Re: [Rats] comments on draft-birkholz-rats-architecture-02

[Hannes Tschofenig <[e-mail]>]

Hi Jürgen,

Thanks for your review. Looks of great questions.
Below is my take on it.

-----Original Message-----
From: RATS <[e-mail]> On Behalf Of Schönwälder, Jürgen
Sent: Mittwoch, 25. September 2019 16:18
To: [e-mail]
Subject: [Rats] comments on draft-birkholz-rats-architecture-02

Hi,

I am rather new here to please forgive my ignorance. I thought I start by reading the architecture document. Some of my questions may just show my ignorance but then this is what happens if you get fresh reads...

- What is 'normative guidance'?

[Hannes] Should just be 'guidance' but on the other hand an architecture document shouldn't provide guidance.
I guess we have to change the sentence altogether from
"
In general, this document
   provides normative guidance how to use, create or adopt network
   protocols that facilitate RATS.
"
To:

"

- Would it not make sense to also define the terms introduced in 1.1?

  - Claims
  - Evidence
  - Known-Good-Values
  - Endorsements
  - Attestation Results

  Perhaps section 1.1 should be folded into section 2 so that all
  terminology is defined in one place. What about terms such as

  - Attester
  - Verifier
  - Asserter
  - Relying Party

- What are 'architectural constituents'?

- Separation:

   A Computing Environment with the capability of remote attestation:

   o  is separate from other Attested Computing Environments (about
      which attestation evidence is created), and

  Does it always have to be separate? Is there an architectural
  requirement for these to be separate?

- If you read this document for the first time, it is difficult to put
  the various terms together in your head. Figure 1 helps but it comes
  a bit late, it would help if it would be shown early. It would have
  helped me if all key terms are defined upfront followed by a Figure
  explaining relationships or interactions before the discussion of
  details starts.

- Not sure this helps me understand things:

  (e.g.  Prinicipals that are Supply Chain Entities)

- What are Appraisals?

   [...]  Attestation Results are the output of appraisals.

  There is text in 3.3 about appraisals that I do not understand.  If
  Attestation Results are the output of appraisals, then appraisals
  are some form of a function. I thought that the Verifier is creating
  appraisals based on the received Evidence and the received
  Endorsements and that leads to Attestation Results, i.e., in a
  functional writing style:

  Verifier :: Known-Good-Values -> Endorsements -> Evidence -> Attestation Results

  This is also how I understand the definition of Verifier in 4.3.1.
  It seems appraisals are something internal to the logic of the
  Verifier, i.e., they may be produced by the logic of the Verifier but
  then the Attestation Results are really the output of the Verifier.

- Evidence

  I understand that Evidence is a specific form of a claim. I am not
  sure, though, what exactly turns a claim into Evidence.

   o  Evidence is provable Claims about a specific Computing Environment
      made by an Attester.

  What makes a claim a provable claim? Who is originating the claim
  and who is originating the Evidence?

- Endorsements

  It is not clear to me yet what the difference between Endorsements
  and KGV really is.

- Security Considerations

   RATS Evidence, Verifiable Assertions and Results SHOULD use formats
   ...

  Should that be

   RATS Evidence, Endorsements, Known-Good-Values, and Attestation
   Results SHOULD use formats ...

  to be consistent with terminology? The term 'Verifiable Assertions'
  shows up here the for the first time...

   [...]  Nonce Claims often piggy-
   back other information and can convey attestation semantics that are
   of essence to RATS, e.g. the last four bytes of a challenge nonce
   could be replaced by the IPv4 address-value of the Attester in its
   response.

  Despite wondering whether this is a good thing or a bad thing, I
  wonder why this is in the security considerations of the
  architecture document. The architecture does not define how Nonce
  Claims look like, so why would it discuss specific issues about
  Nonce Claims?

- Editorial

  s/capabile/capable/

  Singular/plural confusion in the following?

   Likely, there are a set of Claims that is widely applicable across
   most, if not all environments.  Conversely, there are Claims that are

/js

--
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <https://www.jacobs-university.de/>

_______________________________________________
RATS mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/rats
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.