[Rats] should Evidence containers be explicit about Personally Identiable Information?

[Michael Richardson <[e-mail]>]

The architecture design team is working hard to come to consensus!
We discussed for a few minutes an aside comment I had made about some text we
just added about keeping sensitive Evidence private.

Thomas Fossati has just included some of Kathleen's comments as a new ticket:

    > Kathleen's review [part 2](https://mailarchive.ietf.org/arch/msg/rats/7-UJAqHPMLhrGCk9tyh3JqGu8rw/)

    > Further privacy considerations:
    > * Remote attestation also provides a way to profile systems as well as
    > the user behind that system.
    > * If attestation results go higher in the stack to include containers
    > and applications, it could reveal even more about a system or user.

...

I had asked in my aside, if the *ARCHITECTURE* document should create a
requirement on Evidence (such as EAT) that it should *explicitely* flag when
it contains PII.

There are three pieces to this.
Let's start with the Evidence container, and use as an example:
  1) A claim about a device serial number,
  2) or a claim about a device location

a) PII could be implicit.
  The Verifier could just know this fact.
  That would be implicit: serial numbers are PII, device location is PII.
  Even if the device is a water-tower or a lighthouse. [cf:
     https://en.wikipedia.org/wiki/Lighthouse_and_naval_vessel_urban_legend ]
  The onus is now on the Verifier to ALWAYS know everything about every claim.
  Even ones it does not understand or use.
  This may have impacts upon audit trails, and who can see those audit trails.

b) PII could be explicit.
   The Attester would mark the claim with a flag, "pii: true" or something
   when it fills out a claim with data that it thinks is PII.
   This allows the Attester to mark every piece of data that might be
   sensitive as such, even if they are newly standardized claims that not
   every Verifier even uses.  {The lighthouse in the joke above, might decide
   that it's location is not PII}
   This relieves the Verifier from having to know the PII status of every
   item.

   (It is likely that "pii: true" would be the default, and pii:false
   would have to explicit, or rather, that the inverse: "public: true" would
   be what would be flagged)

An Evidence container, (such as EAT) could standardize the above.
We could debate this when we get to LC on EAT.
Another container (PKIX) might not.  This could be annoying.

So part of my question was should we debate this now, and make this an
architectural requirement for all containers?

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-