Language around `authorized-by`

[steven-bellock]

Issues raised by @thomas-fossati.

Regarding https://ietf-rats-wg.github.io/draft-ietf-rats-corim/draft-ietf-rats-corim.html#section-5.1.4.5-9.3.1

1. §5.1.4.5: (measurements) Semantics of authorized-by are unclear therefore rather unusable: "designated authority for measurement Claims" is too generic to be useful. Is this something similar to EAT MC authority, i.e., related to software updates/installations?

2. §5.1.4.5: re: authorized-by, it says: "For example, the signer of a CoMID triple". CoMID triples aren't signed! This is the only concrete example and it doesn't compute.

3. §5.1.4.5: re: authorized-by, it says: "See Section 5.1.4.6." which defines the crypto-key-type-choice type. A bit out of the blue and withouth much context.

4. §5.1.4.5: re: authorized-by, it says: "An entity is authoritative when it makes Claims that are inside its area of competence.". What is this supposed to mean?

[steven-bellock]

In general, it is the signer of the entire CoRIM that endorses the supposed authority represented in authorized-by since, as is pointed out, within the CoRIM document CoMID triples and other structures do not contain signatures generated by the authority. As such, crypto-key-type-choice gives the illusion that the authority wields some cryptographic teeth within the CoRIM itself when, in fact, it does not.

In #20 @nedmsmith says

Given the $crypto-key-type-choice names the supply chain entity that is authorized to provide measurements. If the certificate path used to sign the RIM includes a statement that acknowledges that entity as the measurement authoring authority, then Verifiers can check for consistency.

but I don't think this check is conveyed in section 9.

Note that https://ietf-rats-wg.github.io/draft-ietf-rats-corim/draft-ietf-rats-corim.html#section-5.1.4-2 has a similar issue where it states

However, multiple authorities may be involved in signing triples.