Re: [Rats] retrieving reference measurements

[Guy Fedorkow <[e-mail]>]

Hi Henk,
  I understand that third-party RIMs could be used, but for embedded
equipment, it seems like the easiest path is to deliver the RIMs as part of
the vendor's software update package for the device.  Operators have
well-worn procedures for getting software updates to devices; if the RIM is
just part of the package, they don't have to think about a new procedure at
all...
  Maybe not for everyone, but it seems like it would be a common use-case...
Thanks
/guy



Juniper Business Use Only

-----Original Message-----
From: Henk Birkholz <[e-mail]> 
Sent: Wednesday, April 29, 2020 11:29 AM
To: Guy Fedorkow <[e-mail]>
Cc: [e-mail]; Jessica Fitzgerald-McKay <[e-mail]>; William
Bellingrath <[e-mail]>
Subject: Re: retrieving reference measurements

[External Email. Be cautious of content]


Hi Guy,

I think it would be strange for a network equipment device to expose a
potentially vulnerable management to the open internet, too :)

Luckily, there will probably be a "higher level" constituent in the network
that an Attester's DevID can be presented to (typically this is or is close
to a device that is also a Verifier). And these systems generally have a way
to "reach out" to the internet.

The typically already existing "path" to follow here is the way updates find
their way to a "network equipment device". If you are air-gap'ed or
completely isolated wrt every layer 2 topology, it may start to become a bit
tricky, but your are running around with usb sticks in hand to do updates
then, too.

YANG is a big solution for big problems. But you can use a YANG server to
retrieve RIM that are stored on the Attester itself, of course. These
probably are outdated at some point and then leave you with the same
illustrated above, again.

Viele Grüße,

Henk


On 29.04.20 15:56, Guy Fedorkow wrote:
> Hi Henk,
>
> I see your proposal for identifying URIs for reference measurements in 
> https://urldefense.com/v3/__https://tools.ietf.org/html/draft-birkholz
> -rats-mud-00__;!!NEt6yMaO-gk!WdyQ3vQ51adw93UKoSwWvgPFs4395vPIWLjuzRBiF
> gldobaQ_dLIeFbhOWan0kBLDLY$
>
>    I realize that some constrained devices may not want to do this, 
> but do you think draft-charra could be extended to allow retrieval of 
> the signed reference measurements directly from the device being 
> attested, via the YANG / Netconf interface?
>
>    Ironic as it may sound, I’m sure you know that many operators 
> ensure that their internet routers cannot access the public internet.
>
>    Thanks,
>
> /guy
>
>
> Juniper Business Use Only
>