Re: [Rats] EAT Profiles

[Michael Richardson <[e-mail]>]

Thomas Fossati <[e-mail]> wrote:
    > Thanks.  This sounds like a useful exercise.  Could you please have a
    > look at the PSA draft from this angle too?  We have tried hard to make
    > the document a blueprint of a EAT profile definition that others could
    > follow. It'd be good to have confirmation that we are on the right
    > track.

Hi, Looking at section 4.5.
I'm surprised at how little you write compared to TEEP (that's good, I think)
You are just declaring the profile claim value.
Again, I really think a URL is wrong in a constrained environment.

    >> First, this really feels wrong to use a string here for a constrained
    >> object.  My first suggestion is that it be FCFS registry.

    > This is a choice TEEP made (and, BTW, PSA too [1]) For a more compact
    > representation one could use a RFC9090 OID instead, there is no need
    > for a registry.  In fact, choosing URI / OID as the underlying type was
    > a conscious choice to avoid IANA round-tripping.

I think that's a wrong optimization.
A FCFS Registry is an email to IANA, and take as little as one business day
if time zones line up for you.
An OID could be much bigger than a 2-byte CBOR integer.

    >> I really don't like the EAT has not made a clear judgement on these
    >> things already.  I'd really really like EAT to be far more
    >> opinionated.

    > I think that's what the "The Constrained Device Standard Profile" [2]
    > is intended for?  One should use it as baseline, make a few custom
    > choices, define the claims set, and give it a new name.

Ah, this seems new to me.
Why didn't TEEP use it?  It looks identical to me.
Are each of these SHOULDs, or MUSTs?
If they are SHOULDs, then what are the exceptional case?

    > [2]
    > https://datatracker.ietf.org/doc/html/draft-ietf-rats-eat#section-6.3

    >> This totally surprises me.  Are you saying that it's okay for TEEP
    >> evidence to have *NO CLAIMS*?  Surely that can't be right.  If there
    >> was anything I expected to see in a profile it would be a list of
    >> required claims.

    > Agree, this is quite surprising.  In contrast, a good chunk of the PSA
    > document (all of Section 4 [3]) deals with the definition of the claims
    > set.

    >> > Refined Claim Definition: None.
    >>
    >> This is part of what worries me.  There should never be any semantics
    >> changes between profiles for claims.

    > I don't know what is meant by "Refined Claim Definition".  It doesn't
    > look like something required by EAT.

Maybe it's old.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-