Re: [Rats] Call for adoption draft-moriarty-attestationsets

[Kathleen Moriarty <[e-mail]>]

Thanks for your feedback. I’ll look at updating the draft to address it.

Best regards,
Kathleen 

Sent from my mobile device

> On Nov 23, 2021, at 5:10 AM, Michael Richardson <[e-mail]> wrote:
> 
> 
> Kathleen Moriarty <[e-mail]> wrote:
>> When grouping sets of attestations, they should align to something, that's
>> in the sections you've listed as "nothing lost". How do you convey the set
>> name if it's not part of what is conveyed?
> 
> I don't know what the set name is.
> I suspect that the Introduction is not the place to put it.
> 
>> To reach scalable automation,
>> where attestations are shared remotely, we'll indeed have some alignment to
>> defined sets. CIS Benchmarks, NIST standards, TCG Reference Integrity
>> measurements are all examples of defined sets with NIST SP 800-193 already
>> fully attested in local hardware for traditional and hyperscaler vendors.
> 
> Great, so why not put this into a section, each, on how those fit into the
> claims you want to register?
> 
>> What needs to be registered will become more clear as implementations flush
>> out the details and there are a few vendors looking at this model to help
>> with this problem set - making security simpler to manage.
> 
> Great, again, why in the introduction?
> 
>>> Note that I am in favour of adopting documents early: as soon as the
>>> problem
>>> statement has been clearly articulated. I would support adoption of this
>>> document.
> 
> 
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>           Sandelman Software Works Inc, Ottawa and Worldwide
> 
> 
> 
>