Re: [Rats] Attestation of implementation vs authenticity of service

Yes, the RATS architecture seems highly applicable to claims-about-services (for lack of a better term). It would be dumb to have an IETF architecture for claims-about-services that didn’t re use the RATS architecture at least partially.

By my read of the charter, claims-about-services are not explicitly excluded, but also not quite in the spirit of it. Maybe the work done is done in RATS with a re charter?

The bottom line for me, is that I really don’t want to put any claims about services in EAT. There is enough work to do already :-)

LL

> On Aug 6, 2020, at 11:38 AM, Smith, Ned <ned.smith@intel.com> wrote:
> 
> The RATS charter refers to "system component" as the initial focus for definition; which includes claims definition. The architecture makes it clear that claims can originate elsewhere as well. It seems reasonable that claims about services could be defined elsewhere, but still be conveyed / appraised using RATS WG defined architecture and technology. Alternatively it could be defined in RATS, but possibly with some charter adjustments to allow "services" scope?
> 
> -Ned
> 
> On 8/5/20, 12:42 PM, "RATS on behalf of Laurence Lundblade" <rats-bounces@ietf.org on behalf of lgl@island-resort.com> wrote:
> 
> 
> 
>> On Aug 5, 2020, at 4:47 AM, Carsten Bormann <cabo@tzi.org> wrote:
>> 
>> On 2020-08-03, at 20:58, Laurence Lundblade <lgl@island-resort.com> wrote:
>>> 
>>> Service Authenticity
>>> 	• Focus is on the provider of the service, not the HW or SW
>>> 	• The legal entity of interest is the service provider
>>> 	• There is no equivalent of claims, but if there was they would be about the business or person operating the service
>>> 	• Example: a web site
>>> 	• Example: an email provider (IMAP service)
>>> 
>> 
>> Hi Laurence,
>> 
>> if you are talking about HTTPS, there is exactly one claim:  The service is speaking for a specific name (e.g., facebook.com).  All other claims are funneled through this one very special one.  Of course, the TLS handshake could be leveraged to do more than this one claim, but that is not what happens in HTTPS.
> 
>    Yes, agreed.
> 
>    Any notion of trustworthiness, regulatory compliance and such for a service is implied. We make heavy use of that implication and that is mostly OK. For example, knowing that facebook.com is Facebook Inc allows us to assume lots about the service from what we know of the company. 
> 
>    The equivalent for attestation would be just to name the manufacturer of the HW or SW. However, we are going far beyond that with all the Claims in the Evidence and Results.
> 
>    Maybe we should have Claims about services? For example, what regulatory statutes they meet. Where are they incorporated. A reference to their terms of service and privacy policy.
> 
>    That however seems like a new WG, not RATS.
> 
>    LL
> 
> 
>    _______________________________________________
>    RATS mailing list
>    RATS@ietf.org
>    https://www.ietf.org/mailman/listinfo/rats
> 
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats