search

veraison / corim

CoRIM and CoMID manipulation library and CLI
Apache License 2.0
9 stars 7 forks source link

ValueTriple has "measurements" should be "measurement" to match corim draft #123

Closed deeglaze closed 4 weeks ago

deeglaze commented 2 months ago

The reference-triple-record has 1 environment-map and 1 measurement-map. The ValueTriple's "measurements" collection does not follow that document structure, so I don't know how this produces a valid comid.

It would certainly seem to me that 1 environment could have multiple measurements of different names and value kinds the way this code allows for, but the draft doesn't allow for that. The mkey I thought was a way for multiplicity to be allowed, but also no.

setrofim commented 2 months ago

Looks like the code matches rev00 of the draft, and the triples structure was never brought into alignment with the later versions. We need to fix this.

thomas-fossati commented 2 months ago

Noting that this change would impact how PSA and CCA reference values are currently encoded.

setrofim commented 2 months ago

Noting that this change would impact how PSA and CCA reference values are currently encoded.

Yup, this will have ripple effect on a lot of existing code. Fixing this is not going to be trivial...

yogeshbdeshpande commented 2 months ago

Yes, this was a known issue however, we had not scoped it fully so had put on hold for a while.

Has impact on PSA, CCA and also Parsec-CCA Scheme under Veraison

setrofim commented 2 months ago

@deeglaze this should be resolved by https://github.com/veraison/corim/pull/124