Security goals, implementations and symbols

[muhammad-usama-sardar]

As explained on list

[yogeshbdeshpande]

Usama's comment on the RATS Mailing list have been addressed as below, pasting a reply from RATS Mailing list:

========================================================
From: Yogesh Deshpande
Sent: Thursday, July 24, 2025 10:21 AM
To: Muhammad Usama Sardar muhammad_usama.sardar@tu-dresden.de; rats@ietf.org
Subject: RE: [Rats] Questions about corim

Hello Usama,

Thank you for reviewing the draft and providing valuable comments.

I have added few clarifications below:

1. Regarding Security Properties point raised:
   The purpose of CoRIM is to provide Data Format for conveying Endorsement & Reference Values.
   Security is provided when conveying these messages. In the CoRIM 08 revision:
   Please refer to Section 4 for Security provided to CoRIM Messages and
   Section 11: Security and Privacy Considerations

2. Early Adopters versus Implementation Discussion
   The Slide 2 as its title says, “Early Adopters”, meaning Organizations which are committed to using CoRIM and have some Public Reference that we can site to interpret the adoption.
   This does not necessarily imply that every one of these have OPEN SOURCED their implementation.

Section 10 in Draft: The scope of this section is about current open source implementation status:
As of now, it only points to Veraison. Perhaps if there are other open-source implementations, we can certainly add.

3. Do symbols used in slide 10 in [1] have a 1-1 match with the symbols in the draft?
   No, the Algorithm terminology was simplified for presentation, but draft has more precise semantics

Hope this clarification is helpful!

Regards,
Yogesh Deshpande

[muhammad-usama-sardar]

The responses are unsatisfactory. See on list.