[Rats] Organizing IETF attestation work

[Laurence Lundblade <[e-mail]>]

Hi folks, here is a straw man proposal for organizing the IETF attestation work.

I proposed we combine eat and rats and call this the Remote Attestation or RA working group. 

Example in-scope use cases include:
TPM/TCG based attestations that are sent to remote entities, relying parties and such (non-local attestations)
Attestations used by protocols like FIDO that provide secured claims about a particular subsystem on a device to relying parties
Platform/system attestation schemes like Android O attestation
Reporting of device/system security characteristics by subsystems like TEEs and secure elements
Securing of risk signals (e.g., SW version, geographic location, device types) sent to relying parties
For IoT device on-boarding, proof of device provenance
The documents produced would probably be:
An overall model and terminology document (we have a start with the RATS <https://tools.ietf.org/html/draft-birkholz-attestation-terminology-02> document)
A claims definition document (we have a start with the EAT <https://tools.ietf.org/html/draft-mandyam-eat-00> document)
A protocol definition for transmitting attestations when they are not being carried in other protocols as extensions or such (not started)
Possibly the token binding attestation work (Giri has completed a lot of work on this <https://tools.ietf.org/html/draft-mandyam-tokbind-attest-04>)

We get to reference Ra, the Egyptian sun god and use hieroglyphics.

LL