[Rats] Follow-up to AD review of draft-ietf-rats-tpm-based-network-device-attest-08

[Roman Danyliw <[e-mail]>]

Hi!

When I performed my AD review on draft-ietf-rats-tpm-based-network-device-attest (https://mailarchive.ietf.org/arch/msg/rats/RuBQhogqh3EuleeyDY13eiSfiAU/), I had only selectively read draft-ietf-rats-yang-tpm-charra.  With the benefit of detailed read, I have the following additional comments on draft-ietf-rats-tpm-based-network-device-attest-08

Given that Section 3.2.1 says, "Retrieval of Log Evidence SHOULD be done via log interfaces specified in [I-D.ietf-rats-yang-tpm-charra]", should the two documents be aligned as described below?

** Per the specific aligned text above, what kind of solution would not conform to the log interfaces in charra and how would this lead to an interoperable RIV solution?  Should this say MUST?

** Section 2.3

   2.  For devices using UEFI and Linux, measurements of firmware and
       bootable modules SHOULD be taken according to TCG PC Client
       [PC-Client-BIOS-TPM-1.2] or [PC-Client-BIOS-TPM-2.0], and Linux
       IMA [IMA]

-- should references here line up exactly with the references used in charra BIOS and IMA features?

** Section 2.4.2

   There are multiple event log formats which may be supported as viable
   formats of Evidence between the Attester and Verifier:

   *  IMA Event log file exports [IMA]

   *  TCG UEFI BIOS event log (TCG EFI Platform Specification for TPM
      Family 1.1 or 1.2, Section 7) [EFI-TPM]

   *  TCG Canonical Event Log [Canonical-Event-Log]

   Attesters which use UEFI BIOS and Linux SHOULD use TCG Canonical
   Event Log [Canonical-Event-Log] and TCG UEFI BIOS event log
   [EFI-TPM], although the CHARRA YANG model
   [I-D.ietf-rats-yang-tpm-charra] has no dependence on the format of
   the log.

-- Is saying that charra has no dependence on the format of the log accurate.  It appears that charra is particular about what log formats it will accept.  From [e-mail], it appears to be only:

(1) feature bios ==> "https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf,           Section 9.4.5.2";

(2) feature ima ==> "https://www.trustedcomputinggroup.org/wp-content/uploads/TCG_IWG_CEL_v1_r0p30_13feb2021.pdf  Section 4.3";

-- Is there a mismatch between how this document thinks of the UEFI BIOS event logs and that of the charra draft?

Here [EFI-TPM] is:

   [EFI-TPM]  Trusted Computing Group, "TCG EFI Platform Specification
              for TPM Family 1.1 or 1.2, Specification Version 1.22,
              Revision 15", January 2014,
              <https://trustedcomputinggroup.org/resource/tcg-efi-
              platform-specification/>.

draft-ietf-rats-yang-tpm-charra defines it as:

https://trustedcomputinggroup.org/wp-content/uploads/PC-ClientSpecific_Platform_Profile_for_TPM_2p0_Systems_v51.pdf, Section 9.4.5.2

-- Is it a problem that this document is seems to generically support [Canonical-Event-Log] but draft-ietf-rats-yang-tpm-charra seems to restrict it's support to only Section 4.3 of that reference (around IMA)?

-- Are IMA log file exports compatible with [Canonical-Event-Log]?

-- The [IMA] reference definition seems to have a typo in it.

Regards,
Roman