Re: [Rats] [ietf-rats-wg/eat] Definition and usage of the term 'entity' (#16)

["Smith, Ned" <[e-mail]>]

See inline [nms]

On 10/4/19, 12:17 PM, "Kathleen Moriarty" <[e-mail]<mailto:[e-mail]>> wrote:



On Fri, Oct 4, 2019 at 1:56 PM Smith, Ned <[e-mail]<mailto:[e-mail]>> wrote:
The architecture defines:

· Entity:  a user, organization, device or computing environment.

· Principal:  an Entity that implements RATS Roles and creates provable Claims or Attestation Results (see [ABLP] and [Lampson2007]).

· Attesting Computing Environment:  a Computing Environment capable of monitoring and attesting a target Computing Environment.

· Attested Computing Environment:  a target Computing Environment that is monitored and attested by an Attesting Computing Environment.

The attested computing environment is the subject of attestation which clearly is creating provable claims.

The ‘attested’ environment may be less clearly a Principal. At one point the list suggested the architecture should define a term “target of attestation” or “attestation target” (or something similar). The term “attested computing environment” seems close to this. Do we think the attested environment is semantically the same as “subject of the attestation”?

Using Lampson’s definition of Principal, an expression of attributes (aka claims) is itself a principal.

There are lots of cases where ‘entity’ is used to refer to organizations and users (see https://csrc.nist.gov/glossary/term/entity ). Given the broad use of the term to mean: a “user, organization, device or process” it might not make sense for RATs to change its scope. The RATS Arch used the term “computing environment” instead of process because not every computing environment has an operating system.

An “attested computing environment” is clearly intended to be a “computing environment” and hence is an Entity according to the arch draft.

And from a review of the EAT draft (again), I am reading this as the attestation based on the installed code with the attestation performed at boot to match what was installed.  This would verify that the code was what the system administrator installed and configured.  As opposed to code being attested by the creator, which might be done with the same format, but would assure the code was as he creator expected.

I'm asking about this clarification in light of supply chain and the flow document:
https://datatracker.ietf.org/doc/draft-fedorkow-rats-network-device-attestation/?include_text=1

Does the supply chain use case hold in these definitions or is there some reason why we might not care about attestations on code from the originator that might include code it relies upon when chained attestations are considered?  This would expand out the definition of entity as well.
[nms] The RATS architecture describes the “attestations on code from the originator” as “Endorsements” from “Asserters”. The architecture tries to avoid using the term “attestation” in this context as collection of reference values (Endorsements) isn’t the same as providing proof and evidence (and the charter ruled this out of scope for now). The NIST definition of Entity includes supply chain entities (aka Asserters).

If the RATS charter were updated to allow definition of “Endorsements” it might make sense to propose using JWT/CWT as a binding. The Architecture draft defines endorsements [here] as a specialization of Claims. Claims in Evidence can be semantically linked to claims in Endorsements. This is intentional so that verification is less susceptible to semantic misdirection.
[here]

  *   Endorsements are reference Claims about the environment protecting the Attesters capabilities to create believable Evidence (e.g. the type of protection for an attestation key).  It answers the question "why Evidence is believable".


If the EAT draft’s use of entity is semantically equal to the architecture draft use of “attested computing environment” then possibly it makes sense for the EAT draft to begin using this term instead?

The architecture draft potentially could be more clear as to whether an “Attested computing environment” is both an entity and a principal or just an entity. It seems clear that an “attesting computing environment” is a Principal.

Is EAT limited to 'attested computing environments' or a broader definition of entity?

Kathleen


Ned

On 10/4/19, 10:27 AM, "Laurence Lundblade" <[e-mail]<mailto:[e-mail]>> wrote:


EAT and Architecture are absolutely NOT aligned on the term entity. See my recent email comments on the architecture document.

My basis for closure is that the architecture document will define some term that is the is used to refer to the subject of the attestation. Maybe we shouldn't close this until the architecture doc starts tracking issues formally.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<https://github.com/ietf-rats-wg/eat/issues/16?email_source=notifications&email_token=ABPMCSG6S47KPNKHPDRK3TDQM54ILA5CNFSM4ID7KXSKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEAMLBKY#issuecomment-538489003>, or mute the thread<https://github.com/notifications/unsubscribe-auth/ABPMCSAPK5BFFBWNGO2SLZTQM54ILANCNFSM4ID7KXSA>.
_______________________________________________
RATS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/rats


--

Best regards,
Kathleen