Re: [Privacy-pass] Regarding the role of attester

I agree with Chris that it’d be preferable to keep the terminology here consistent, given that Privacy Pass has been using this for a while now, and it’s been adopted outside of the IETF WG. We did discuss this as we added references to RATS, and that led to the section that Chris pointed out where we provide the translation between RATS and Privacy Pass terminology.

Within RATS, the “attester” is the client, because the entire architecture is about attestation. In Privacy Pass, the client has several roles, and providing attestation evidence is only one part — calling the privacy pass client the “attester” throughout the documents would be highly confusing.

I’d support any further updates for clarity to the document to make sure this is obvious to readers, but I don’t think we should change the terminology for Privacy Pass.

Thanks,
Tommy

> On May 15, 2023, at 11:14 AM, Christopher Wood <caw@heapingbits.net> wrote:
> 
> In Section 3.4.1., we clarify this discrepancy:
> 
>   [RFC9334] describes an architecture for attestation procedures. Using that architecture as a conceptual basis, Clients are RATS attesters that produce attestation evidence, and Attesters are RATS verifiers that appraise the validity of attestation evidence
> 
> We could update the definition in Section 2 to also make this clear, if desired. Reworking the entire architecture document and mental models of people using Privacy Pass today — especially for a document that’s through WGLC — seems like a big lift for alignment with the output of a different working group. I would be fine clarifying the existing terminology.
> 
> Best,
> Chris
> 
>> On May 15, 2023, at 3:48 AM, Wang Haiguang <wang.haiguang.shieldlab=40huawei.com@dmarc.ietf.org> wrote:
>> 
>> Hi, all
>> 
>> I am reading the draft named the privacy pass architecture. 
>> 
>> I found there is a definition for attester as follows:
>> Page 3, Attester: an entity that attests to properties of clients for the purpose of token issuance. 
>> 
>> However, in the RFC 9334, it has following statement:
>> Page 8, the Attester role is assigned to entities that create Evidence that is conveyed to a Verifier. 
>> 
>> It seems the two documents have different indication on the role of attester.
>> 
>> In RFC 9334, the attester collects the evidence and sent to verifier for attestation.  In the document for the architecture of privacy pass, the attester is more like a verifier. I am not sure my understanding if correct or not. 
>> 
>> Can we align the definition of attester of RFC 9334 and the one in the privacy pass architecture to the same meaning?
>> 
>> Best regards
>> 
>> Haiguang Wang
>> 
>> Senior Researcher
>> Huawei International Pte. Ltd 
>> 
>> 
>> 
>> -- 
>> Privacy-pass mailing list
>> Privacy-pass@ietf.org
>> https://www.ietf.org/mailman/listinfo/privacy-pass
> 
> -- 
> Privacy-pass mailing list
> Privacy-pass@ietf.org
> https://www.ietf.org/mailman/listinfo/privacy-pass