Re: [Rats] [Last-Call] Intdir telechat review of draft-ietf-rats-eat-21

["Smith, Ned" <[e-mail]>]

> Acronyms should be spelled out on first use
+1

From: "lgl island-resort.com" <[e-mail]>
Date: Tuesday, September 5, 2023 at 1:05 PM
To: Haoyu Song <[e-mail]>
Cc: "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: Re: [Last-Call] Intdir telechat review of draft-ietf-rats-eat-21
Resent-From: <[e-mail]>
Resent-To: <[e-mail]>, <[e-mail]>, Nancy Cam-Winget <[e-mail]>, <[e-mail]>, <[e-mail]>, <[e-mail]>, Kathleen Moriarty <[e-mail]>, <[e-mail]>, <[e-mail]>
Resent-Date: Tuesday, September 5, 2023 at 1:02 PM

Hi Haoyu,

Quick questions / answers below. Others to follow.

LL



On Sep 5, 2023, at 11:34 AM, Haoyu Song via Datatracker <[e-mail]> wrote:

Reviewer: Haoyu Song
Review result: Ready with Issues

This review is done as requested by the Internet Area Directorate. Document
editors and WG chairs should treat these comments just like any other last-call
comments.

The document needs an introduction or references to the background and related
work pertaining to the problem domain. Without understanding the status quo and
the state-of-the-art solutions, it’s difficult to evaluate what the proposed
framework has improved and the value of it compared to the existing solutions.

Was the RATS architecture document, RFC 9334<https://datatracker.ietf.org/doc/html/rfc9334>, insufficient for the background you were seeking? It is referenced early in the document to provide this background.



More than 30% of the document content is in the appendix. Are these topics
considered non-essential and can be ignored? How do the authors plan to treat
these materials in the published RFC?

We put the appendices in so they will be published with the document. We think they are all useful. Note that RFC 8446, TLS 1.3 has a similar proportion.


P8 “The claims set includes a nonce or some other means to assure freshness.”
Should these means be explained in more detail? The concept and mechanisms are
not obvious to readers.

The document supplies a set of claims and profiles for EAT. As long as EAT is
motivated as necessary in real use cases, I don’t see a reason to block the
advance of this document.

Some editorial suggestions:
Acronyms should be spelled out on first use. It’s better to also provide
references. This applies to all the acronyms throughout the draft (e.g., TEE,
CDDL, COSE, JOSE, ...)

P9 “For example, measurements in evidence may be compared to reference values
[and?] the results of which are represented as a simple pass/fail in
attestation results.”



--
last-call mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/last-call