Update ietf-scitt-charter.md #20

mwiseman-byid · 2022-08-28T22:30:36Z

Should we use the term "Compliance" or "Trustworthiness"
I used Markdown comment syntax to make comments and put questions where I wanted to explain rationale or wasn't sure enough to provide edits.

Should we use the term "Compliance" or "Trustworthiness"

OR13 · 2022-08-29T13:31:29Z

ietf-scitt-charter.md


 The output of the SCITT WG is a set of standards that define the essential building blocks enabling the security of supply chain systems and assisting implementers in securing deployments.
 For example, a public computer interface system could report its software composition, which can be compared against known software compositions for such a device, as recorded in a public append-only transparent registry.
 Therefore, providing an individual using the system with confidence that it will behave as and when expected, consistently and without deviation.

+[//]: # (MW: "recorded in a public ledger, " I thought that is too implementation specific for an introduction)


Also agree. Additionally, I suggest a few capitalization and grammatical edits.

SCITT forms a set of building blocks that will allow implemeters to build interoperable supply chain integrity systems. For example, a public computer interface system could report its software composition that can be compared against known software compositions for such a device providing an individual using the system confidence that it will behave as expected, when expected, and nothing/nowhen else.

resolved in previous commits and reflected in current branch. also removed "public" as that can be misunderstood easily

@kaywilliams I like where that is going. May I offer this slight mod. I'm concerned that we're swerving a little into the 'preventative security' world where actually the work here is transparency and accountability. In the example given we don't have total confidence that the computer will always behave perfectly: there may be bugs or operator-borne attacks, for example. But what we do have is confidence that you're dealing with the computer system you thought you would be, and that nothing has been injected or modified on its way to you.

I also removed "an individual" because humans aren't realistically going to be doing much of this transactional verification: we want all of this stuff to be strong enough that we can automate all the mundane validation work away.

"SCITT forms a set of interoperable building blocks that will allow implementers to build integrity and accountability into supply chain systems to help assure trustworthy operation. For example, a public computer interface system could report its software composition that can then be compared against known software compositions (and certifications?) for such a device thereby giving confidence that the system is running the software expected and has not been modified, either by attack or accident, in the supply chain".

OR13 · 2022-08-29T13:33:12Z

ietf-scitt-charter.md


-A minimal, simple, and concise set of building blocks that interact in a standardized way will assure long-term accountability and interoperability for supply chain components throughout their lifecycles across architecturally diverse systems.
+[//]: # (MW: #6 is not true, SWID tags can be signed today.)


I interpret this as know standard way to discover if they key used to sign the tag is authoritative for the entity in question. SPDX and Cyclone also support signing.

henkbirkholz

pending moving md comments to issues, of course

rjb4standards · 2022-08-30T14:55:15Z

ietf-scitt-charter.md

-Over the years, rapid technological advancements have motivated organizations to implement efficient processes for supply chains (i.e., from design to manufacturing, logistics, and just-in-time delivery).
-While these improvements help organizations increase efficiency and swiftly bring innovations to market, the rapid increase in scale, size, and complexity of supply chains has led to more frequent and sophisticated supply chain attacks.
-The traditional methods of safeguarding supply chains (e.g., pre- and post-audit methodologies) are no longer adequate.
+A Device's supply chain, including its components, is complex often being comprised of both common libraries and custom components. Knowing the identity of a Device or its component is critical to determining its compliance. However, the scale, size, and complexity of supply chains, from design, manufacturing, logistics, and just-in-time delivery has led to more frequent and sophisticated supply chain attacks. The traditional methods of safeguarding supply chains (e.g., pre- and post-audit methodologies) are no longer adequate, therefore, with the increase in suppliers and increase in the complexity of the various supply chains the means to determine a Device or component's identity requires standardization.


Suggest inserting "digital" in front of device.

mprorock · 2022-08-30T15:07:15Z

ietf-scitt-charter.md

 ## Generic Protocol Bindings for Information Model and Interaction Models

-The WG shall standardize request-response interactions ("external API") and potentially other generic interaction schemes provided to various actors to interact with the supply chain ecosystem. This includes standardizing inter-component messages (based on the interaction models) and payload serialization between supply chain actors to support easy reference implementations of SCITT building blocks by various organizations and easy industry-wide adaptation.
+The WG shall standardize request-response interactions ("external API") and potentially other generic interaction schemes provided to various actors to interact with the supply chain ecosystem. This includes standardizing inter-component messages (based on the interaction models) and payload serialization between supply chain actors to support common reference implementations of SCITT building blocks by various organizations to expedite industry-wide adaptation.


this is excellent

ietf-scitt-charter.md

kaywilliams · 2022-08-31T22:48:26Z

ietf-scitt-charter.md


 Goals
 =====
 Based on an input document on the architecture (draft-birkholz-scitt-architecture-00), the WG will:

-1. Standardize the overall technical security flows for securing a software supply chain, which also includes firmware, and covering the essential building blocks that make up the architecture.
+[//]: # (MW: Seems circular to have within the charter a reference to one of the documents to be produced by the WG)


kaywilliams · 2022-08-31T22:49:31Z

ietf-scitt-charter.md

-    - other IETF WGs such as COSE WG, and IETF RATS WG, as appropriate, as well as
-    - in coordination with other bodies, such as the, OpenSSF, W3C, or the Trusted Computing Group.
+    - other IETF WGs such as COSE WG, and IETF RATS WG, as appropriate,
+    - coordination with other bodies, such as the, OpenSSF, W3C, ISO, and the Trusted Computing Group.


kaywilliams · 2022-08-31T22:49:50Z

ietf-scitt-charter.md

@@ -37,23 +44,27 @@ The WG does not:

 1. make recommendations or suggestions on best practices on how to design the supply chain,
 2. establish a universal/centralized registry for supply chain data,
-3. try to prevent supply chain issuers from making false claims,
+3. define methods to prevent supply chain issuers from making false claims,


kaywilliams · 2022-08-31T22:50:46Z

ietf-scitt-charter.md

 Program of Work
 ===============

 The main deliverables defined by this program of work provide a guideline for milestones that are in scope of the WG charter. Documents produced by the working group will address one or more of the following main deliverables:

 ## Architectural Model: Actors, Interactions, Terminology

-The WG shall start out by documenting and defining terms in an architectural model for:
+The WG shall start by documenting and defining terms in an architectural model for:


Agree with this change

kaywilliams · 2022-08-31T22:52:19Z

ietf-scitt-charter.md

 ## Generic Protocol Bindings for Information Model and Interaction Models

-The WG shall standardize request-response interactions ("external API") and potentially other generic interaction schemes provided to various actors to interact with the supply chain ecosystem. This includes standardizing inter-component messages (based on the interaction models) between supply chain actors to support easy reference implementations of SCITT building blocks by various organizations and easy industry-wide adaptation.
+The WG shall standardize request-response interactions ("external API") and potentially other generic interaction schemes provided to various actors to interact with the supply chain ecosystem. This includes standardizing inter-component messages (based on the interaction models) between supply chain actors to support common reference implementations of SCITT building blocks by various organizations to expedite industry-wide adaptation.


Agree with these changes.

ietf-scitt-charter.md

OR13 · 2022-09-01T15:36:10Z

ietf-scitt-charter.md


 ## Versatile Countersigning Format in Support of Transparency Services

 The WG shall specify a standard format for authenticity data returned from the transparent registry such as proofs, etc. The standard shall enable independent verification of supply chain claims at a (much) later point on multiple platforms across multiple geographical locations.

+[//]: # (MW: authenticity data is not defined above. What is it?)


Suggested change

[//]: # (MW: authenticity data is not defined above. What is it?)

yogeshbdeshpande · 2022-09-01T15:36:57Z

ietf-scitt-charter.md


 The output of the SCITT WG is a set of standards that define the essential building blocks enabling the security of supply chain systems and assisting implementers in securing deployments.
 For example, a public computer interface system could report its software composition, which can be compared against known software compositions for such a device, as recorded in a public append-only transparent registry.
 Therefore, providing an individual using the system with confidence that it will behave as and when expected, consistently and without deviation.

+[//]: # (MW: "recorded in a public ledger, " I thought that is too implementation specific for an introduction)


Remove public from Line 8

ietf-scitt-charter.md

Co-authored-by: Orie Steele <[email protected]>

yogeshbdeshpande · 2022-09-01T15:45:23Z

ietf-scitt-charter.md

-5. Software consumers have no trustworthy way to verify that a software signature on a software package is legitimate.
+4. The absence of decentralized, globally interoperable, transparent services to publish the supply chain data.
+5. The lack of sufficient standards for independently verifying the presence of supply chain data in tamper-proof data stores.
+6. Software consumers have no trustworthy way to verify that a software signature on a software package is legitimate.


Suggested change

6. Software consumers have no trustworthy way to verify that a software signature on a software package is legitimate.

6. Some software consumers have no trustworthy way to verify that a software signature on a software package is legitimate.

ietf-scitt-charter.md

removing emptyline

ietf-scitt-charter.md

henkbirkholz · 2022-09-01T15:57:24Z

ietf-scitt-charter.md


 Goals
 =====
 Based on an input document on the architecture (draft-birkholz-scitt-architecture-00), the WG will:

-1. Standardize the overall technical security flows for securing a software supply chain, which also includes firmware, and covering the essential building blocks that make up the architecture.
+


removing empty line

ietf-scitt-charter.md

Co-authored-by: Orie Steele <[email protected]>

ietf-scitt-charter.md

OR13 · 2022-09-01T16:08:20Z

@henkbirkholz let me know if there is anything else I can help with on this.

henkbirkholz · 2022-09-01T18:34:50Z

@OR13, we transplanted Monty's fine tuning to a local branch (to avoid rebasing the fork). I think we are good.

henkbirkholz · 2022-09-01T18:35:37Z

This PR can be abandoned due to #22

OR13 · 2022-09-02T13:25:34Z

I can't close the PR, but it should be closed

henkbirkholz · 2022-09-02T13:26:22Z

Agreed

Boogie55

Illegal vulnerability software please take me out.

mwiseman-byid and others added 2 commits August 28, 2022 17:27

Update ietf-scitt-charter.md

c4a895f

Should we use the term "Compliance" or "Trustworthiness"

Merge branch 'post-BoF-1st-pass' into patch-1

ae993f3

OR13 approved these changes Aug 29, 2022

View reviewed changes

OR13 reviewed Aug 29, 2022

View reviewed changes

henkbirkholz approved these changes Aug 29, 2022

View reviewed changes

rjb4standards reviewed Aug 30, 2022

View reviewed changes

mprorock approved these changes Aug 30, 2022

View reviewed changes

kaywilliams reviewed Aug 31, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

