[Rats] 答复: I-D Action: draft-xia-rats-pubsub-model-01.txt

["Xialiang (Frank, Network Standard & Patent Dept)" <[e-mail]>]

Hi Eric,

-----邮件原件-----
发件人: RATS [mailto:[e-mail]] 代表 Eric Voit (evoit)
发送时间: 2019年10月24日 20:46
收件人: Xialiang (Frank, Network Standard & Patent Dept) <[e-mail]>
抄送: [e-mail]
主题: Re: [Rats] I-D Action: draft-xia-rats-pubsub-model-01.txt

Hi Frank,

> From: Xialiang (Frank, Network Standard & Patent Dept), Wednesday, 
> October 23, 2019 11:32 PM
> To: Eric Voit (evoit) <[e-mail]>
> 
> Hi Eric,
> Thank you for good comments!
> 
> Please see inline:
> 
> -----邮件原件-----
> 发件人: RATS [mailto:[e-mail]] 代表 Eric Voit (evoit)
> 发送时间: 2019年10月24日 5:38
> 收件人: Xialiang (Frank, Network Standard & Patent Dept) 
> <[e-mail]>; [e-mail]
> 主题: Re: [Rats] I-D Action: draft-xia-rats-pubsub-model-01.txt
> 
> Hi Frank,
> 
> A few quick thoughts.
> 
> (1) The best way to deliver a nonce is to augment the <establish-
> subscription> RPC from RFC8639.  This requires just one object update.   To
> make this work effectively, we would need to expand the 
> draft-birkholz-rats- basic-yang-module to also include data nodes for 
> PCR state, rather than just the current RPCs.  BTW: If we base the 
> data nodes on existing groupings, this actually is not a big change.
> [Frank]: I don't understand your point exactly. Since nonce for 
> freshness checking and protecting against replay attack is used by a 
> randomly generating and varied in each notification message way, I 
> think current dynamic subscription or configured subscription both 
> need some extension for achieving this goal. And what is the point of 
> your next statement of including data nodes for PCR state rather than 
> just the current RPCs? Do you mean by this way the PCR state can be acquired by netconf push solution?

Yes.  One way to do this would be sending a TUDA Sync token in the RPC response, or the subscription-started notification.

Eric

[Frank]: agree. Or maybe more.
 
> (2) Figure 2 & 3 mix the context of both stream subscriptions 
> (RFC8639) and datastore subscriptions (RFC8641).  What you want is an 
> RFC8641 subscription to draft-birkholz-rats-basic-yang-module, and an 
> independent
> RFC8639 subscription to event streams like pcr-trust-evidence.  The 
> results of these subscriptions can be independently correlated at the verifier.
> [Frank]: You are right. Figure 2 is an example of using configured 
> subscriptions to acquire the on-change state of PCR since they are 
> very important event for RATS protocol. Figure 3 is an example of 
> using netconf push (datastore subscriptions) to periodically get 
> bios-log-trust-evidence for normal checking task. Figure 4 is an 
> example of using the pre-defined events as the update trigger 
> according the relatively new ECA netconf method. But I generally agree with your idea of their relation.
> 
> (3) Interestingly, the need to subscribe on-change to the values of 
> individual PCRs (rather than a hash across multiple PCRs) is a perfect 
> example of why a router will need to do pre-processing and 
> summarization of signed information coming off a TPM.  This is in 
> contrast to people who believe that a cryptoprocessor's raw feed is 
> sufficient for all off-router applications.  A raw feed from a TPM is simply not sufficent.
> 
> Eric
> 
> > From: Xialiang (Frank, Network Standard & Patent Dept), October 21,
> > 2019 9:13 AM
> >
> > Hi,
> > We submit a new draft describing a method of using the netconf 
> > pub/sub model in the RATS interaction procedure, to increase its 
> > flexibility, efficiency and scalability.
> >
> > Warmly welcome your comments!
> >
> > B.R.
> > Frank
> >
> >
> > -----邮件原件-----
> > 发件人: I-D-Announce [mailto:[e-mail]] 代表
> > [e-mail]
> > 发送时间: 2019年10月21日 21:09
> > 收件人: [e-mail]
> > 主题: I-D Action: draft-xia-rats-pubsub-model-01.txt
> >
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> >
> >
> >         Title           : Using Netconf Pub/Sub Model for RATS Interaction
> > Procedure
> >         Authors         : Liang Xia (Frank)
> >                           Wei Pan
> > 	Filename        : draft-xia-rats-pubsub-model-01.txt
> > 	Pages           : 14
> > 	Date            : 2019-10-21
> >
> > Abstract:
> >    This draft defines the a new method of using the netconf pub/sub
> >    model in the RATS interaction procedure, to increse its flexibility,
> >    efficiency and scalability.
> >
> >
> > The IETF datatracker status page for this draft is:
> > https://datatracker.ietf.org/doc/draft-xia-rats-pubsub-model/
> >
> > There are also htmlized versions available at:
> > https://tools.ietf.org/html/draft-xia-rats-pubsub-model-01
> > https://datatracker.ietf.org/doc/html/draft-xia-rats-pubsub-model-01
> >
> > A diff from the previous version is available at:
> > https://www.ietf.org/rfcdiff?url2=draft-xia-rats-pubsub-model-01
> >
> >
> > Please note that it may take a couple of minutes from the time of 
> > submission until the htmlized version and diff are available at
> tools.ietf.org.
> >
> > Internet-Drafts are also available by anonymous FTP at:
> > ftp://ftp.ietf.org/internet-drafts/
> >
> > _______________________________________________
> > I-D-Announce mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/i-d-announce
> > Internet-Draft directories: http://www.ietf.org/shadow.html or 
> > ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> > _______________________________________________
> > RATS mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/rats