search

ietf-wg-scitt / draft-ietf-scitt-architecture

An Architecture for Trustworthy Digital Supply Chain Transparency Services
Other
11 stars 12 forks source link

Do we need dedicated section on SCITT requirements for append-only log? #67

Closed henkbirkholz closed 10 months ago

henkbirkholz commented 1 year ago

Maybe the term "append-only log" is self-descriptive and technology-agnostic enough by itself or maybe a set of examples is helpful.

fournet commented 1 year ago

Examples could help, as long as we are not too demanding on implementations (notably on their need to commit & persist statements before issuing receipts, on serializability, on replication). This was controversial in several discussions so far.

raylutz commented 1 year ago

I believe there is some functionality that is required that is not encompassed by the notion of an append only log:

  1. Ability to somehow tag and group items, perhaps to simulate the ability to add to an existing set of entries. For example, incremental cryptographic data as a larger data set is being built, or another example is test data that is applied later.

  2. Ability to submit just cryptographic data to the log, while storing the data elsewhere.

That said, it may also go too far. The idea of an append-only log is perhaps only one possible implementation that can securely store the statements and provide receipts.

SteveLasker commented 10 months ago

Closing as stale, and belief we've captured this. Please open new Issues/PRs with new new specific needs