Re: [Rats] REIM v06 review

[Henk Birkholz <[e-mail]>]

Dear Sérgio,

many thanks for your detailed review! We'll address them in a dedicated 
PR in 
https://github.com/ietf-rats-wg/draft-ietf-rats-reference-interaction-models/ 
next week. If clarifying questions come up, we'll post the here on the 
list for better visibility.

Viele Grüße,

Henk

On 10.02.23 18:05, sfigueiredo=[e-mail] wrote:
> Dear REIM Authors,
> 
> I’ve performed an (unsolicited, but hopefully still welcome) revision to 
> draft-ietf-rats-reference-interaction-models-06, resulting in the 
> following (mostly minor) comments:
> 
> 1. Introduction
> 
> - “attestation policies”: “evidence appraisal policies” seems to be a 
> more accurate description.
> 
> 2.1 Disambiguation
> 
> - “definition of Attestation as described in 
> “[I-D.ietf-rats-tpm-based-network-device-attest].”
> 
>                 - a side- question (and now useless, since it has been 
> published as a RFC): why wasn’t attestation definition included in RFC9334?
> 
> 3. Scope and Intention
> 
> “how to triggering”: “how to trigger”
> 
> 6. Generic Information Elements
> 
> - “(..) all kinds interaction models”: “all kinds of interaction models”
> 
> - “that each identifies an Authentication Secret in a single Attesting 
> Environment”: “where each identifies” seems to be more correct
> 
> 7.1.  Challenge/Response Remote Attestation
> 
> - “see section Section 10.”: repeated words
> 
> - “The final output of the Verifier are Attestation Results”: while this 
> is correct, maybe it would be more accurate to state “The final output 
> of the Evidence appraisal by the Verifier are Attestation Results”?
> 
> - “Attestation Results constitute new Claim Sets about the properties 
> and characteristics of an Attester, which enables Relying Parties, for 
> example, to assess an Attester's trustworthiness.”
> 
> Considering the usage of “for example”, what are other generic usages of 
> Attestation Results by Relying Parties other than assessing the 
> Attester’s trustworthiness?
> 
> Section 7.1.1 , 1 – Passport model
> 
> - “In this model, the attestation sequence is a two-step procedure.”: 
> This seems to ignore the Request coming from the Verifier (depicted in 
> the diagram). To ensure coherence with the subsection “2 – Background 
> Check model”, it should probably mentioned.
> 
> General comments:
> 
> - I found the document to be informative, with an apparently clear scope 
> and intent
> 
> - mentioning to [I-D.ietf-rats-architecture needs updating to RFC 9334
> 
> Best regards,
> 
> *Sérgio Figueiredo*
> 
> *Technical Project Manager | Laboratory for Informatics and Systems*
> 
> [phone]
> 
> www.ipn.pt <http://www.ipn.pt/>
> 
> 
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats