[nasr] Re: [saag] Re: NASR BOF Follow-Up

[Eric Rescorla <[e-mail]>]

On Tue, Apr 15, 2025 at 1:17 AM Henk Birkholz <[e-mail]>
wrote:

> Hi ekr,
>
> I apologize for mixing provenances... again! For me, dipping in into
> this thread occasionally, it is not easy to track data origin vs. data
> source without a napkin note.
>
> Both questions:
>
> "is it possible to determine that the configuration/policy of a device
> is acceptable in a fashion that does not expose that
> configuration/policy to a counterparty?"
>
> and
>
> "Is it practical to mechanically verify that a configuration is
> acceptable?"
>
> sound like really good questions to me. Personally, I am under the
> assumption that both of these questions are not RATS questions and maybe
> not even SEC area questions. They seem to me more like OPS area
> questions, right?.


Yes, I agree.

-Ekr




> Please chime in here on the SAAG list, if you think
> that was a weird thing to say! (Obviously, opsec is a thing, but I am
> referring the "mechanics" of the solution providing an answer to the
> questions).
>
> I also think that (from a RATS perspective) the answer to those
> questions is really interesting (as it could inform the exposure of RATS
> conceptual messages). Will these questions be worked on?
>
>
> Viele Grüße,
>
> Henk
>
>
> On 11.04.25 23:29, Eric Rescorla wrote:
> >
> >
> > On Fri, Apr 11, 2025 at 11:50 AM Henk Birkholz
> > <[e-mail]> wrote:
> >
> >     On 11.04.25 19:23, Eric Rescorla wrote:
> >
> >     Hi Ekr,
> >
> >     sorry for dragging you through this convo, but I think I now have a
> >     better understanding of your problem statement than before. Thanks!
> >
> >     As far as I am understanding it for now, the question is: "is it
> >     possible to determine that the configuration/policy of a device is
> >     acceptable in a fashion that does not expose that
> configuration/policy
> >     to a counterparty?" That question would be independent from "RATS
> >     Evidence" which was popping up in the thread before.
> >
> >
> > To be clear, that was *Richard's* question. My question was prior to
> that,
> > namely "Is it practical to mechanically verify that a configuration is
> > acceptable?"
> >
> > -Ekr
> >
>