@techreport{le-scitt-derived-subjects-01,
    number =    {draft-le-scitt-derived-subjects-01},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-le-scitt-derived-subjects/01/},
    author =    {Thanh Le},
    title =     {{SCITT Profile for Independently Derived Subjects}},
    pagetotal = 43,
    year =      2026,
    month =     sep,
    day =       11,
    abstract =  {The Supply Chain Integrity, Transparency, and Trust (SCITT) architecture permits distinct Issuers to agree on a common CBOR Web Token (CWT) Subject Claim (sub). This document specifies a profile for independently deriving that claim from shared application-defined Subject semantics without a shared assigning authority. An application maps its Subject description to a structured Value. This profile defines the derivation domain, deterministic binding encoding, SHA-256 construction, text syntax, and candidate-to-claim comparison requirements. Optional JSON and Concise Binary Object Representation (CBOR) codecs exchange admitted Values. Subject descriptions and Statement payloads have separate roles; the construction derives sub from the complete mapped Value, while SCITT provides the signed binding and transparency evidence.},
}