Re: [Rats] Attestation Results for Connectivity (was RE: RATS Digest, Vol 35, Issue 24)

["Eric Voit (evoit)" <[e-mail]>]

From: Dave Thaler, April 27, 2021 9:56 AM



[.]

[DT9]: Does this mean that the Verifier can authenticate both the hardware
and the firmware? 
[EV9]: In draft-voit-rats-trustworthy-path-routing, we broke out hardware
and firmware.  However I was unable to find a real case where a customer
might be good with the hardware being ok, but they were not ok with the
firmware being not ok.   So from the perspective of the Relying Party +
Verifier B, if Verifier A finds any issue here, then flag it.   In general,
it is useful to collapse failure states where the Relying Party + Verifier
will take the same action no matter what.

 

>From most practical perspectives F/W==H/W as the latter comes with implicit
trust

 

Agree.  This is why (from the perspective of the Relying Party) it is safe
to collapse them when we are simply making an affirming or detracting claim.


 

Taking that argument, it would imply the same for all layers of the
evidence.

E.g., the bootloader, the OS kernel, the application communicating with the
Relying Party.
So why would you stop at firmware?

 

<Eric> I think it is up to the Relying Party to determine what elements they
might actually choose to differentiate.  Initially with
draft-voit-rats-trustworthy-path-routing, I had separated hardware from
firmware.  But I simply found nobody who had an Appraisal Policy for
Attestation Results who ever wanted a differentiating level of granularity
as part of the link layer establishment phase.     Per your comment below,
the draft progresses, then we absolutely should explore the right
granularity here.  

 

Also a separate point: the TAM in TEEP is an example of a Relying Party that
needs to know, if the software/firmware is not in compliance, which
component(s) are the ones out of compliance, since it's the remediation
server that needs to force an update of said components.

 

<Eric> I am good with whatever breakout the WG is appropriate.   I do think
we should differentiate between admission control actions which are relevant
for the link, and remediation efforts.  The remediation server will likely
need a lot more detail than we would want to continuously send over EAP.

 

Eric

 

Dave