Re: [Rats] security-level claim (was Re: WGLC for https://datatracker.ietf.org/doc/html/draft-ietf-rats-eat)

[Laurence Lundblade <[e-mail]>]

Hi Henk,

We talked this through at the Hackathon in Vienna and agree on resolution that I think is documented in this text <https://datatracker.ietf.org/doc/html/draft-ietf-rats-eat-13#section-1.4.1> in draft 13. The Hackathon photographer even took a picture of us talking about it.

LL


> On Jun 1, 2022, at 2:28 PM, Henk Birkholz <[e-mail]> wrote:
> 
> Hi Laurence,
> 
> I think we just framed one of the vital issues. More in-line!
> 
> On 01.06.22 23:16, Laurence Lundblade wrote:
>>> On Jun 1, 2022, at 2:06 PM, Henk Birkholz <[e-mail] <mailto:[e-mail]>> wrote:
>>> 
>>> Hi Laurence,
>>> 
>>> I see that the list of values for security-level has been trimmed, the context had quite some churn that is hard for me to reflect here in detail. What I am really missing now is the most important statement: "The claim made here is solely a self-claim made by the Attester.”
>> You suggested text would quite work out right.
>> - It could be a claim made by Verifier in AR and thus not a self-claim. (But only if this is a useful in the particular AR use case; some RP/Verifiers may prefer certification info or define their own scheme for security level; it’s just there if you like it and find it useful, not as any canonical standard representation of Verifier output)
> 
> Exactly. Which is why I still think that "just defining claims" without placing them in an Evidence or an Attestation bucket (or both! and then explaining why), explicitly, is mega important.
> 
>> - Even if it is a self-claim, so are many of the other claims
> 
> You'll probably see where I am going with this: this is an extension of the potentially cascading issue I am afraid we are creating.
> 
>> - In some cases when it is a claim made by the Attester, the Verifier may have rules for checking it when forwarding it to the RP, just like it has rules for all the other claims it may forward to the RP from either the Attester or Endorser. For example it might know the device manufacturer is very scrupulous and will only puts the correct security-level in just like it knows it puts in the correct UEID.
> 
> These appraisal policies for Evidence and appraisal policies for Attestation Results you are describing here will be implemented by independent teams of engineers most of the time like ships in the night, if the document does not elaborate on when they are okay to be put into Evidence and when they are okay to be put into Attestation Results.
> 
> Maybe this is just a déjà vu of mine, but didn't we had this exact some dialog already on the list? (maybe not byte compare identical, but more or less)
> 
> Viele Grüße,
> 
> Henk
> 
>> LL