Re: [Rats] Implementation report

[Tom Jones <[e-mail]>]

We are exploring the use of SBOM in OWF.
The last time I raised anything like that in a RATS thread I was met with
outright hostility.
..tom


On Wed, Feb 21, 2024 at 3:11 AM Henk Birkholz <[e-mail]>
wrote:

> Hi Kathleen,
>
> thank you for the pointers! Will you be in Brisbane?
>
> Looking at your last link, I am wondering if there are plans for future
> projects. Say... remote attestation based authenticity assurance in the
> software supply chain chain: and I am thinking along the lines of
> "Trustworthy SBOMs", which would be scenario that would combine various
> building blocks and that is definitely still in demand of more standards
> consolidation.
>
> Because
> https://learn.cisecurity.org/built-in-security-scale-hardware-support
> cited https://www.cisa.gov/securebydesign, I am reeling Alan into this
> reply. So that he is aware that we could do something meaningful here :-)
>
>
> Viele Grüße,
>
> Henk
>
> On 13.02.24 15:58, Kathleen Moriarty wrote:
> > Greetings!
> >
> > Last year, I introduced my team to RATS work and pulled together a
> > project that was a lead in to the attestation sets draft, implementing
> > largely what's described in
> > https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/
> > <https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/>
> >
> > It took some time to complete due to some hyperscaler environments not
> > having a TPM or access to it from the container orchestration platform
> > or virtual server host. Once we secured an environment where this was
> > possible, through use of the IMA libraries (created for this purpose and
> > previously proven by RedHat), positive results were demonstrated. The
> > objective was to test assurance to CIS Benchmarks as that was my
> > employer at the time. We hope you find this report useful.
> >
> >
> https://www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical
> <
> https://www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical
> >
> >
> > This was done at the same time other team members were researching the
> > prevalence of TPMs and TEEs in infrastructure. The purpose of that work
> > was to signal that hardware support is increasingly available and should
> > be used to ease configuration management and posture assurance
> capabilities.
> >
> >
> https://www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support
> <
> https://www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support
> >
> >
> > The timeline could include more data points, we included key points.
> >
> > I am copying John Schmidt who did the work. Sean Turner joined the
> > project in September and assisted with key management, application of
> > cryptography, and validation. Thank you both for your great work to
> > successfully implement this PoC!
> >
> > --
> >
> > Best regards,
> > Kathleen
> >
> > _______________________________________________
> > RATS mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/rats
>
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats
>