concise-mid-tag.cddl

concise-mid-tag = {
  ? comid.language => language-type
  comid.tag-identity => tag-identity-map
  ? comid.entities => [ + entity-map ]
  ? comid.linked-tags => [ + linked-tag-map ]
  comid.triples => triples-map
  * $$concise-mid-tag-extension
}

language-type = text

tag-identity-map = {
  comid.tag-id => $tag-id-type-choice
  ? comid.tag-version => tag-version-type
}

$tag-id-type-choice /= tstr
$tag-id-type-choice /= uuid-type

tag-version-type = uint .default 0

entity-map = {
  comid.entity-name => $entity-name-type-choice
  ? comid.reg-id => uri
  comid.role => [ + $comid-role-type-choice ]
  * $$entity-map-extension
}

$comid-role-type-choice /= comid.tag-creator
$comid-role-type-choice /= comid.creator
$comid-role-type-choice /= comid.maintainer

linked-tag-map = {
  comid.linked-tag-id => $tag-id-type-choice
  comid.tag-rel => $tag-rel-type-choice
}

$tag-rel-type-choice /= comid.supplements
$tag-rel-type-choice /= comid.replaces

triples-map = non-empty<{
  ? comid.reference-triples => [ + reference-triple-record ]
  ? comid.endorsed-triples => [ + endorsed-triple-record ]
  ? comid.attest-key-triples => [ + attest-key-triple-record ]
  ? comid.identity-triples => [ + identity-triple-record ]
  * $$triples-map-extension
}>

; REFERENCE-VALUE triple
; "target environment $TE" "has reference measurements" "$RV"
reference-triple-record = [
  environment-map ; target environment
  [ + measurement-map ] ; reference measurements
]

; ENDORSED-VALUE triple
; "environment $E" "has endorsed measurements" "$EV"
endorsed-triple-record = [
  environment-map ; (target or attesting) environment
  [ + measurement-map ] ; endorsed measurements
]

; ATTESTATION-VERIFICATION-KEY triple
; "attesting environment $AE" "signs Evidence that can be verified with a set of keys [$K]"
attest-key-triple-record = [
  environment-map ; attesting environment
  [ + $crypto-key-type-choice ] ; attestation verification key(s)
]

; DEVICE-IDENTITY triple
; "device $D" "is identified by a set of keys [$K]"
identity-triple-record = [
  environment-map ; device identifier (instance or class)
  [ + $crypto-key-type-choice ] ; DevID, or semantically equivalent
]

$crypto-key-type-choice /= tagged-pkix-base64-key-type
$crypto-key-type-choice /= tagged-pkix-base64-cert-type
$crypto-key-type-choice /= tagged-pkix-base64-cert-path-type

; Raw key in DER format base64-encoded.
tagged-pkix-base64-key-type = #6.554(tstr)
; X.509 certificate in DER format base64-encoded
tagged-pkix-base64-cert-type = #6.555(tstr)
; chain of X.509 certificates in DER format base64-encoded
tagged-pkix-base64-cert-path-type = #6.556(tstr)


environment-map = non-empty<{
  ? comid.class => class-map
  ? comid.instance => $instance-id-type-choice
  ? comid.group => $group-id-type-choice
}>

class-map = non-empty<{
  ? comid.class-id => $class-id-type-choice
  ? comid.vendor => tstr
  ? comid.model => tstr
  ? comid.layer => uint
  ? comid.index => uint
}>

$class-id-type-choice /= tagged-oid-type
$class-id-type-choice /= tagged-uuid-type
$class-id-type-choice /= tagged-int-type

$instance-id-type-choice /= tagged-ueid-type
$instance-id-type-choice /= tagged-uuid-type

$group-id-type-choice /= tagged-uuid-type

;
; From draft-ietf-cbor-tags-oid (TODO(tho), roid and pen)
;
oid-type = bytes
tagged-oid-type = #6.111(oid-type)

;
; github.com/lucas-clemente/cbor-specs/blob/master/uuid.md
;
tagged-uuid-type = #6.37(uuid-type)

;
; numeric class identifer.  MUST be coupled with vendor.
;
tagged-int-type = #6.551(int)

;
; From draft-ietf-rats-eat
;
ueid-type = bytes .size 33
tagged-ueid-type = #6.550(ueid-type)

;
; mkey type definitions
;
$measured-element-type-choice /= tagged-oid-type
$measured-element-type-choice /= tagged-uuid-type
; The $measured-element-type-choice uint is intended for time series mval data where lower uint
; values indicate older mval data while higher uint values indicate newer mval data; 0 is an assumed epoch.
$measured-element-type-choice /= uint
; Subsequent additions to $measured-element-type-choice should be tagged values.

measurement-map = {
  ? comid.mkey => $measured-element-type-choice
  comid.mval => measurement-values-map
  ? comid.authorized-by => [ + $crypto-key-type-choice ]
}

; see https://github.com/ietf-rats/ietf-corim-cddl/issues/72
measurement-values-map = non-empty<{
  ? comid.ver => version-map
  ? comid.svn => svn-type-choice
  ? comid.digests => digests-type
  ? comid.flags => flags-map
  ? raw-value-group
  ? comid.mac-addr => mac-addr-type-choice
  ? comid.ip-addr =>  ip-addr-type-choice
  ? comid.serial-number => serial-number-type
  ? comid.ueid => ueid-type
  ? comid.uuid => uuid-type
  ? comid.name => tstr
  * $$measurement-values-map-extension
}>

version-map = {
  comid.version => version-type
  ? comid.version-scheme => $version-scheme
}
version-type = text .default '0.0.0'
; version-scheme is defined in CoSWID

svn-type = uint
svn = svn-type
min-svn = svn-type
tagged-svn = #6.552(svn)
tagged-min-svn = #6.553(min-svn)
svn-type-choice = tagged-svn / tagged-min-svn


; flags-map maps DiceTcbInfo.flags
flags-map = {
  ? comid.operational-flag-configured => bool
  ? comid.operational-flag-secure => bool
  ? comid.operational-flag-recovery => bool
  ? comid.operational-flag-debug => bool
  ? comid.operational-flag-replay-protected => bool
  ? comid.operational-flag-integrity-protected => bool
  * $$flags-map-extension
}

raw-value-group = (
  comid.raw-value => $raw-value-type-choice
  ? comid.raw-value-mask => raw-value-mask-type
)

$raw-value-type-choice /= #6.560(bytes)

raw-value-mask-type = bytes

ip-addr-type-choice = ip4-addr-type / ip6-addr-type
ip4-addr-type = bytes .size 4
ip6-addr-type = bytes .size 16

mac-addr-type-choice = eui48-addr-type / eui64-addr-type
eui48-addr-type = bytes .size 6
eui64-addr-type = bytes .size 8

serial-number-type = text

; Notes:
; - hash-entry is defined in CoSWID schema
digests-type = [ + hash-entry ]

; vim: set tw=70 ts=2 et: