Re: [Rats] retrieving reference measurements

[Henk Birkholz <[e-mail]>]

Hi Guy,

I think I misunderstood the intend of your initial question. I thought 
it was a "network isolation" question, but it is a "conveyance method" 
question, I think.

CoSWID RIM tags use (and extend, actually), the payload-entry and 
therefore can be bundled in corresponding software/firmware packages 
that are updates. This is the reason why they are used in SUIT 
Manifests, too.

If they are not included in a software package, they can be referred to 
via a MUD ULL / MUD File. MUD is simply a straight forward option to... 
point at device specific things. It is certainly not meant to be 
constraining options, it adds a increasingly popular one.

Viele Grüße,

Henk



On 29.04.20 18:19, Guy Fedorkow wrote:
> Hi Henk,
>    I understand that third-party RIMs could be used, but for embedded
> equipment, it seems like the easiest path is to deliver the RIMs as part of
> the vendor's software update package for the device.  Operators have
> well-worn procedures for getting software updates to devices; if the RIM is
> just part of the package, they don't have to think about a new procedure at
> all...
>    Maybe not for everyone, but it seems like it would be a common use-case...
> Thanks
> /guy
> 
> 
> 
> Juniper Business Use Only
> 
> -----Original Message-----
> From: Henk Birkholz <[e-mail]>
> Sent: Wednesday, April 29, 2020 11:29 AM
> To: Guy Fedorkow <[e-mail]>
> Cc: [e-mail]; Jessica Fitzgerald-McKay <[e-mail]>; William
> Bellingrath <[e-mail]>
> Subject: Re: retrieving reference measurements
> 
> [External Email. Be cautious of content]
> 
> 
> Hi Guy,
> 
> I think it would be strange for a network equipment device to expose a
> potentially vulnerable management to the open internet, too :)
> 
> Luckily, there will probably be a "higher level" constituent in the network
> that an Attester's DevID can be presented to (typically this is or is close
> to a device that is also a Verifier). And these systems generally have a way
> to "reach out" to the internet.
> 
> The typically already existing "path" to follow here is the way updates find
> their way to a "network equipment device". If you are air-gap'ed or
> completely isolated wrt every layer 2 topology, it may start to become a bit
> tricky, but your are running around with usb sticks in hand to do updates
> then, too.
> 
> YANG is a big solution for big problems. But you can use a YANG server to
> retrieve RIM that are stored on the Attester itself, of course. These
> probably are outdated at some point and then leave you with the same
> illustrated above, again.
> 
> Viele Grüße,
> 
> Henk
> 
> 
> On 29.04.20 15:56, Guy Fedorkow wrote:
>> Hi Henk,
>>
>> I see your proposal for identifying URIs for reference measurements in
>> https://urldefense.com/v3/__https://tools.ietf.org/html/draft-birkholz
>> -rats-mud-00__;!!NEt6yMaO-gk!WdyQ3vQ51adw93UKoSwWvgPFs4395vPIWLjuzRBiF
>> gldobaQ_dLIeFbhOWan0kBLDLY$
>>
>>     I realize that some constrained devices may not want to do this,
>> but do you think draft-charra could be extended to allow retrieval of
>> the signed reference measurements directly from the device being
>> attested, via the YANG / Netconf interface?
>>
>>     Ironic as it may sound, I’m sure you know that many operators
>> ensure that their internet routers cannot access the public internet.
>>
>>     Thanks,
>>
>> /guy
>>
>>
>> Juniper Business Use Only
>>