[Rats] 答复: I-D Action: draft-xia-rats-pubsub-model-01.txt

["Xialiang (Frank, Network Standard & Patent Dept)" <[e-mail]>]

Hi Eric,
Thank you for good comments!

Please see inline:

-----邮件原件-----
发件人: RATS [mailto:[e-mail]] 代表 Eric Voit (evoit)
发送时间: 2019年10月24日 5:38
收件人: Xialiang (Frank, Network Standard & Patent Dept) <[e-mail]>; [e-mail]
主题: Re: [Rats] I-D Action: draft-xia-rats-pubsub-model-01.txt

Hi Frank,

A few quick thoughts.

(1) The best way to deliver a nonce is to augment the <establish-subscription> RPC from RFC8639.  This requires just one object update.   To make this work effectively, we would need to expand the draft-birkholz-rats-basic-yang-module to also include data nodes for PCR state, rather than just the current RPCs.  BTW: If we base the data nodes on existing groupings, this actually is not a big change.
[Frank]: I don't understand your point exactly. Since nonce for freshness checking and protecting against replay attack is used by a randomly generating and varied in each notification message way, I think current dynamic subscription or configured subscription both need some extension for achieving this goal. And what is the point of your next statement of including data nodes for PCR state rather than just the current RPCs? Do you mean by this way the PCR state can be acquired by netconf push solution?

(2) Figure 2 & 3 mix the context of both stream subscriptions (RFC8639) and datastore subscriptions (RFC8641).  What you want is an RFC8641 subscription to draft-birkholz-rats-basic-yang-module, and an independent RFC8639 subscription to event streams like pcr-trust-evidence.  The results of these subscriptions can be independently correlated at the verifier.
[Frank]: You are right. Figure 2 is an example of using configured subscriptions to acquire the on-change state of PCR since they are very important event for RATS protocol. Figure 3 is an example of using netconf push (datastore subscriptions) to periodically get bios-log-trust-evidence for normal checking task. Figure 4 is an example of using the pre-defined events as the update trigger according the relatively new ECA netconf method. But I generally agree with your idea of their relation.

(3) Interestingly, the need to subscribe on-change to the values of individual PCRs (rather than a hash across multiple PCRs) is a perfect example of why a router will need to do pre-processing and summarization of signed information coming off a TPM.  This is in contrast to people who believe that a cryptoprocessor's raw feed is sufficient for all off-router applications.  A raw feed from a TPM is simply not sufficent.

Eric

> From: Xialiang (Frank, Network Standard & Patent Dept), October 21, 
> 2019 9:13 AM
> 
> Hi,
> We submit a new draft describing a method of using the netconf pub/sub 
> model in the RATS interaction procedure, to increase its flexibility, 
> efficiency and scalability.
> 
> Warmly welcome your comments!
> 
> B.R.
> Frank
> 
> 
> -----邮件原件-----
> 发件人: I-D-Announce [mailto:[e-mail]] 代表
> [e-mail]
> 发送时间: 2019年10月21日 21:09
> 收件人: [e-mail]
> 主题: I-D Action: draft-xia-rats-pubsub-model-01.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
>         Title           : Using Netconf Pub/Sub Model for RATS Interaction
> Procedure
>         Authors         : Liang Xia (Frank)
>                           Wei Pan
> 	Filename        : draft-xia-rats-pubsub-model-01.txt
> 	Pages           : 14
> 	Date            : 2019-10-21
> 
> Abstract:
>    This draft defines the a new method of using the netconf pub/sub
>    model in the RATS interaction procedure, to increse its flexibility,
>    efficiency and scalability.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-xia-rats-pubsub-model/
> 
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-xia-rats-pubsub-model-01
> https://datatracker.ietf.org/doc/html/draft-xia-rats-pubsub-model-01
> 
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-xia-rats-pubsub-model-01
> 
> 
> Please note that it may take a couple of minutes from the time of 
> submission until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> I-D-Announce mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html or 
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats