Re: [Rats] Call for adoption (after draft rename) for Yang module draft

["Smith, Ned" <[e-mail]>]

The log is merely a way to defer actions taken by a Relying Party. Presumably, there is not reason to log something if the log is never processed.

The Roles workflow isn’t necessarily time dependent while possibly the arch models (passport, BGC) are?

From: Laurence Lundblade <[e-mail]>
Date: Monday, November 18, 2019 at 1:17 AM
To: Dave Thaler <dthaler=[e-mail]>
Cc: "Smith, Ned" <[e-mail]>, Henk Berkholz <[e-mail]>, Nancy Cam-Winget <[e-mail]>, "[e-mail]" <[e-mail]>, ""Schönwälder, Jürgen"" <[e-mail]>, "Oliver, Ian (Nokia - FI/Espoo)" <[e-mail]>
Subject: Re: [Rats] Call for adoption (after draft rename) for Yang module draft

If a tree falls in a forest, even if no one hears it, there is a log.

LL





On Nov 18, 2019, at 5:09 PM, Dave Thaler <dthaler=[e-mail]<mailto:dthaler=[e-mail]>> wrote:

I do think it would be useful to keep your statement true, so I will think about how to define Relying Party since I suspect there’s a way around it that we would both like.

From: RATS <[e-mail]<mailto:[e-mail]>> On Behalf Of Dave Thaler
Sent: Monday, November 18, 2019 5:04 PM
To: Laurence Lundblade <[e-mail]<mailto:[e-mail]>>
Cc: Smith, Ned <[e-mail]<mailto:[e-mail]>>; Henk Birkholz <[e-mail]<mailto:[e-mail]>>; Nancy Cam-Winget (ncamwing) <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; "Schönwälder, Jürgen" <[e-mail]<mailto:[e-mail]>>; Oliver, Ian (Nokia - FI/Espoo) <[e-mail]<mailto:[e-mail]>>
Subject: Re: [Rats] Call for adoption (after draft rename) for Yang module draft

If all you do is log, then there is no enforcement, and since the device doesn’t talk to the log, you can’t call the log a “Relying Party”.
I didn’t say there was never a Relying Party (if you do enforcement and kick the device off the network or something then yes there’s a Relying Party), I said “might be no”.
So I disagree with “Attestation always has a relying party” based on my discussion with Nancy.
Before the hackathon I would have agreed with that statement ☺

From: Laurence Lundblade <[e-mail]<mailto:[e-mail]>>
Sent: Monday, November 18, 2019 4:59 PM
To: Dave Thaler <[e-mail]<mailto:[e-mail]>>
Cc: "Schönwälder, Jürgen" <[e-mail]<mailto:[e-mail]>>; Smith, Ned <[e-mail]<mailto:[e-mail]>>; Henk Birkholz <[e-mail]<mailto:[e-mail]>>; Nancy Cam-Winget (ncamwing) <[e-mail]<mailto:[e-mail]>>; Oliver, Ian (Nokia - FI/Espoo) <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Subject: Re: [Rats] Call for adoption (after draft rename) for Yang module draft


On Nov 18, 2019, at 4:52 PM, Dave Thaler <dthaler=[e-mail]<mailto:dthaler=[e-mail]>> wrote:

Case 1) The network notices anomalous traffic coming from a device already on the network, which triggers a verifier to ask the device to attest to its health (which may have changed since it was last attested).  Here there might even be no Relying Party involved per se.
Case 2) The network has not noticed anything odd, but wants to proactively query a device anyway, e.g., because the network's appraisal policy of what is considered trustworthy has just changed.  Again there might even be no Relying Party involved.

I would call the network the relying party. Attestation always has a relying party because there would be no point if no one cared (if a tree falls in a forest…)

LL


_______________________________________________
RATS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/rats