[Rats] Re: Security considerations of remote attestation (RFC9334)

["Smith, Ned" <[e-mail]>]

+1 – If there are gaps in 9334 they need to be identified specifically and documented. Broadly stated claims of something being insecure isn’t actionable in my view.

From: Carsten Bormann <[e-mail]>
Date: Friday, December 20, 2024 at 02:52
To: Muhammad Usama Sardar <[e-mail]>
Cc: Smith, Ned <[e-mail]>, Michael Richardson <[e-mail]>, [e-mail] <[e-mail]>, Henk Birkholz <[e-mail]>, junzhang <[e-mail]>, Giridhar Mandyam <[e-mail]>, lgl island-resort.com <[e-mail]>, [e-mail] <[e-mail]>
Subject: Re: [Rats] Security considerations of remote attestation (RFC9334)
On 2024-12-19, at 19:18, Muhammad Usama Sardar <[e-mail]> wrote:
>
> Anyway, for a week since my statement, I just don't see any follow-up on the list saying that I am wrong, and TBH I will be very surprised if someone on the list will could actually justify that since the statement I am talking about contradicts fundamental security principles. If someone thinks I am wrong, I am all ears to it.

I haven’t read the 65 messages preceding this one in this thread, but I did use search.

I haven’t found anyone else wanting to undertake a 9334bis at this time.
If the WG doesn’t have the energy, it cannot undertake this work.

I do believe that collecting any clarifications that may be needed for 9334 would be a good thing, you could set up a Wiki for that.

If something emerges from this collection process that is useful, of substance, and can be developed into a consensus document, then a companion document to 9334 could be written.
This is likely not even an update (but could be if needed), just additional information.

Cross-WG suggestion: If this is really about corrections and clarifications, please have a look at RFC 4815 and draft-ietf-core-corr-clar.  Please do read [1] for a process that we are using right now over in the CoRE WG.  (This is about normative documents, which are more likely to need corrections and clarifications, but maybe an approach for collecting additional information for an architecture document can be derived.)

[1]: https://www.ietf.org/archive/id/draft-ietf-core-corr-clar-01.html#name-process

Do start the Wiki first, so we better know the shape of what is needed...

Grüße, Carsten