[Rats] RATS Architecture

[Kathleen Moriarty <[e-mail]>]

Greetings!

I took some time to review the current version of the architecture document
and have some comments and suggestions.  The comments are from the editor's
version.  Please do post early and often updates to the IETF draft
repository.  Version numbers do not matter, it's okay to have a large
number :-)

These are meant to be helpful comments to improve the draft.

Introduction:
Could we change:
From:
Trust is a decision being made.
To:
To trust is a decision that spans beyond the technical assertions.

I struggle a little with the following:
"Trustworthiness is a quality that is assessed via evidence created."
As when one determines trustworthiness, it may span beyond evidence that is
"created".  Perhaps drop the word created?  I think it spans beyond that as
well, but may be too nit picky to expand.  The evidence could have to do
with something other then the system and those who manage it for instance.

Terminology:
The following definition should be just for "appraisal policy" unless there
are other types of appraisal policies in context for this body of work:
    Appraisal Policy for Attestation Result:  A set of rules that direct
      how a Relying Party uses the Attestation Results regarding an
      Attester generated by the Verifiers.  Compare /security policy/ in
      [RFC4949]
I don't think direct is the right word.  If this is so you can make
judgments on relying party decisions, the policy is more of a statement on
the decision process than how they are directed, which could be more
subjective.  The verifier here reads as if they generate the policy, but
are verifying against a set policy.
Proposed:
A set of rules for a Relying Party to verify attestation results.

The following 'definition' seems to get into role recommendations rather
than being a definition:
     Attester:  An entity whose attributes must be appraised in order to
      determine whether the entity is considered trustworthy, such as
      when deciding whether the entity is authorized to perform some
      operation
Shouldn't this stick to what an attester is/does?
Perhaps:
attester - entity who puts forth data that may include configuration or
static system information, evidence, or claims.  The evidence may be
digitally signed.

For evidence, should this definition be more about what evidence is rather
than about the roles involved?  The attester may not be the same component
or system that attests to the evidence as well.  Evidence could be
measurement data, telemetry (e.g. counters on a system interface - YANG or
SNMP), results of a policy comparison to configuration data).
    Evidence:  A set of information about an Attester that is to be
      appraised by a Verifier
Perhaps:
Evidence: Information about or originating from a system/firmware/software
that may include configuration data, measurements, telemetry, or inferences.

Is the following definition necessary?
    Verifier Owner:  An entity, such as an administrator, that is
      authorized to configure Appraisal Policy for Evidence in a
      Verifier

Section 3:
Consider changing the following sentence:
From:
" Each use case includes a description, and a summary of what an
   Attester and a Relying Party refer to in the use case."
To:
" Each use case includes a description followed by a summary of the
   Attester and a Relying Party roles."

Section 3.1:
Sentence 1: Consider changing from:
"Network operators want a trustworthy report of identity and version
   of information of the hardware and software on the machines attached
   to their network, for purposes such as inventory, auditing, and/or
   logging."
To:
"Network operators want a trustworthy report that includes identity and
version
   of information of the hardware and software on the machines attached
   to their network, for purposes such as inventory, audit,
anomaly detection, record maintenance and/or trending reports (logging)."

In the following sentence, "health" is fine, but did you consider the more
commonly used, "hygiene"?

>From the editor's version:
"Typically, solutions start with a specific component (called a "Root of
Trust") that provides device identity and protected storage for
measurements. These components perform a series of measurements, and
express this with Evidence as to the hardware and firmware/software that is
running."
Perhaps better stated as:
"Typically, solutions start with a specific component (called a "Root of
Trust") that provides device identity and protected storage for
measurements. The system components perform a series of measurements that
may be signed by the Root of Trust, considered as Evidence of the hardware,
firmware, BIOS, software, etc. that is running."
"express this with" is confusing and possibly misleading.  This proposed
phrasing allows for evidence to be broader than the series of measurements
as it might include system or configuration information.  It's not the RoT
that does the measurements, but they do attest to it.

Would the attester in this example be the root of trust of the device
rather than the full system?

Section 3.2:
Perhaps change the wording from:
"A device manufacturer wants to protect its intellectual property in
   terms of the ML model it developed and that runs in the devices that
   its customers purchased, and it wants to prevent attackers,
   potentially including the customer themselves, from seeing the
   details of the model."

To:
"A device manufacturer wants to protect its intellectual property.  This is
primarily the ML model it developed and runs in the devices purchased by
its customers. The goals for the protection include preventing attackers,
potentially the customer themselves, from seeing the details of the model."

I'm confused by the phrasing of the rest of the section and am wondering if
it can be improved.
Current:
"This typically works by having some protected environment in the
   device attest to some manufacturer service.  If remote attestation
   succeeds, then the manufacturer service releases either the model, or
   a key to decrypt a model the Attester already has in encrypted form,
   to the requester.

   Attester:  A device desiring to run an ML model to do inferencing

   Relying Party:  A server or service holding ML models it desires to
      protect"

I think it would help to talk about inferences in the written description.
For the attester, if it's the whole system as opposed to a component, then
then definition makes sense.  I'm wondering if it is crisper when
narrowed.  RoT captures inferences of the ML modeling used as evidence.
Does the relying party hold the ML model or knowledge of expected
inferences?

I'm happy to propose alternative text once I have more information to more
fully understand the use case.

Section 3.3:This one took a couple of reads to understand.  While it is
understandable, it could be more explicit to make it easier to get on first
read.  How about changing the following From:
Attestation is desired to prevent leaking data to compromised devices.
To:
"An assessment of system hygiene is made against a set of policies to
verify the state of a system using attestations for the system requesting
data.  Attestation is desired to prevent leaking data to compromised
devices."

Section 3.6
Nit:
From:
"One significant problem is malware that holds a device hostage and does
not allow it to reboot to prevent updates to be applied. "
To:
"One significant problem is malware that holds a device hostage and does
not allow it to reboot to prevent updates from being applied.  Remote
attestation aids in the verification process that may occur locally as well
as it is less likely that the policy or verification processes have also
been compromised if hosted on a separate system."

The second sentence is suggested as this also occurs locally on systems
today, but there is value in having this via remote attestation.

I'll send the next batch when I get far enough through the document.  I
didn't want to hold up on these comments.

Thank you for all your work on the document!

-- 

Best regards,
Kathleen