Re: [Rats] Comments on draft-birkholz-rats-architecture-01

Hi Ned,

Perhaps in the RATS context we don't have to have this (side) discussion
about the use/definition of the word trustworthy...

For access at the datalink (device joining a network via an Access Point),
perhaps you could consider "trustworthy" as binary.  Although even later
TCG TNC and IETF NEA didn't - they distinguished which logical subnet
you got access to according to the quality of your posture information.

For access to a service (e.g., financial or medical), certainly
"trustworthy"
is not binary.  Service access and transaction authorization are dynamic
contexts for "trustworthy" - banks and credit card companies make a new
decision about relative degree of "trustworthiness" for every transaction.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Access Protocol SG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: blueroofmusic@gmail.com
PO Box 221  Grand Marais, MI 49839  906-494-2434

On Mon, Jul 15, 2019 at 10:07 AM Smith, Ned <ned.smith@intel.com> wrote:

> I think both perspectives are correct. If the context of evaluation is an
> access decision then trust is binary. If the context is analytics, logging
> or risk management then trust is (can be) probabilistic.
>
>
>
> The relying party has the necessary context. The main objective for RATS
> is to define Attester-Verifier interactions.
>
>
>
> I’m just wondering, for the purposes of RATS architecture, if we need to
> resolve this question now?
>
>
>
> On 7/13/19, 7:11 AM, "Ira McDonald" <blueroofmusic@gmail.com> wrote:
>
>
>
> Hi,
>
>
>
> About binary "trustworthy".
>
>
>
> This is a fundamental fallacy.  Neither "trustworthy"
>
> nor "secure" are *ever* binary.  That's basic to the
>
> security by design approach.
>
>
>
> Cheers,
>
> - Ira
>
>
>
> Ira McDonald (Musician / Software Architect)
> Co-Chair - TCG Trusted Mobility Solutions WG
>
> Co-Chair - TCG Metadata Access Protocol SG
>
> Chair - Linux Foundation Open Printing WG
> Secretary - IEEE-ISTO Printer Working Group
> Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
> IETF Designated Expert - IPP & Printer MIB
> Blue Roof Music / High North Inc
> http://sites.google.com/site/blueroofmusic
> http://sites.google.com/site/highnorthinc
> mailto: blueroofmusic@gmail.com
> PO Box 221  Grand Marais, MI 49839  906-494-2434
>
>
>
>
>
> On Fri, Jul 12, 2019 at 10:38 PM Benjamin Kaduk <kaduk@mit.edu> wrote:
>
> Cherry-picking one point...
>
> On Mon, Jul 08, 2019 at 02:44:56PM +0000, Nicolae Paladi wrote:
> > Hello,
> >
> > Some comments on draft-birkholz-rats-architecture-01<
> https://tools.ietf.org/html/draft-birkholz-rats-architecture-01>
> >
> [...]
> > 7.1.1<
> https://tools.ietf.org/html/draft-birkholz-rats-architecture-01#section-7.1.1>.
> How the RATS Architecture Addresses the Lying Endpoint Problem
> >
> >
> >
> >
> >
> >  RATS imply the involvement of at least two players (roles) who seek
> >    to overcome the lying endpoint problem.  The Verifier wishes to
> >    consume application data supplied by a Computing Context.  But before
> >    application data is consumed, the Verifier obtains Attestation
> >    Evidence about the Computing Context to assess likelihood of poisoned
> >    data due to endpoint compromise or failure.  Remote Attestation
> >    argues that a systems's integrity characteristics should not be
> >    believed until rationale for believability is presented to the
> >    relying party seeking to interact with the system.
> >
> > “Likelihood” implies a probabilistic approach to trustworthiness (e.g.
> 42% likelihood of poisoned data”). Is that really feasible? And if so, is
> it actually of any use? IMO trustworthiness is binary (“trustworthy or not
> trustworthy”), or binary and conditional/contextual (“trustworthy if used
> for certain actions”).
>
> My personal thinking here is along the lines of "this data makes me
> confident that only someone who was able to subvert my supply chain and
> surreptitiously replace the TPM chip in the sealed device delivered to me
> would be able to forge the attestation evidence; I don't think I'm the
> target of such an attack, so there's a low likeliyhood of endpoint
> compromise".  Or, as James Mickens put it more glibly in
> https://www.usenix.org/system/files/1311_05-08_mickens.pdf there's a
> Mossad/not-Mossad distinction in the potential attackers, and if the Mossad
> is a threat, you're gonna be Mossad'ed upon no matter what you do.
>
> -Ben
>
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats
>
>