Re: [Rats] Implementation report

[Yogesh Deshpande <[e-mail]>]

Hi Henk,

What you mentioned below, is a perfect use case which is frequently been discussed across multiple groups.
i.e. how remote attestation can assist getting access to deeper insight into authenticity of secure software supply chain.

For this process to move forward, we not only need SBOM but also
HBOM ( https://www.cisa.gov/sites/default/files/2023-09/A%20Hardware%20Bill%20of%20Materials%20Framework%20for%20Supply%20Chain%20Risk%20Management%20%28508%29.pdf)

Hardware Profile is been discussed in SPDX community also, and linking various Bill of Materials can assist in visibility of overall end point security via remote attestation.

I would be quite keen to promote this discussion during coming IETF (though attending remotely).

Regards,
Yogesh Deshpande

-----Original Message-----
From: RATS <[e-mail]> On Behalf Of Henk Birkholz
Sent: Wednesday, February 21, 2024 11:11 AM
To: Kathleen Moriarty <[e-mail]>; rats <[e-mail]>; John Schmidt <[e-mail]>; Sean Turner <[e-mail]>
Cc: Allan Friedman <[e-mail]>
Subject: Re: [Rats] Implementation report

Hi Kathleen,

thank you for the pointers! Will you be in Brisbane?

Looking at your last link, I am wondering if there are plans for future projects. Say... remote attestation based authenticity assurance in the software supply chain chain: and I am thinking along the lines of "Trustworthy SBOMs", which would be scenario that would combine various building blocks and that is definitely still in demand of more standards consolidation.

Because
https://learn.cisecurity.org/built-in-security-scale-hardware-support
cited https://www.cisa.gov/securebydesign, I am reeling Alan into this reply. So that he is aware that we could do something meaningful here :-)


Viele Grüße,

Henk

On 13.02.24 15:58, Kathleen Moriarty wrote:
> Greetings!
>
> Last year, I introduced my team to RATS work and pulled together a
> project that was a lead in to the attestation sets draft, implementing
> largely what's described in
> https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/
> <https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/>
>
> It took some time to complete due to some hyperscaler environments not
> having a TPM or access to it from the container orchestration platform
> or virtual server host. Once we secured an environment where this was
> possible, through use of the IMA libraries (created for this purpose
> and previously proven by RedHat), positive results were demonstrated.
> The objective was to test assurance to CIS Benchmarks as that was my
> employer at the time. We hope you find this report useful.
>
> https://www.rsaconference.com/Library/blog/automated-assurance-on-a-pa
> th-to-becoming-practical
> <https://www.rsaconference.com/Library/blog/automated-assurance-on-a-p
> ath-to-becoming-practical>
>
> This was done at the same time other team members were researching the
> prevalence of TPMs and TEEs in infrastructure. The purpose of that
> work was to signal that hardware support is increasingly available and
> should be used to ease configuration management and posture assurance capabilities.
>
> https://www.cisecurity.org/insights/white-papers/built-in-security-at-
> scale-through-hardware-support
> <https://www.cisecurity.org/insights/white-papers/built-in-security-at
> -scale-through-hardware-support>
>
> The timeline could include more data points, we included key points.
>
> I am copying John Schmidt who did the work. Sean Turner joined the
> project in September and assisted with key management, application of
> cryptography, and validation. Thank you both for your great work to
> successfully implement this PoC!
>
> --
>
> Best regards,
> Kathleen
>
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats

_______________________________________________
RATS mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/rats
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.