised keys. In such cases, the legitimate tag signer (namely, the software provider for an authoritative CoSWID tag) can simply employ uncompromised signing credentials to create a new signature on the original tag. The tag version number would not be incremented since the tag itself was not modified. Consumers of CoSWID tags would need to validate the tag using the new credentials and would also need to revoke certificates associated with the compromised credentials to avoid validating tags signed with them. The process for doing this is beyond the scope of this specification.

```suggestion
Loss of control of signing credentials used to sign CoSWID tags would create doubt about the authenticity and integrity of any CoSWID tags signed using the compromised keys. In such cases, the legitimate tag signer (namely, the software provider for an authoritative CoSWID tag) can employ uncompromised signing credentials to create a new signature on the original tag. The tag version number would not be incremented since the tag itself was not modified. Consumers of CoSWID tags would need to validate the tag using the new credentials and would also need to revoke certificates associated with the compromised credentials to avoid validating tags signed with them. The process for doing this is beyond the scope of this specification.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45#pullrequestreview-782082370

---

From: David Waltermire <[email-masked]>
Date: Mon, 18 Oct 2021 06:49:46 -0700

This doesn't sound simple, so removing simple here would be better.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45#discussion_r730941942

---

From: David Waltermire <[email-masked]>
Date: Mon, 18 Oct 2021 06:53:24 -0700

> @@ -1692,6 +1692,10 @@ providers are unlikely to do this, CoSWID tags can be created by any party and t
 collected from an endpoint could contain a mixture of vendor and non-vendor created tags. For this
 reason, a CoSWID tag might contain potentially malicious content. Input sanitization, loop detection, and signature verification are ways that implementations can address this concern.
 
+# Privacy Consideration
+
+As noted in {{sec-sec}}, collected information about an endpoint's software load, such as might be represented by an endpoints CoSWID tag collection, could be used to identify vulnerable software for attack. Collections of endpoint software information also can have privacy implications for users. The set of application a user installs can give clues to personal matters such as political affiliation, banking and investments, gender, sexual orientation, medical concerns, etc. While the collection of CoSWID tags on an endpoint wouldn't increase the privacy risk (since a party able to view those tags could also view the applications themselves), if those CoSWID tags are gathered and stored in a repository somewhere, visibility into the repository now also gives visibility into a user's application collection. For this reason, repositories of collected CoSWID tags not only need to be protected against collection by malicious parties, but even authorized parties will need to be vetted and made aware of privacy responsibilities associated with having access to this information. Likewise, users should be made aware that their software inventories are being collected from endpoints.

```suggestion
As noted in {{sec-sec}}, collected information about an endpoint's software load, such as what might be represented by an endpoint's CoSWID tag collection, could be used to identify vulnerable software for attack. Collections of endpoint software information also can have privacy implications for users. The set of application a user installs can give clues to personal matters such as political affiliation, banking and investments, gender, sexual orientation, medical concerns, etc. While the collection of CoSWID tags on an endpoint wouldn't increase the privacy risk (since a party able to view those tags could also view the applications themselves), if those CoSWID tags are gathered and stored in a repository somewhere, visibility into the repository now also gives visibility into a user's application collection. For this reason, repositories of collected CoSWID tags not only need to be protected against collection by malicious parties, but even authorized parties will need to be vetted and made aware of privacy responsibilities associated with having access to this information. Likewise, users should be made aware that their software inventories are being collected from endpoints. Furthermore, when collected and stored by authorized parties or systems, the inventory data needs to be protected as both security and privacy sensitive information.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45#pullrequestreview-782088231

---

From: Henk Birkholz <[email-masked]>
Date: Mon, 18 Oct 2021 07:12:46 -0700

@henkbirkholz commented on this pull request.

 

ack

+# Privacy Consideration
+

ack

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45#discussion_r730964575

---

From: Henk Birkholz <[email-masked]>
Date: Mon, 18 Oct 2021 07:13:08 -0700

58c42eabc57423ed5aa0162ffb55793a7c5ff43a  Update draft-ietf-sacm-coswid.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45/files/179e2c18887f955b82cf5ef420943edf7997bccc..58c42eabc57423ed5aa0162ffb55793a7c5ff43a

---

From: Henk Birkholz <[email-masked]>
Date: Mon, 18 Oct 2021 07:13:20 -0700

819952ba3041d3ec56c4102be065c0406f0e63ce  Update draft-ietf-sacm-coswid.md

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/45/files/58c42eabc57423ed5aa0162ffb55793a7c5ff43a..819952ba3041d3ec56c4102be065c0406f0e63ce