[Rats] Re: New Version Notification for draft-sardar-rats-sec-cons-03.txt

[David Condrey <[e-mail]>]

Hi Usama, Yogesh, Jun, Houda, Henk, and the RATS WG,

I am replying to voice my strong support for Usama's request to include the security and privacy considerations from draft-sardar-rats-sec-cons-03 (Sections 8.1.1 and 8.1.2) into the multi-verifier draft.

From the perspective of other active work in this space, preserving the security and privacy guarantees of TLS Exported Authenticators (expat) is critical. As the author of drafts utilizing the Proof of Process (PoP) framework and related cryptographic proofs (such as draft-condrey-cfrg-posme and draft-condrey-rats-pop), my proposed architectures fundamentally rely on those expat guarantees remaining intact.

If the multi-verifier architecture breaks the expat guarantees, it creates a cascading issue that undermines the threat models of downstream drafts that depend on them.

David Condrey


> On Apr 29, 2026, at 4:08 PM, Muhammad Usama Sardar <[e-mail]> wrote:
> 
> Hi Yogesh, Jun, Houda, and Henk,
> 
> We are doing research on the security and privacy of multi-verifiers, and we will share any solution that we will have from our analysis.
> 
> For now, we have revised the proposal for security considerations statement [0] based on the adoption call discussion that we would like to be added in the draft until you or we find some reasonable solution.
> 
> Privacy statement is unchanged [1] and we would like that to be added in the draft as well.
> 
> Thank you.
> 
> Best regards,
> 
> -Usama
> 
> [0] https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.html#section-8.1.1-3
> 
> [1] https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.html#section-8.1.2-3
> 
> 
> 
> 
> 
> -------- Forwarded Message --------
> Subject: 	New Version Notification for draft-sardar-rats-sec-cons-03.txt
> Date:	Wed, 29 Apr 2026 15:44:15 -0700
> From:	[e-mail] <mailto:[e-mail]>
> To:	Muhammad Sardar <[e-mail]> <mailto:[e-mail]>, Muhammad Usama Sardar <[e-mail]> <mailto:[e-mail]>
> 
> A new version of Internet-Draft draft-sardar-rats-sec-cons-03.txt has been
> successfully submitted by Muhammad Usama Sardar and posted to the
> IETF repository.
> 
> Name: draft-sardar-rats-sec-cons
> Revision: 03
> Title: Guidelines for Security Considerations of RATS
> Date: 2026-04-29
> Group: Individual Submission
> Pages: 14
> URL: https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.txt
> Status: https://datatracker.ietf.org/doc/draft-sardar-rats-sec-cons/
> HTML: https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.html
> HTMLized: https://datatracker.ietf.org/doc/html/draft-sardar-rats-sec-cons
> Diff: https://author-tools.ietf.org/iddiff?url2=draft-sardar-rats-sec-cons-03
> 
> Abstract:
> 
> This document aims to provide guidelines and best practices for
> writing security considerations for technical specifications for RATS
> targeting the needs of implementers, researchers, and protocol
> designers. This is a work-in-progress, and the current version
> mainly presents an outline of the topics that future versions will
> cover in more detail.
> 
> * Corrections in published RATS RFCs
> 
> * Security concerns in two RATS drafts
> 
> * General security guidelines, baseline, or template for RATS
> 
> 
> 
> The IETF Secretariat
> 
> 
> _______________________________________________
> RATS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]