Re: [Rats] Call for Adoption: EAT draft

[Hannes Tschofenig <[e-mail]>]

Hi Giri,

We are currently in the phase of working document adoption and the question whether you would be willing to add this or that guidance to your individual draft isn’t actually relevant.
If your document becomes a working group item then we should have these details discussions about what claims should be registered and what the policy for adding new claims should be. Then, it is a decision of the working group and you will have to add it irrespectively of whether you like it or not. (At least that’s the idea.)

In a nutshell, we should have these discussions but now is actually not the time for it.

I will nevertheless give you feedback regarding your question below whether claims intended for use in EAT should be designated somehow: Of course this can be done by adding an extra attribute to the existing registry. Is it necessary is something I am wondering. There are, however, examples where adding an extra attribute to an already existing registry made sense. For example, when DTLS was developed the registry of algorithms for TLS was already established and there was a stream cipher (RC4) that couldn’t be used with DTLS. (Later we found out that stream ciphers are not even safe for TLS and hence this extra attribute does not make much sense anymore.)

Ciao
Hannes


From: RATS <[e-mail]> On Behalf Of Giridhar Mandyam
Sent: Donnerstag, 30. Mai 2019 19:49
To: [e-mail]
Subject: Re: [Rats] Call for Adoption: EAT draft

Thanks for chiming in, Hannes.  I assume you can speak on behalf of the CWT claims registry expert reviewers.

>>(a) some principles/guidance to CWT claims registry people on avoiding the mass registration of lightly-used or unused claims

>Why is this a requirement? When a claim is registered then it is most likely done with the anticipation that it will be used. I have not seen other IETF registries that have raised the bar to a similar level, at least the JWT claims registry does not work that way. Furthermore, what is the harm in registering claims that later turn out to be less frequently used?

OK – maybe guidance on lightly-used/unused claims is not desirable.

From a broader perspective - I am wondering whether claims intended for use in EAT should be designated as such when registering them in the CWT claims registry.  If so, should the CWT claims expert reviewers take into account different criteria when considering whether a proposed claim should be added to the registry?  If arbitrary claims are added to EAT via the registry that do not serve the purpose of remote attestation, it seems that the value of EAT would lessen.

>>(b) a requirement to map claims to existing YANG objects, if these YANG objects exist

>I also don’t understand this requirement. Is there some design rational why this would be needed/useful?

I was envisioning guidance along the lines of  - “If a claim represents a YANG object, then the corresponding CWT claim should follow the guidelines provided in https://datatracker.ietf.org/doc/draft-ietf-core-yang-cbor/ and the JWT claim should follow the guidelines of https://tools.ietf.org/html/rfc6020.”  This would hopefully prevent the case where a claim proposal uses an arbitrary methodology to map an attestation-related YANG object to CWT or JWT.  I don’t see a need to provide more guidance than this.

-Giri


From: Hannes Tschofenig <[e-mail]<mailto:[e-mail]>>
Sent: Thursday, May 30, 2019 10:18 AM
To: Giridhar Mandyam <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; Eric Voit (evoit) <[e-mail]<mailto:[e-mail]>>
Subject: RE: [Rats] Call for Adoption: EAT draft


CAUTION: This email originated from outside of the organization.
Hi Giri, Hi Eric,

>(a) some principles/guidance to CWT claims registry people on avoiding the mass registration of lightly-used or unused claims

Why is this a requirement? When a claim is registered then it is most likely done with the anticipation that it will be used. I have not seen other IETF registries that have raised the bar to a similar level, at least the JWT claims registry does not work that way. Furthermore, what is the harm in registering claims that later turn out to be less frequently used?

>(b) a requirement to map claims to existing YANG objects, if these YANG objects exist

I also don’t understand this requirement. Is there some design rational why this would be needed/useful?

Cia
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.