Re: [EAT] Attestation BoF charter updates?

[Laurence Lundblade <[e-mail]>]

I’d like to propose this for the Introduction in the charter. I tried pretty hard to write what I wanted through edits to the existing intro, but really couldn’t make it work, so this is mostly new text. Some phrases are re used. Apologies for not finding a better way to do this. I have tried to put all the ideas and concepts in Henk’s original charter intro in here, though I have gone for a more abstract conceptual level. A few more notes below.

RATS enables remote parties communicating with a device to evaluate the trustworthiness, device identity, origin of manufacture, system integrity, configuration, operational state and other characteristics of that device. Conceptually, the remote party ends up knowing a set of claims about the device and using them to make the evaluation. The claims may explicitly be transmitted or implicitly derived from other things known about the device. Various means are used to secure, or prove the security of, claims for the remote party. Signing of the claims is the most important but may not be the only means of securing the claims. These claims can provide evidence that a device supports a certain set of operations and functions and/or that it is actually the exact device it is supposed to be.

RATS includes the measurement of SW running on the device and securely conveying those measurements to the remote party.  These measurements enable tje remote party to evaluate device trustworthiness, that it operates as expected, does what is required and does not do other things.

RATS may include definition of procedures by which a remote party evaluates certain claims. For example, how some measurement or other claims are compared to expected values to evaluate trustworthiness of the device.

RATS may include the definition new protocols and/or definition of secured data structures (e.g., signed) that are carried in existing protocols.

RATS is general purpose and aims to address a broad range of uses cases including on-line banking, payment transactions, critical infrastructure, network security functions, constrained devices, business and government enterprises and management of end-user devices.

Notes:

I have avoided the use of the formally defined terms in the introduction so it can stand more on its own, is easier to understand and is less presumption about architectures and designs. Seems like it is work for the WG to define the terms and create the designs.
My use of the lower case “device”, “claim” and “remote party” are just as broad concepts to be able to get the general idea across. The WG documents should use the more formal and specific definitions.
Hope I’ve covered both EAT and RATS concepts here. It was my goal. 
While I used the term RATS, I still want the WG name change to CREATE.

LL


> On Oct 11, 2018, at 10:19 PM, Henk Birkholz <[e-mail]> wrote:
> 
> Hi all,
> 
> sorry for the delay. Please find an updated charter proposal here:
> 
>> https://github.com/ietf-rats/charter/blob/RC2/ietf-rats-charter.md
> 
> The BoF proponents tried to merge all comments and proposals on keystores, existing solutions, provenance & device characteristics, etc that were raised on the list - and align them in homogeneous fashion.
> 
> This draft is intended to focus the discussion and improve the wording.
> 
> Viele Grüße,
> 
> Henk
> 
> On 10/06/2018 08:23 AM, Laurence Lundblade wrote:
>> Hi Henk,
>> Bangkok IETF is getting close, will you be able to update the charter for the attestation BoF to properly include EAT?  I sent you some text that just needs to be pasted along with some comments. It doesn’t look like there’s been any updates.
>> LL
> 
> _______________________________________________
> EAT mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/eat