Re: [Rats] Call for adoption draft-moriarty-attestationsets

Hi Michael,

When grouping sets of attestations, they should align to something, that's
in the sections you've listed as "nothing lost". How do you convey the set
name if it's not part of what is conveyed? To reach scalable automation,
where attestations are shared remotely, we'll indeed have some alignment to
defined sets. CIS Benchmarks, NIST standards, TCG Reference Integrity
measurements are all examples of defined sets with NIST SP 800-193 already
fully attested in local hardware for traditional and hyperscaler vendors.

What needs to be registered will become more clear as implementations flush
out the details and there are a few vendors looking at this model to help
with this problem set - making security simpler to manage.

I hope that helps.

Thanks,
Kathleen

On Thu, Nov 18, 2021 at 1:56 PM Michael Richardson <mcr+ietf@sandelman.ca>
wrote:

>
> I think that the point of this document is to register five claims:
>    MPS, LEM, PCR,  FMA,  HSH
>
> I guess that I would expect to find a section on each claim?
>
> While the Introduction has been simplified a bit.
> There are four paragraphs in the Introduction, some points, and a closing
> paragraph:
>       -(*) posture automation
>       - CIS
>       - TPM/boot/NIST
>       -(*) PCR values + EAT
>       - some things to measure
>       - policy/conclusion
>
> I see how (*) relate to section 2's claims, but the rest I still find
> irrelevant.  If I skip those paragraphs, then I find that I've lost
> nothing.
>
> Note that I am in favour of adopting documents early: as soon as the
> problem
> statement has been clearly articulated. I would support adoption of this
> document.    {I'm not sure what criteria this WG is using}
>
> I'd also like to understand how this document interacts with the many other
> desktop TPM systems out there... the whole SACM/PA-TNC and related NEA
> works.
> It feels like a reset-to-blank, start over again.  (I'm not opposed to
> that)
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
>
>
>
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats
>

-- 

Best regards,
Kathleen