[Rats] REIM v06 review

[[e-mail]]

Dear REIM Authors,

 

I’ve performed an (unsolicited, but hopefully still welcome) revision to
draft-ietf-rats-reference-interaction-models-06, resulting in the following
(mostly minor) comments:

 

1. Introduction

- “attestation policies”: “evidence appraisal policies” seems to be a more
accurate description.

 

2.1 Disambiguation

- “definition of Attestation as described in
“[I-D.ietf-rats-tpm-based-network-device-attest].” 

               - a side- question (and now useless, since it has been
published as a RFC): why wasn’t attestation definition included in RFC9334?

 

3. Scope and Intention

“how to triggering”: “how to trigger”

 

6. Generic Information Elements

- “(..) all kinds interaction models”: “all kinds of interaction models”

- “that each identifies an Authentication Secret in a single Attesting
Environment”: “where each identifies” seems to be more correct

 

7.1.  Challenge/Response Remote Attestation

- “see section Section 10.”: repeated words

- “The final output of the Verifier are Attestation Results”: while this is
correct, maybe it would be more accurate to state “The final output of the
Evidence appraisal by the Verifier are Attestation Results”?

- “Attestation Results constitute new Claim Sets about the properties and
characteristics of an Attester, which enables Relying Parties, for example,
to assess an Attester's trustworthiness.”

Considering the usage of “for example”, what are other generic usages of
Attestation Results by Relying Parties other than assessing the Attester’s
trustworthiness?

 

Section 7.1.1 , 1 – Passport model

- “In this model, the attestation sequence is a two-step procedure.”: This
seems to ignore the Request coming from the Verifier (depicted in the
diagram). To ensure coherence with the subsection “2 – Background Check
model”, it should probably mentioned.

 

General comments:

- I found the document to be informative, with an apparently clear scope and
intent 

- mentioning to [I-D.ietf-rats-architecture needs updating to RFC 9334

 

 

Best regards,

 

Sérgio Figueiredo

Technical Project Manager | Laboratory for Informatics and Systems

[phone]

 <http://www.ipn.pt/> www.ipn.pt