Re: [Rats] OEM ID lifetime (was Re: Warren Kumari's Discuss on draft-ietf-rats-eat-21: (with DISCUSS and COMMENT))

[Warren Kumari <[e-mail]>]

On Thu, Sep 07, 2023 at 12:13 AM, lgl island-resort.com <
[e-mail]> wrote:

> On Sep 6, 2023, at 3:03 PM, Warren Kumari via Datatracker <noreply@ietf.
> org> wrote:
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
>
> Be ye not afraid -- a DISCUSS ballot is a request to have a discussion --
> https://www.ietf.org/about/groups/iesg/statements/
> handling-ballot-positions/ .
>
>
> :-)
>
>
> 4: S 4.2.3.1. Random Number Based OEMID
> "They would perform this only once in the life of the company to generate
> the
> single ID for said company. They would use that same ID in every entity
> they
> make. This uniquely identifies the OEM on a statistical basis and is large
> enough should there be ten billion companies."
>
> It is very unclear what exactly the "life of a company" is here. America
> Online
> has been, variously: Control Video Corporation (1983–1985) Quantum Computer
> Services (1985–1991) America Online (1991–2009) AOL Time Warner
> (2001–2009) AOL
> (2009 - 2015) AOL, part of Verizon (2015 - now)
>
> At what point(s) in this tangled web (if ever) should "AOL" have generated
> a
> new "single SID"? Another example: "In April 2012, Facebook paid $1B for
> Instagram, a photo and video sharing software." -- which "single" SID
> should
> Facebook (whoops, Meta) used for Oculus headsets?
>
>
> Good point. Thx.
>
> I’ve made a PR here <https://github.com/ietf-rats-wg/eat/pull/406/files>.
> For convenience I’ve pasted the text here:
>
> The "oemid" claim identifies the Original Equipment Manufacturer (OEM) of
> the hardware. Any of the three forms described below MAY be used at the
> convenience of the claim sender. The receiver of this claim MUST be able to
> handle all three forms.
>
> Note that the "hwmodel" claim in Section 4.2.4, the "oemboot" claim in
> Section 4.2.8 and "dbgstat" claim in Section 4.2.9 depend on this claim.
>
> Sometimes one manufacturer will acquire or merge with another. Depending
> on the situation and use case newly manfactured devices may continue to use
> the old OEM ID or switch to a new one. This is left to the discretion of
> the manufacturers, but they should consider how it affects the
> above-mentioned claims and the attestation eco-system for their devices.
> The considerations are the same for all three forms of this claim
>
> discuss….
>


Erm… Ok, but it will be a VERY short discussion - LGTM! :-)
W



> LL
>