Re: [Rats] retrieving reference measurements

[Henk Birkholz <[e-mail]>]

Hi Guy,

I think it would be strange for a network equipment device to expose a 
potentially vulnerable management to the open internet, too :)

Luckily, there will probably be a "higher level" constituent in the 
network that an Attester's DevID can be presented to (typically this is 
or is close to a device that is also a Verifier). And these systems 
generally have a way to "reach out" to the internet.

The typically already existing "path" to follow here is the way updates 
find their way to a "network equipment device". If you are air-gap'ed or 
completely isolated wrt every layer 2 topology, it may start to become a 
bit tricky, but your are running around with usb sticks in hand to do 
updates then, too.

YANG is a big solution for big problems. But you can use a YANG server 
to retrieve RIM that are stored on the Attester itself, of course. These 
probably are outdated at some point and then leave you with the same 
illustrated above, again.

Viele Grüße,

Henk


On 29.04.20 15:56, Guy Fedorkow wrote:
> Hi Henk,
> 
> I see your proposal for identifying URIs for reference measurements in 
> https://tools.ietf.org/html/draft-birkholz-rats-mud-00
> 
>    I realize that some constrained devices may not want to do this, but 
> do you think draft-charra could be extended to allow retrieval of the 
> signed reference measurements directly from the device being attested, 
> via the YANG / Netconf interface?
> 
>    Ironic as it may sound, I’m sure you know that many operators ensure 
> that their internet routers cannot access the public internet.
> 
>    Thanks,
> 
> /guy
> 
> 
> Juniper Business Use Only
>