Re: [Rats] use case document updates on Roots of Trust

I don't know what a trust root is, but a trust anchor does not reside on 
the Attester (with respect to the evidence that is created) while a root 
of trust does. That is kind of one of the primitives why they are 
differentiated. Specific comments in-line:

On 13.09.19 00:31, Salz, Rich wrote:
> I do not see a meaningful difference between "trust anchor" and "trust root" and "root(s) of trust."  All of them:
> 	- Are pieces of data (certificate or key is not meaningful

Well, if the entities certificates and the entities openssl software 
components are the same thing (because they both are pieces of data), 
then I think I would agree here. If it is relevant to the workflow that 
one is an executable that resides somewhere and one is a document that 
can be presented, I am more inclined to differentiate the entities TA 
from the entity ROT, too. I am aware that the analogy is a bit clunky 
and someone can surely can come up with a better one.

> 	- Used to verify something such as a certificate or signature

Some roots of trusts do that, other roots of trust don't do that (e.g. 
doing the opposite: an RTR for creating the signatures, digests, or 
evidence). So that cannot be a common denominator either, I think.

> 	- Are trusted by the application, based on actions that are "out of band" of the application itself

That in fact is indisputable and probably the reason why both trust 
anchor and root of trust include the term "trust" :)

In essence, I simply think it is just not that simple - to say "they are 
the same" and then only focus on similarities to bolster that argument.

Viele Grüße,

Henk

>   
> 
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats
> 