Re: [Rats] Call for adoption (after draft rename) for Yang module draft

Laurence Lundblade <lgl@island-resort.com> Mon, 11 November 2019 19:52 UTC

Return-Path: <lgl@island-resort.com>
X-Original-To: rats@ietfa.amsl.com
Delivered-To: rats@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD2B5120A01 for <rats@ietfa.amsl.com>; Mon, 11 Nov 2019 11:52:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 849gg1IyVzpA for <rats@ietfa.amsl.com>; Mon, 11 Nov 2019 11:52:48 -0800 (PST)
Received: from p3plsmtpa08-02.prod.phx3.secureserver.net (p3plsmtpa08-02.prod.phx3.secureserver.net [173.201.193.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 513381209FA for <rats@ietf.org>; Mon, 11 Nov 2019 11:52:38 -0800 (PST)
Received: from [10.141.0.162] ([45.56.150.139]) by :SMTPAUTH: with ESMTPA id UFjpiCA3HSGDjUFjpiQ1D7; Mon, 11 Nov 2019 12:52:37 -0700
From: Laurence Lundblade <lgl@island-resort.com>
Message-Id: <0C6940B0-E93F-4274-9D00-DEC4119B8F69@island-resort.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_6EEFEE09-4078-45AB-B62A-2477877FF2AC"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Date: Mon, 11 Nov 2019 11:52:37 -0800
In-Reply-To: <4A83CDF5-D29F-4279-8B03-E9D23299EB53@island-resort.com>
Cc: rats@ietf.org
To: Michael Richardson <mcr+ietf@sandelman.ca>
References: <8B173958-FC2A-4D1D-A81C-F324AB632CD7@cisco.com> <147F9159-6055-4E55-ABDC-43DFE3498BF1@island-resort.com> <ce5f8206-74dc-36bb-0093-a93045d5c67f@sit.fraunhofer.de> <0A7E3A4F-8534-4E98-BCB7-1454E07699F4@island-resort.com> <C3AE2645-49C8-4313-BCED-02FEB576B614@cisco.com> <1C8A1884-A37D-45E3-8C11-2FC5A083B245@island-resort.com> <ba12a686-1b34-21a3-388c-bbe01c01a408@sandelman.ca> <4A83CDF5-D29F-4279-8B03-E9D23299EB53@island-resort.com>
X-Mailer: Apple Mail (2.3445.104.11)
X-CMAE-Envelope: MS4wfEBu6GzFT9Tq18kIjm4CPf3SF7FYOLiONr8qnAL4XoQ32a8cvDRIxJIyXn3DdahxxxfWuWO1BCQxpMkFzaEm8VWLq7tPY7yRbqlzR7eoISwjZMI5VXiJ 7fBoCMM/Gh5l0L92IaQepSNbgEndcl4yVjAYf44y/KFWxfLKK2rcGDYkPmHVtmBH58CAdCflZ6fVZTL0aU8JTMqgIt+mHjzvaDA=
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/Kfegle-4BrGMC5_2AdLySNGlrxk>
Subject: Re: [Rats] Call for adoption (after draft rename) for Yang module draft
X-BeenThere: rats@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Remote Attestation Procedures <rats.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rats>, <mailto:rats-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rats/>
List-Post: <mailto:rats@ietf.org>
List-Help: <mailto:rats-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rats>, <mailto:rats-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 11 Nov 2019 19:52:51 -0000

One more note on this. It seems wrong-headed to try express claims in YANG. To do that we’d need to invent a YANG signing standard (YOSE?). Seems like YANG should be thought of as RPC / conveyance / transport here, not as a way to format a signed attestation token. 

LL


> On Nov 11, 2019, at 11:47 AM, Laurence Lundblade <lgl@island-resort.com>; wrote:
> 
> On Nov 10, 2019, at 9:20 PM, Michael Richardson <mcr+ietf@sandelman.ca <mailto:mcr+ietf@sandelman.ca>> wrote:
>> 
>>> 
>>> I think the value add to the larger RATS effort of adding EAT support
>>> to this YANG protocol is really high. It a core thing to do that helps
>>> bring together the two attestation worlds and make the TPM and EAT
>>> work here less like ships in the night.
>> 
>> Can you explain what it would mean to add EAT support for a YANG module?
> 
> The EAT is an opaque chunk of data in YANG. I’m not a YANG expert, but maybe like this:
> 
> Server                               Device
> GetAttestationTypes —>
>                                 <- TYPE_TPM, TYPE_CWT /* bit flags */
> 
> GetAttestation(TYPE_CWT , nonce) —> 
>                                 <— CWT Token /* a full signed token */
> 
> I assume YANG can carry opaque binary data of moderate size.
> 
> The yang module information model would have an element for a nonce and for an opaque EAT. It would not describe any internals of the EAT. The information model for the EAT is separate in the EAT document.
> 
> LL
> 
>                                  
>