Re: [EAT] EAT slides posted in git hub

[Laurence Lundblade <[e-mail]>]

Don’t want to have too large a discussion across these three mailing lists, but will make a few comments here.

There was some consensus in yesterday’s meetings that EAT should focus on standardizing just claims in the token — the "EAT Token" gray box between Entity and Relying Party in diagram below. The end-end flow should be described for context, but not standardized. The EAT draft would mention assumptions it makes, such as the existence of key material to perform the signing and verification.  This makes good sense to me and is more or less what is in the current draft. 

I am of the opinion that it is not practical to try for any general standard for the establishment of key material to sign tokens and services to verify tokens them at this time. There are too many manufacturing, deployment and use case specific issues. Even BRSKI and FIDO don’t standardize the primordial steps. Also, some of what needs to be done is going to happen over serial ports to devices or through chip test equipment on manufacturing lines which is not really where IETF works.

I agree that the solution is incomplete without establishment of this key material, but what I think is needed now is motivation for the chip and device vendors to invest.  A big reason for creating and standardizing EAT is to create momentum and interest with relying parties that will eventually turn into incentive for device vendors to invest. Unlike SW, device key establishment can add a per-chip cost for manufacturing time, for new assembly line equipment like HSMs and new operational security procedures, so incentive is needed. 

LL








> On Jul 17, 2018, at 11:57 AM, Suresh Marisetty <[e-mail]> wrote:
> 
> Hi Laurence,
>  
> One question I have is regarding the overall flow, which includes:
> Zero Touch Onboarding
> Attestation (EAT as you described)
>  
> Is the current thinking that onboarding can be any methods adopted from: IETF-BRSKI, FIDO, IETF-SZTP, SDO, etc. and EAT will piggyback on it?
>  
> In my view, the EAT solution will be complete when it is combined with a proposed/recommended onboarding method, which is the critical piece of the overall solution.
>  
> Thanks
> Suresh Marisetty
>  
>  
> From: EAT <[e-mail] <mailto:[e-mail]>> On Behalf Of Laurence Lundblade
> Sent: Tuesday, July 17, 2018 8:29 AM
> To: [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>
> Subject: [EAT] EAT slides posted in git hub
>  
> The EAT slides presented at secdispatch, plus a longer set of slides are here <https://github.com/eat-ietf-wg/eat-slides> on GitHub.
>  
> LL
>  
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. _______________________________________________
> EAT mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/eat <https://www.ietf.org/mailman/listinfo/eat>