Re: [Rats] Reminder on RATS scope

["Smith, Ned" <[e-mail]>]

Henk,
Good catch, as SACM has wound down. It seems the evaluation of prior work happened organically and is reflected in use cases draft. 



On 1/12/22, 3:07 PM, "Henk Birkholz" <[e-mail]> wrote:

    Hi Ned,

    as a first step, I tried to capture Roman's proposals here:

    > https://github.com/ietf-rats/charter/compare/2nd-RC1...2nd-RC2

    and actually took the liberty to update the 2nd paragraph of "Goals" in 
    this step, too.

    OLD:
    The working group will cooperate and coordinate with other IETF WGs such 
    as TEEP, SUIT, and SACM, and work with organizations in the community, 
    such as the TCG and the FIDO Alliance, as appropriate. The WG will also 
    evaluate prior work such as NEA and proprietary attestation technologies 
    like the Android Keystore.

    NEW:
    The WG will continue to cooperate and coordinate with other IETF WGs 
    such as TEEP and SUIT, and work with organizations in the community, 
    such as the TCG and the FIDO Alliance, as appropriate.

    Please bash, if that reads wrong and/or can be improved.

    Viele Grüße,

    Henk

    On 12.01.22 00:54, Smith, Ned wrote:
    > @Roman Danyliw, Thanks for contributing to the discussion!
    > 
    > @Henk Berkholz, Thanks for capturing proposed charter text at https://github.com/ietf-rats/charter/compare/798fd27...2nd-RC1
    > 
    > I assume someone will incorporate Roman's suggestions into the git repo so that all list members will be able to review the proposed text in toto?
    > 
    > Maybe it makes sense for those wishing to voice objections or who want to suggest changes, to do so by the end of next week to bring the thread to a conclusion? However, this might be contingent on the proposed charter text on github being updated in a timely manner.
    > 
    > Thanks,
    > -Ned
    > 
    > 
    > On 1/11/22, 2:57 PM, "RATS on behalf of Roman Danyliw" <[e-mail] on behalf of [e-mail]> wrote:
    > 
    >      Hi Henk and WG!
    > 
    >      I don't want to micromanage the creation of proposed charter text, but I would suggest we leverage the clarity we got from the all of the hard work on the architecture document an enshrine it into the charter text.
    > 
    >      A way to repeat the same charter scope we have now using the language of the architecture document and add the new proposed scope (cribbing from Henk's words) would be as follows:
    > 
    >      ===[ OLD
    > 
    >      Goals
    >      =====
    > 
    >      This WG will standardize formats for describing assertions/claims about system
    >      components and associated evidence; and procedures and protocols to convey
    >      these assertions/claims to relying parties. Given the security and privacy
    >      sensitive nature of these assertions/claims, the WG will specify approaches to
    >      protect this exchanged data. While a relying party may use reference, known, or
    >      expected values or thresholds to assess the assertions/claims, the procedures
    >      for this activity are out of scope for this WG (without rechartering).
    > 
    >      Program of Work
    >      ===============
    >      3. Standardize an information model for assertions/claims which provide
    >      information about system components characteristics scoped by the specified
    >      use-cases.
    > 
    >      5. Standardize interoperable protocols to securely convey assertions/claims.
    > 
    >      ===[ Proposed
    > 
    >      Goals
    >      =====
    > 
    >      The WG has defined an architecture (draft-ietf-rats-architecture) for remote attestation.  It will standardize formats for describing evidence and attestation results; and the associated procedures and protocols to convey this evidence for appraisal to a verifier and these attestation results to a relying party.  Additionally, the WG will standardize formats for endorsements and reference values, but protocols and associated procedures for conveying them to the verifier are out of scope.  Formats and protocols for appraisal policy for evidence and appraisal policy for attestation results are also out of scope.
    > 
    >      Program of Work
    >      ===============
    >      3. Standardize an information model for evidence and attestations results scoped by the specified use-cases
    > 
    >      5. Standardize interoperable protocols to securely convey evidence and attestation results
    > 
    >      6. Standardize information and data models to securely declare and convey endorsements
    >         and reference values.
    > 
    >      ==[ end
    > 
    >      In addition to the charter text itself, the charter would need milestones for this new program of work in #6 (of the form "<date> Submit <deliverable name> draft to IESG for publication").  During this discussion I would also recommend revisiting all of the existing milestones which are 6 months - almost 2 years old in some cases.
    > 
    >      Regards,
    >      Roman
    > 
    > 
    >      > -----Original Message-----
    >      > From: Henk Birkholz <[e-mail]>
    >      > Sent: Monday, December 20, 2021 9:21 AM
    >      > To: Roman Danyliw <[e-mail]>; [e-mail]
    >      > Subject: Re: [Rats] Reminder on RATS scope
    >      >
    >      > Hi Roman,
    >      >
    >      > we tried to create proposal for a minimalist change to the charter with the
    >      > intent to allow for endorsement and reference values to be in scope.
    >      >
    >      > > https://github.com/ietf-rats/charter/compare/798fd27...2nd-RC1
    >      >
    >      > Viele Grüße,
    >      >
    >      > Henk
    >      >
    >      >
    >      > On 14.12.21 18:40, Roman Danyliw wrote:
    >      > > Hi!
    >      > >
    >      > > Congratulations to the WG on the recent push of documents heading to the
    >      > IESG or in WGLC.  I am enthusiastic to see this progress.
    >      > >
    >      > > As the WG considers the future work that needs to be done, I wanted to
    >      > reiterate the charter scope [1] in terms of the common language we have
    >      > established through the architecture document [2].  I appreciate that there
    >      > might be ambiguity as the charter language wasn't written with the benefit of
    >      > this common terminology or the insights the WG has gotten since starting in
    >      > 2019.
    >      > >
    >      > > In scope activities are:
    >      > > ** Architecture (to include extensions, but not alternatives) and use
    >      > > cases (plural) documentation (informational documents) for RATS
    >      > > regardless of which components are involved
    >      > > ** Protocols, formats and procedures for the communication between (a)
    >      > > the attester and verifier, and (b) the verifier and the relying party
    >      > >
    >      > > Out of scope activities are:
    >      > > ** Protocols involving the endorser, reference value provider,
    >      > > verification owner, relying party owner as their primary focus
    >      > > ** Formats for endorsements, reference values, appraisal policy for
    >      > > evidence, or appraisal policy for attestation results
    >      > >
    >      > > It has not escaped my attention that a number of the individual (unadopted)
    >      > drafts [3], some under WG discussion, are out of scope per the charter.  I leave
    >      > it to the WG to consider if they have both the energy and interest to consider
    >      > broader scope.  I would strongly recommend that the next time the WG
    >      > updates the charter with new scope, the terminology be harmonized.
    >      > >
    >      > > Regards,
    >      > > Roman
    >      > >
    >      > > [1] https://datatracker.ietf.org/wg/rats/about/
    >      > > [2] Figure 1.
    >      > > https://datatracker.ietf.org/doc/draft-ietf-rats-architecture/
    >      > > [3] https://datatracker.ietf.org/wg/rats/documents/
    >      > >
    >      > > _______________________________________________
    >      > > RATS mailing list
    >      > > [e-mail]
    >      > > https://www.ietf.org/mailman/listinfo/rats
    >      > >
    >      _______________________________________________
    >      RATS mailing list
    >      [e-mail]
    >      https://www.ietf.org/mailman/listinfo/rats
    >