Re: [Rats] FW: New Version Notification for draft-shaw-rats-rear-00.txt

[Thomas Fossati <[e-mail]>]

Hi Kathleen,

I hadn't come across SCAP before.  This looks interesting and certainly
relevant, so thanks for pointing out the potential relation with our
draft.

On 06/07/2020, 15:41, "Kathleen Moriarty" <[e-mail]> wrote:
> Since we have a number of RESTful protocols in use to exchange
> formatted data, it would be good to explicitly state support for these
> protocols.  SCAPv2.0 has adopted ROLIE [RFC8322].  Since SCAP is how
> posture assessment is performed, it would be good to include this
> capability to enable a smooth transition to the use of remote
> attestation for simplified posture assessment as this work evolves.

Clarifying question.  In principle, the mechanics specified in the draft
can be used to bind attestation data to *any* resource.  So, ROLIE feeds
are certainly in scope.  However, it seems to me that in the SCAP
architecture the "natural" attestors are the Endpoints.  And, on the
Endpoint, posture collection is pulled using one of NEA/SWIMA, or
NETCONF, or some other specific MDM protocol, depending on the
Endpoint's type/class.  So, wouldn't NETCONF be a more suitable target
than ROLIE in this case?

> Similarly, RedFish is in use for server management across several
> platforms.  I’ve been working with the DMTF to improve security of
> RedFish just in case it could be used.
>
> There are likely other protocols that may be used, and leaving this
> open to accommodate various RESTful protocols may be the best approach
> towards enabling adoption.

+1 -- Though I'm a bit unsure about what strategy would you suggest?

One of the base constructs provided in the draft, namely the way to bind
the resource representation with the attestation Evidence by hashing it
in to the nonce claim, is very broadly applicable.  So there's that.
However, the REST-y bits (verbs & content types) are slightly more
"rigid" in the sense that although the attested resource can be anything
you want it to be, the outer shell has a very precise format that is not
open to manipulation.

cheers, thanks!




IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.