Re: [Rats] =?UTF-8?B?562U5aSN?=: =?UTF-8?B?IOetlOWkjQ==?=: use case document updates on Roots of Trust

Or more applicable here, many current attestations. Though these are
formatted as certificates.

On 9/16/19, 10:36 PM, "Carl Wallace" <carl@redhoundsoftware.com> wrote:

>TAMP messages are an example. But any signature could apply, whether a
>public key is a trust anchor or not is not up to the verifier.
>
>On 9/16/19, 10:21 PM, "Xialiang (Frank, Network Standard & Patent Dept)"
><frank.xialiang@huawei.com> wrote:
>
>>Can you give some other examples?
>>
>>-----邮件原件-----
>>发件人: Carl Wallace [mailto:carl@redhoundsoftware.com]
>>发送时间: 2019年9月17日 10:19
>>收件人: Xialiang (Frank, Network Standard & Patent Dept)
>><frank.xialiang@huawei.com>
>>抄送: Laurence Lundblade <lgl@island-resort.com>; Salz, Rich
>><rsalz@akamai.com>; Michael Richardson <mcr+ietf@sandelman.ca>;
>>rats@ietf.org
>>主题: Re: 答复: [Rats] use case document updates on Roots of Trust
>>
>>The definition of a trust anchor does not limit the scope to certificate
>>chains. 
>>
>>> On Sep 16, 2019, at 8:51 PM, Xialiang (Frank, Network Standard &
>>>Patent 
>>>Dept) <frank.xialiang@huawei.com> wrote:
>>> 
>>> Hi Carl,
>>> The other big difference between them is the object they deal with:
>>>RoT 
>>>is for integrity measurement value chain, CA is for certificate chain.
>>> 
>>> Hope it is helpful.
>>> 
>>> B.R.
>>> Frank
>>> 
>>> -----邮件原件-----
>>> 发件人: RATS [mailto:rats-bounces@ietf.org] 代表 Carl Wallace
>>> 发送时间: 2019年9月16日 20:26
>>> 收件人: Laurence Lundblade <lgl@island-resort.com>; Salz, Rich
>>> <rsalz@akamai.com>
>>> 抄送: Michael Richardson <mcr+ietf@sandelman.ca>; rats@ietf.org
>>> 主题: Re: [Rats] use case document updates on Roots of Trust
>>> 
>>> I took Rich's statement to be more from a relying party perspective
>>>and 
>>>your detail to be more what one might find in a policy describing
>>>nature 
>>>of the root of trust, which is not that different from how one may
>>>describe a trust anchor/CA in a PKIX context in a policy that describes
>>>how a CA are operated, etc. Two sides of the same coin.
>>> 
>>> On 9/15/19, 4:50 PM, "RATS on behalf of Laurence Lundblade"
>>> <rats-bounces@ietf.org on behalf of lgl@island-resort.com> wrote:
>>> 
>>>>> On Sep 12, 2019, at 3:31 PM, Salz, Rich <rsalz@akamai.com> wrote:
>>>>> 
>>>>> I do not see a meaningful difference between "trust anchor" and
>>>>> "trust root" and "root(s) of trust."  All of them:
>>>>>    - Are pieces of data (certificate or key is not meaningful)
>>>>>    - Used to verify something such as a certificate or signature
>>>>>    - Are trusted by the application, based on actions that are "out
>>>>> of band" of the application itself
>>>> 
>>>> This is not how I understand a root of trust, nor how I think it is
>>>> generally used in the TCG or TEE worlds. I think a root of trust
>>>> involves a CPU, memory and SW that actively does something like boot
>>>> and measure a device. There is usually a boundary around it so that
>>>> other software on the device, like the high-level OS, can’t corrupt
>>>>it.
>>>> When it is doing reporting as in RATS it will have a private key that
>>>>can do some signing.
>>>> When it is doing trusted/secure boot, it will also have a public key
>>>> to verify the software it loads.
>>>> 
>>>> LL
>>>> 
>>>> 
>>>> _______________________________________________
>>>> RATS mailing list
>>>> RATS@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/rats
>>> 
>>> 
>>> _______________________________________________
>>> RATS mailing list
>>> RATS@ietf.org
>>> https://www.ietf.org/mailman/listinfo/rats