Re: [Rats] RATS use cases review

[Jessica Fitzgerald-McKay <[e-mail]>]

Michael,

That's fine, we can back-burner my suggestions until we a) finish
collecting all the use cases we want to include, and b) are ready to
address what claims are necessary to fulfill each use case.

As a potential "end user" of attestation standards, I want RATS to be able
to answer the question of whether or not I can trust a device on my
network. And, the answer to that question will depend a lot on what kind of
claims I can get and verify from the device. But I can see that being
outside the scope of the style use case document we are writing right now.

Thanks,
Jess

On Mon, Oct 7, 2019 at 8:35 AM Michael Richardson <[e-mail]>
wrote:

>
> Jessica Fitzgerald-McKay <[e-mail]> wrote:
>     > I took a careful read of the use cases document. I notices that
>     > Sections 5.1 - 5.6.2 each are variations on the themes of attesting
> to
>     > a device's:
>
> ...
>
>     > In this light, the right approach is to organize the document around
>     > the information that is being attested (the above list, plus end-user
>     > information (section 5.6.3), geographic attestation (section 5.7),
> and
>     > connectivity attestation (section 5.8)), with perhaps additional
>     > information on how these types of attestation can be combined in
>     > support of things like, say, critical infrastructure security, etc.
>
>     > What does the work group think?
>
> This thread didn't go very far, unfortunately.
> I've spent quite a few hours since thinking about your suggestion.
> In many ways, the Thursday morning side-meeting went in the other
> direction,
> providing new situations which differed from existing use cases only in the
> severity.
>
> As I explain in another email, I have added a set of attributes to each use
> case, being;
>        - Who will use it:
>        - Attestation type: (passport or background check)
>        - Attesting Party
>        - Relying Party
>        - Claims used
>
> The claims used are all TBD at this point.
>
> As I said at the meeting in March, I don't want to do ontology up-front,
> but
> rather to just collect all sorts of things, even if they seem to overlap.
> Some of Guy's suggestions (in a PDF he sent me) also related to refactoring
> some use cases, and while I actually agree with his suggestion, I still
> want
> to avoid that.
>
> --
> ]               Never tell me the odds!                 | ipv6 mesh
> networks [
> ]   Michael Richardson, Sandelman Software Works        | network
> architect  [
> ]     [e-mail]  http://www.sandelman.ca/        |   ruby on
> rails    [
>
>
>