Re: [Rats] Comments on draft-birkholz-rats-architecture-01

Hi,

About binary "trustworthy".

This is a fundamental fallacy.  Neither "trustworthy"
nor "secure" are *ever* binary.  That's basic to the
security by design approach.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Access Protocol SG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: blueroofmusic@gmail.com
PO Box 221  Grand Marais, MI 49839  906-494-2434

On Fri, Jul 12, 2019 at 10:38 PM Benjamin Kaduk <kaduk@mit.edu> wrote:

> Cherry-picking one point...
>
> On Mon, Jul 08, 2019 at 02:44:56PM +0000, Nicolae Paladi wrote:
> > Hello,
> >
> > Some comments on draft-birkholz-rats-architecture-01<
> https://tools.ietf.org/html/draft-birkholz-rats-architecture-01>
> >
> [...]
> > 7.1.1<
> https://tools.ietf.org/html/draft-birkholz-rats-architecture-01#section-7.1.1>.
> How the RATS Architecture Addresses the Lying Endpoint Problem
> >
> >
> >
> >
> >
> >  RATS imply the involvement of at least two players (roles) who seek
> >    to overcome the lying endpoint problem.  The Verifier wishes to
> >    consume application data supplied by a Computing Context.  But before
> >    application data is consumed, the Verifier obtains Attestation
> >    Evidence about the Computing Context to assess likelihood of poisoned
> >    data due to endpoint compromise or failure.  Remote Attestation
> >    argues that a systems's integrity characteristics should not be
> >    believed until rationale for believability is presented to the
> >    relying party seeking to interact with the system.
> >
> > “Likelihood” implies a probabilistic approach to trustworthiness (e.g.
> 42% likelihood of poisoned data”). Is that really feasible? And if so, is
> it actually of any use? IMO trustworthiness is binary (“trustworthy or not
> trustworthy”), or binary and conditional/contextual (“trustworthy if used
> for certain actions”).
>
> My personal thinking here is along the lines of "this data makes me
> confident that only someone who was able to subvert my supply chain and
> surreptitiously replace the TPM chip in the sealed device delivered to me
> would be able to forge the attestation evidence; I don't think I'm the
> target of such an attack, so there's a low likeliyhood of endpoint
> compromise".  Or, as James Mickens put it more glibly in
> https://www.usenix.org/system/files/1311_05-08_mickens.pdf there's a
> Mossad/not-Mossad distinction in the potential attackers, and if the Mossad
> is a threat, you're gonna be Mossad'ed upon no matter what you do.
>
> -Ben
>
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats
>