Code change:
sense for their operational use cases. At least one identifier for an identity document MUST be included in <del> the protected header of the COSE envelope, either "x5t" or "kid". </del> <ins> the protected header of the COSE envelope, as one of "x5t", "x5chain" or "kid". </ins> Support for "x5t" is mandatory to implement. <del> Support for "kid" is optional. </del> <ins> Support for "kid" and "x5chain" is optional. </ins> <del> When "x5t" is present, "iss" MUST be a string with a value between 1 and 8192 characters in length that fits the regular expression of a distinguished name. </del> <ins> When "x5t" or "x5chain" is present, "iss" MUST be a string with a value between 1 and 8192 characters in length that fits the regular expression of a distinguished name. </ins> The mechanisms for how Transparency Services obtain identity documents is out-of-scope of this document. <del> The "kid" header parameter MUST be present when the "x5t" header parameter is not present.  Key discovery protocols are out-of-scope of this document. </del> <ins> The "kid" header parameter MUST be present when neither "x5t" nor "x5chain" are present.  Key discovery protocols are out-of-scope of this document. </ins> The protected header of a Signed Statement and a Receipt MUST include the "CWT Claims" header parameter as specified in CWT_CLAIMS_COSE.

Related discussion:
text: My take on trying to make registration auditable. This is still very open-ended in terms of implementation choice
I have made optional, but still supported
Steve, Is it too late to add another service API to SCRAPI: Retrieve Registration Policy Thanks, Dick Brooks Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council – A Public-Private Partnership Never trust software, always verify and report! URL Email: NAME NAME Tel: +1 978-696-1788
Hi, NAME Once the Architecture is settled, we plan to put more focus on SCRAPI, and yes, we can certainly add/edit/remove.
NAME this PR contains guidance for SCRAPI enabling registration policies to be retrieved: URL It also adds optional endpoints for retrieving signature and payloads, not just receipts.
Thanks NAME NAME I'm still not sure how the architecture handles a revoked certificate used to sign the registry log. Would a new log be started with a different signing key and the old log would remain available for reference - with a warning that the signing key has been revoked or is expired? Still trying to figure out implementation details so that REA can support the initiative. I assume the results of a SCRAPI query would contain a warning that the returned results are from a log that has a revoked signing key.
SCITT does not have any messages currently related to revoked certificates. What messages do you propose?
It can be as simple as a warning in response to a query i.e. “Warning: The signing certificate has been revoked or has expired” Thanks, Dick Brooks Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council – A Public-Private Partnership Never trust software, always verify and report! URL Email: NAME NAME Tel: +1 978-696-1788
Dealing with expired or revoked TS certificates should be straightforward, as you can always obtain a fresh receipt for a previously registered transparent statement. For issuer certificate this is a non-issue as SCITT only guarantees the issuer certificate was valid at registration.
Thanks, Antoine. Is this also the case when the certificate used to maintain log integrity has been revoked or has expired. I’m presuming the registry log integrity is also maintained using a digital certificate – correct?