Re: [Rats] Comments on draft-birkholz-rats-architecture-01

I think both perspectives are correct. If the context of evaluation is an access decision then trust is binary. If the context is analytics, logging or risk management then trust is (can be) probabilistic.

The relying party has the necessary context. The main objective for RATS is to define Attester-Verifier interactions.

I’m just wondering, for the purposes of RATS architecture, if we need to resolve this question now?

On 7/13/19, 7:11 AM, "Ira McDonald" <blueroofmusic@gmail.com<mailto:blueroofmusic@gmail.com>> wrote:

Hi,

About binary "trustworthy".

This is a fundamental fallacy.  Neither "trustworthy"
nor "secure" are *ever* binary.  That's basic to the
security by design approach.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Access Protocol SG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: blueroofmusic@gmail.com<mailto:blueroofmusic@gmail.com>
PO Box 221  Grand Marais, MI 49839  906-494-2434

On Fri, Jul 12, 2019 at 10:38 PM Benjamin Kaduk <kaduk@mit.edu<mailto:kaduk@mit.edu>> wrote:
Cherry-picking one point...

On Mon, Jul 08, 2019 at 02:44:56PM +0000, Nicolae Paladi wrote:
> Hello,
>
> Some comments on draft-birkholz-rats-architecture-01<https://tools.ietf.org/html/draft-birkholz-rats-architecture-01>
>
[...]
> 7.1.1<https://tools.ietf.org/html/draft-birkholz-rats-architecture-01#section-7.1.1>.  How the RATS Architecture Addresses the Lying Endpoint Problem
>
>
>
>
>
>  RATS imply the involvement of at least two players (roles) who seek
>    to overcome the lying endpoint problem.  The Verifier wishes to
>    consume application data supplied by a Computing Context.  But before
>    application data is consumed, the Verifier obtains Attestation
>    Evidence about the Computing Context to assess likelihood of poisoned
>    data due to endpoint compromise or failure.  Remote Attestation
>    argues that a systems's integrity characteristics should not be
>    believed until rationale for believability is presented to the
>    relying party seeking to interact with the system.
>
> “Likelihood” implies a probabilistic approach to trustworthiness (e.g. 42% likelihood of poisoned data”). Is that really feasible? And if so, is it actually of any use? IMO trustworthiness is binary (“trustworthy or not trustworthy”), or binary and conditional/contextual (“trustworthy if used for certain actions”).

My personal thinking here is along the lines of "this data makes me
confident that only someone who was able to subvert my supply chain and
surreptitiously replace the TPM chip in the sealed device delivered to me
would be able to forge the attestation evidence; I don't think I'm the
target of such an attack, so there's a low likeliyhood of endpoint
compromise".  Or, as James Mickens put it more glibly in
https://www.usenix.org/system/files/1311_05-08_mickens.pdf there's a
Mossad/not-Mossad distinction in the potential attackers, and if the Mossad
is a threat, you're gonna be Mossad'ed upon no matter what you do.

-Ben

_______________________________________________
RATS mailing list
RATS@ietf.org<mailto:RATS@ietf.org>
https://www.ietf.org/mailman/listinfo/rats