Component RIMs¶

Component Reference Integrity Manifests (RIMs) are cryptographically signed data structures that provide a secure baseline of expected firmware and software measurements for hardware components. In other words, a Component RIM is a generic term for an object that holds "golden" expected measurements for a component. During computer attestation, validation services use these trusted manufacturer assertions to verify that a device's actual boot state remains secure, unmodified, and free from compromise.

Note

Compenent RIM processing is currently in progress for HIRS attestation services, but is not fully developed yet.

Component RIMs are similar in purpose to the PC Client RIM, but specifically designed for computer components. Unlike a PC Client RIM which typically exists as a single standardized metadata format - the SWID (Software Identification) tag - Component RIMs come in many different formats and typically use Concise Binary Object Representation (CBOR) encoding and CBOR Object Signing and Encryption (COSE) signatures.

The following table shows the relationship between some of the common formats:

Encoding	Format	Description
Traditional XML Encoding (ISO / TCG)	TCG Component RIM SWID	Top-level signed XML envelope Contains software/firmware data blocks formatted as SWID tags
	IETF CoSWID	Top-level signed CBOR envelope
Modern Concise CBOR Encoding (IETF / RATS)	TCG Component RIM CoSWID	Top-level signed CBOR envelope
	IETF CoRIM	Top-level signed CBOR envelope Payload = unsigned-corim-map structure Subcomponent options inside the unsigned-corim-map IETF CoSWID TCG Component RIM CoSWID IETF CoMID

IETF CoSWID vs TCG Component RIM CoSWID¶

A TCG Component RIM CoSWID is an augmented, specialized flavor of an IETF CoSWID. The IETF CoSWID is the base blueprint: It is an industry-wide, generic CBOR structure designed to define any software or firmware footprint of a component. The TCG CoSWID is the extension: The Trusted Computing Group (TCG) took that exact IETF CoSWID map and used built-in CBOR extension points to add specialized hardware attributes (like specific SPDM platform registers or hardware vendor IDs).

IETF CoRIM Structure¶

Since the CoRIM structure is complex, below is a diagram to help visualize it:

    📦 Signed IETF CoRIM (COSE Envelope)
    └── 📑 PAYLOAD: unsigned-corim-map
         ├── 🆔 corim.id (Manifest UUID)
         └── 🗂️ corim.tags [ Array of Child Tags ]
              ├── 🧩 Tag 1: IETF CoMID (hardware and reference values)
              ├── 📜 Tag 2: IETF CoSWID (software manifests and cryptographic hashes)
              └── 🏷️ Tag 3: TCG Component RIM CoSWID (TCG-specific CBOR mapping)