[Rats] Implementation report

[Kathleen Moriarty <[e-mail]>]

Greetings!

Last year, I introduced my team to RATS work and pulled together a project
that was a lead in to the attestation sets draft, implementing largely
what's described in
https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/

It took some time to complete due to some hyperscaler environments not
having a TPM or access to it from the container orchestration platform or
virtual server host. Once we secured an environment where this was
possible, through use of the IMA libraries (created for this purpose and
previously proven by RedHat), positive results were demonstrated. The
objective was to test assurance to CIS Benchmarks as that was my employer
at the time. We hope you find this report useful.

https://www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical

This was done at the same time other team members were researching the
prevalence of TPMs and TEEs in infrastructure. The purpose of that work was
to signal that hardware support is increasingly available and should be
used to ease configuration management and posture assurance capabilities.

https://www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support

The timeline could include more data points, we included key points.

I am copying John Schmidt who did the work. Sean Turner joined the project
in September and assisted with key management, application of cryptography,
and validation. Thank you both for your great work to successfully
implement this PoC!

--

Best regards,
Kathleen