[Rats] 答复: use case document updates on Roots of Trust

Hi Carl,
The other big difference between them is the object they deal with: RoT is for integrity measurement value chain, CA is for certificate chain.

Hope it is helpful.

B.R.
Frank

-----邮件原件-----
发件人: RATS [mailto:rats-bounces@ietf.org] 代表 Carl Wallace
发送时间: 2019年9月16日 20:26
收件人: Laurence Lundblade <lgl@island-resort.com>; Salz, Rich <rsalz@akamai.com>
抄送: Michael Richardson <mcr+ietf@sandelman.ca>; rats@ietf.org
主题: Re: [Rats] use case document updates on Roots of Trust

I took Rich's statement to be more from a relying party perspective and your detail to be more what one might find in a policy describing nature of the root of trust, which is not that different from how one may describe a trust anchor/CA in a PKIX context in a policy that describes how a CA are operated, etc. Two sides of the same coin.

On 9/15/19, 4:50 PM, "RATS on behalf of Laurence Lundblade"
<rats-bounces@ietf.org on behalf of lgl@island-resort.com> wrote:

>On Sep 12, 2019, at 3:31 PM, Salz, Rich <rsalz@akamai.com> wrote:
>> 
>> I do not see a meaningful difference between "trust anchor" and 
>>"trust root" and "root(s) of trust."  All of them:
>> 	- Are pieces of data (certificate or key is not meaningful)
>> 	- Used to verify something such as a certificate or signature
>> 	- Are trusted by the application, based on actions that are "out of 
>>band" of the application itself
>
>This is not how I understand a root of trust, nor how I think it is 
>generally used in the TCG or TEE worlds. I think a root of trust 
>involves a CPU, memory and SW that actively does something like boot 
>and measure a device. There is usually a boundary around it so that 
>other software on the device, like the high-level OS, can’t corrupt it. 
>When it is doing reporting as in RATS it will have a private key that can do some signing.
>When it is doing trusted/secure boot, it will also have a public key to 
>verify the software it loads.
>
>LL
>
>
>_______________________________________________
>RATS mailing list
>RATS@ietf.org
>https://www.ietf.org/mailman/listinfo/rats

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats