Registry for OID/Evidence Mappings

[hannestschofenig]

No description provided.

[thomas-fossati]

This seems like a very useful addition.

I am wondering whether the new registry's scope could be extended to cover all typing information related to attestation evidence, including OID, media types, CoAP C-F, CBOR tags, etc., to make this a one-stop shop "meta registry" for everything attestation.
Not sure if there is a precedence for this in IANA.

PS: I have left a couple of markdown-related fixes in-line.

[ounsworth]

Meeting 2024-01-29
This PR is mergeable, pending sorting out the [[TBD]] mail list reference.

[ounsworth]

As per discussion on the RATS mailing list, this is considered a very good idea, and is slipping into scope creep.

At this point, I suggest removing this from the CSR Attestation draft so that the CSR draft is not delayed due to this much larger initiative.

(aka, the CA industry really needs this CSR draft ASAP. Can we please put a New Content Freeze on it?)

https://mailarchive.ietf.org/arch/msg/rats/h98spAElEuQtpIEWStEuaCyRQrI/

[henkbirkholz]

I am wondering whether the new registry's scope could be extended to cover all typing information related to attestation evidence, including OID, media types, CoAP C-F, CBOR tags, etc., to make this a one-stop shop "meta registry" for everything attestation.
Not sure if there is a precedence for this in IANA.

@thomas-fossati, could you imagine for this endeavor to move into a separate document?

[thomas-fossati]

Sorry, replied to Mike's email before reading this.

@thomas-fossati, could you imagine for this endeavor to move into a separate document?

Yes, absolutely.

[henkbirkholz]

then we can 🚢 this ☺️

[mcr]

As I understand it, we are not asking for a new OID arc, but rather just collecting the OIDs that are used from other arcs?

[ounsworth]

As I understand it, we are not asking for a new OID arc, but rather just collecting the OIDs that are used from other arcs?

Well, except that this draft is also asking for a new OID arc called id-ata "SMI Security for PKIX Evidence Statement Formats", which is presumably where we would put any new OIDs for things like the x509-evidence draft that we're working on in RATS.

So is that right? We want this draft to ask IANA to create two new registries: one for new Evidence OIDs created by IETF, and one for exiting Evidence OIDs created by not-IETF ?