kaywilliams reviewed Aug 31, 2022

View reviewed changes

OR13 reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

OR13 reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

OR13 reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

OR13 reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

OR13 reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

OR13 reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

OR13 reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

OR13 reviewed Sep 1, 2022

View reviewed changes

yogeshbdeshpande reviewed Sep 1, 2022

View reviewed changes

henkbirkholz reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

henkbirkholz and others added 5 commits September 1, 2022 17:39

Update ietf-scitt-charter.md

4baf24b

Update ietf-scitt-charter.md

2be7ab9

Co-authored-by: Orie Steele <[email protected]>

Update ietf-scitt-charter.md

6f597a3

Co-authored-by: Orie Steele <[email protected]>

Update ietf-scitt-charter.md

d387664

Co-authored-by: Orie Steele <[email protected]>

Update ietf-scitt-charter.md

21297ca

Co-authored-by: Orie Steele <[email protected]>

yogeshbdeshpande reviewed Sep 1, 2022

View reviewed changes

henkbirkholz reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

Update ietf-scitt-charter.md

2d74c62

henkbirkholz reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

Update ietf-scitt-charter.md

7b5685d

henkbirkholz reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

Update ietf-scitt-charter.md

c97545b

removing emptyline

henkbirkholz reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

Update ietf-scitt-charter.md

32dee48

henkbirkholz reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

henkbirkholz and others added 4 commits September 1, 2022 17:58

Update ietf-scitt-charter.md

39de677

Update ietf-scitt-charter.md

76caa0c

Co-authored-by: Orie Steele <[email protected]>

Update ietf-scitt-charter.md

52958fb

Co-authored-by: Orie Steele <[email protected]>

Update ietf-scitt-charter.md

d865cf9

Co-authored-by: Orie Steele <[email protected]>

henkbirkholz reviewed Sep 1, 2022

View reviewed changes

ietf-scitt-charter.md Outdated Show resolved Hide resolved

Update ietf-scitt-charter.md

7439419

yogeshbdeshpande mentioned this pull request Sep 1, 2022

Take changes from Monty PR #22

Merged

henkbirkholz closed this Sep 2, 2022

OR13 mentioned this pull request Sep 2, 2022

Back to "transparency and trust" from "security" #23

Merged

Boogie55 reviewed Sep 7, 2022

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update ietf-scitt-charter.md #20

Update ietf-scitt-charter.md #20

mwiseman-byid commented Aug 28, 2022

OR13 Aug 29, 2022

kaywilliams Aug 31, 2022 •

edited

Loading

henkbirkholz Sep 1, 2022

JAG-UK Sep 2, 2022 •

edited

Loading

OR13 Aug 29, 2022

henkbirkholz left a comment

rjb4standards Aug 30, 2022

mprorock Aug 30, 2022

kaywilliams Aug 31, 2022

kaywilliams Aug 31, 2022

kaywilliams Aug 31, 2022

kaywilliams Aug 31, 2022

kaywilliams Aug 31, 2022

OR13 Sep 1, 2022

yogeshbdeshpande Sep 1, 2022

yogeshbdeshpande Sep 1, 2022

henkbirkholz Sep 1, 2022

henkbirkholz Sep 1, 2022 •

edited

Loading

OR13 commented Sep 1, 2022

henkbirkholz commented Sep 1, 2022

henkbirkholz commented Sep 1, 2022

OR13 commented Sep 2, 2022

henkbirkholz commented Sep 2, 2022

Boogie55 left a comment


		A minimal, simple, and concise set of building blocks that interact in a standardized way will assure long-term accountability and interoperability for supply chain components throughout their lifecycles across architecturally diverse systems.
		[//]: # (MW: #6 is not true, SWID tags can be signed today.)

	6. Software consumers have no trustworthy way to verify that a software signature on a software package is legitimate.
	6. Some software consumers have no trustworthy way to verify that a software signature on a software package is legitimate.

Update ietf-scitt-charter.md #20

Update ietf-scitt-charter.md #20

Conversation

mwiseman-byid commented Aug 28, 2022

Choose a reason for hiding this comment

kaywilliams Aug 31, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JAG-UK Sep 2, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

henkbirkholz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

henkbirkholz Sep 1, 2022 • edited Loading

Choose a reason for hiding this comment

OR13 commented Sep 1, 2022

henkbirkholz commented Sep 1, 2022

henkbirkholz commented Sep 1, 2022

OR13 commented Sep 2, 2022

henkbirkholz commented Sep 2, 2022

Boogie55 left a comment

Choose a reason for hiding this comment

kaywilliams Aug 31, 2022 •

edited

Loading

JAG-UK Sep 2, 2022 •

edited

Loading

henkbirkholz Sep 1, 2022 •

edited

Loading