[Rats] Re: Security considerations of remote attestation (RFC9334)

["Smith, Ned" <[e-mail]>]

> I am pretty sure that nobody intended to start an axiomatic proof
I think this is true.

I think Usama is trying to map the various hand-wavey statements (that weren’t trying to be expressed in a way that makes sense for formal methods) into something that is meaningful to formal methods. But maybe Usama / others who are familiar with formal methods could show their work so to speak and explain where the various statements fall apart, but more importantly, what would a statement look like that is useful?

-Ned

On 1/27/25, 02:29, "Henk Birkholz" <[e-mail]> wrote:

Hi Usama,

of course I might be wrong, but I feel pretty confident saying that Dave
and Ned meant:

"if you have an authentication procedure in Internet protocols, in
principle you can augment that with remote attestation."

I am pretty sure that nobody intended to start an axiomatic proof with
that. Dave and/or Ned, please tell me, if I am wrong.


Viele Grüße,

Henk

On 24.01.25 20:03, Muhammad Usama Sardar wrote:
> Sorry but mathematically the three statements are quite different.
> Please see inline.
>
> On 24.01.25 18:38, Henk Birkholz wrote:
>> Hi Usama,
>>
>> the text you quote is me paraphrasing Dave who was quoted by Ned
>> recently.
>>
>> As reference:
>>
>> A quote from Dave here (for quote attribution):
>>> https://mailarchive.ietf.org/arch/msg/rats/5343t-tb2Fam-i663H1kh5oQuMk/
>>
> Dave says "Every authentication use case is an attestation use case."
>> A quote from Ned where he restated Dave:
>>> https://mailarchive.ietf.org/arch/msg/rats/5UUvmi8lHLuyq4fthLK1MJO41YM
>>
>
> Ned says: "Dave Thaler observed at the outset of RATS that every authentication use case is potentially also an attestation use case."
>
> With "potentially", this is a much weaker statement than what Dave
> originally said. If you follow the responses, I already disagreed to
> that as well. [1]
>
>> A quote from Kathleen where she disagreed with Dave's statement:
>>> https://mailarchive.ietf.org/arch/msg/rats/pH77KM4gCHZ7_DENXPhoKWnL5NI
>>
> And your paraphrasing
>
>  > "every authentication procedure can be augmented with a remote
> attestation procedure"
>
> is yet quite different from above 2 statements, showing that the two
> procedures are kind of complementary rather than one being stronger than
> the other.
>
> [1] https://mailarchive.ietf.org/arch/msg/rats/Hkajhpd4PI1y2l-VL6jgvBt4__g/
>
>
>
>
> _______________________________________________
> RATS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

_______________________________________________
RATS mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]