Re: [Rats] Comments on draft-birkholz-rats-architecture-01

[Benjamin Kaduk <[e-mail]>]

Cherry-picking one point...

On Mon, Jul 08, 2019 at 02:44:56PM +0000, Nicolae Paladi wrote:
> Hello,
> 
> Some comments on draft-birkholz-rats-architecture-01<https://tools.ietf.org/html/draft-birkholz-rats-architecture-01>
> 
[...]
> 7.1.1<https://tools.ietf.org/html/draft-birkholz-rats-architecture-01#section-7.1.1>.  How the RATS Architecture Addresses the Lying Endpoint Problem
> 
> 
> 
> 
> 
>  RATS imply the involvement of at least two players (roles) who seek
>    to overcome the lying endpoint problem.  The Verifier wishes to
>    consume application data supplied by a Computing Context.  But before
>    application data is consumed, the Verifier obtains Attestation
>    Evidence about the Computing Context to assess likelihood of poisoned
>    data due to endpoint compromise or failure.  Remote Attestation
>    argues that a systems's integrity characteristics should not be
>    believed until rationale for believability is presented to the
>    relying party seeking to interact with the system.
> 
> “Likelihood” implies a probabilistic approach to trustworthiness (e.g. 42% likelihood of poisoned data”). Is that really feasible? And if so, is it actually of any use? IMO trustworthiness is binary (“trustworthy or not trustworthy”), or binary and conditional/contextual (“trustworthy if used for certain actions”).

My personal thinking here is along the lines of "this data makes me
confident that only someone who was able to subvert my supply chain and
surreptitiously replace the TPM chip in the sealed device delivered to me
would be able to forge the attestation evidence; I don't think I'm the
target of such an attack, so there's a low likeliyhood of endpoint
compromise".  Or, as James Mickens put it more glibly in
https://www.usenix.org/system/files/1311_05-08_mickens.pdf there's a
Mossad/not-Mossad distinction in the potential attackers, and if the Mossad
is a threat, you're gonna be Mossad'ed upon no matter what you do.

-Ben