Re: [Rats] Reminder on RATS scope

[Roman Danyliw <[e-mail]>]

Hi Henk and WG!

I don't want to micromanage the creation of proposed charter text, but I would suggest we leverage the clarity we got from the all of the hard work on the architecture document an enshrine it into the charter text.

A way to repeat the same charter scope we have now using the language of the architecture document and add the new proposed scope (cribbing from Henk's words) would be as follows:

===[ OLD

Goals
=====

This WG will standardize formats for describing assertions/claims about system
components and associated evidence; and procedures and protocols to convey
these assertions/claims to relying parties. Given the security and privacy
sensitive nature of these assertions/claims, the WG will specify approaches to
protect this exchanged data. While a relying party may use reference, known, or
expected values or thresholds to assess the assertions/claims, the procedures
for this activity are out of scope for this WG (without rechartering).

Program of Work
===============
3. Standardize an information model for assertions/claims which provide
information about system components characteristics scoped by the specified
use-cases.

5. Standardize interoperable protocols to securely convey assertions/claims.

===[ Proposed

Goals
=====

The WG has defined an architecture (draft-ietf-rats-architecture) for remote attestation.  It will standardize formats for describing evidence and attestation results; and the associated procedures and protocols to convey this evidence for appraisal to a verifier and these attestation results to a relying party.  Additionally, the WG will standardize formats for endorsements and reference values, but protocols and associated procedures for conveying them to the verifier are out of scope.  Formats and protocols for appraisal policy for evidence and appraisal policy for attestation results are also out of scope.

Program of Work
===============
3. Standardize an information model for evidence and attestations results scoped by the specified use-cases

5. Standardize interoperable protocols to securely convey evidence and attestation results

6. Standardize information and data models to securely declare and convey endorsements
   and reference values.

==[ end

In addition to the charter text itself, the charter would need milestones for this new program of work in #6 (of the form "<date> Submit <deliverable name> draft to IESG for publication").  During this discussion I would also recommend revisiting all of the existing milestones which are 6 months - almost 2 years old in some cases.

Regards,
Roman


> -----Original Message-----
> From: Henk Birkholz <[e-mail]>
> Sent: Monday, December 20, 2021 9:21 AM
> To: Roman Danyliw <[e-mail]>; [e-mail]
> Subject: Re: [Rats] Reminder on RATS scope
> 
> Hi Roman,
> 
> we tried to create proposal for a minimalist change to the charter with the
> intent to allow for endorsement and reference values to be in scope.
> 
> > https://github.com/ietf-rats/charter/compare/798fd27...2nd-RC1
> 
> Viele Grüße,
> 
> Henk
> 
> 
> On 14.12.21 18:40, Roman Danyliw wrote:
> > Hi!
> >
> > Congratulations to the WG on the recent push of documents heading to the
> IESG or in WGLC.  I am enthusiastic to see this progress.
> >
> > As the WG considers the future work that needs to be done, I wanted to
> reiterate the charter scope [1] in terms of the common language we have
> established through the architecture document [2].  I appreciate that there
> might be ambiguity as the charter language wasn't written with the benefit of
> this common terminology or the insights the WG has gotten since starting in
> 2019.
> >
> > In scope activities are:
> > ** Architecture (to include extensions, but not alternatives) and use
> > cases (plural) documentation (informational documents) for RATS
> > regardless of which components are involved
> > ** Protocols, formats and procedures for the communication between (a)
> > the attester and verifier, and (b) the verifier and the relying party
> >
> > Out of scope activities are:
> > ** Protocols involving the endorser, reference value provider,
> > verification owner, relying party owner as their primary focus
> > ** Formats for endorsements, reference values, appraisal policy for
> > evidence, or appraisal policy for attestation results
> >
> > It has not escaped my attention that a number of the individual (unadopted)
> drafts [3], some under WG discussion, are out of scope per the charter.  I leave
> it to the WG to consider if they have both the energy and interest to consider
> broader scope.  I would strongly recommend that the next time the WG
> updates the charter with new scope, the terminology be harmonized.
> >
> > Regards,
> > Roman
> >
> > [1] https://datatracker.ietf.org/wg/rats/about/
> > [2] Figure 1.
> > https://datatracker.ietf.org/doc/draft-ietf-rats-architecture/
> > [3] https://datatracker.ietf.org/wg/rats/documents/
> >
> > _______________________________________________
> > RATS mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/rats
> >