[Rats] Re: question about draft-moriarty-rats-posture-assessment-01

[Kathleen Moriarty <[e-mail]>]

Thomas,

Thank you! I think A.J. is a bit tied up so I'll respond with some of my
thoughts as well.

On Wed, Aug 7, 2024 at 4:36 AM Thomas Fossati <[e-mail]>
wrote:

> Hi A.J.,
>
> On Thu, 1 Aug 2024 at 16:18, A.J. Stein <[e-mail]>
> wrote:
> > I am one of the authors, but I would presume that defining a "GRC
> report" is something conceptually and structurally different (I assume
> conceptual message is pointing to semantics of data in a new use of
> Conceptual Message Wrapper? Correct me if I am wrong) is not desirable. Re
> the options and your diagram, I can see a summarization of attestation
> results as just another form of attestation result, so I too would see it
> as Option 1.
>
> Cool, thanks!
>
> (For the records, I believe that it is possible to interpret the RATS
> verifier role recursively, symmetric to the "layered" attester.)
>

Great. I think it will be helpful to have assessments that layer, as well
as ones that report out on just a particular assessment. For the latter, it
could be useful to know one layer has a problem, but the rest is running
and configured as expected. A zero trust principle is that you can run
something secure on a platform that may not be secure and operationally, I
think posture assessments may need this flexibility for operational
decisions to be made.


>
> >> Note that 2. is a bit problematic because in a rigid interpretation of
> >> RFC9334, the new conceptual message is outside Figure 1, and therefore
> >> out of RATS's scope:
> >
> > I reviewed the diagram (with the prettified ASCII version rendered on
> mailarchive.ietf.org in the subsequent thread) and it seems sensible to
> me. Would that diagram be helpful for you to better inform the goals and
> design of the draft?
>
> The diagram is a pictorial representation of option 2.  If we go with
> option 1., RFC9334's conceptual framework holds - with the caveat that
> the RATS roles' big boxes may hide some smaller, nested boxes.
>
> > I will say that given my previous response, I guess I want to make sure
> I understand: could the system analyzing and summarizing attestation
> results be simply a relying party? I would assume that is not sufficient or
> prudent given my previous read of 9334, but maybe that is a good reason you
> wrote this email and presented this diagram.
>

Yes, it could be a full assessment using attestation in the way that you
would normally expect taking place, with a summary generated including a
reference to the log evidence of the verifications performed.


> Yes, in essence, that was my doubt: that an RP (i.e., an application
> built on top of the RATS architecture) could take that role and use
> the defined claims in some kind of new "summary message."
>
> I suggest that it should be made clearer that the scope is restricted
> to attestation results, possibly beginning with a new document title,
> e.g.: "Attestation Result Claims for Posture Assessment".
>

Sure, we're flexible with the title and this suggestion makes a lot of
sense.

Thank you,
Kathleen


> cheers, t
>


-- 

Best regards,
Kathleen