IETF Logo Mail Archive

Re: [Rats] EAT Review Comments

Hannes Tschofenig <Hannes.Tschofenig@arm.com> Fri, 10 December 2021 07:57 UTC

Return-Path: <Hannes.Tschofenig@arm.com>
X-Original-To: rats@ietfa.amsl.com
Delivered-To: rats@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4F7F3A09CF for <rats@ietfa.amsl.com>; Thu, 9 Dec 2021 23:57:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=4sw6JUjr; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=4sw6JUjr
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2KX3rvaaHg_T for <rats@ietfa.amsl.com>; Thu, 9 Dec 2021 23:57:56 -0800 (PST)
Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60070.outbound.protection.outlook.com [40.107.6.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 339753A09D0 for <rats@ietf.org>; Thu, 9 Dec 2021 23:57:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HRH3n2m7NwB292sWVrVxlrraUamrpAzdbAOFZMe8IeQ=; b=4sw6JUjrXQjtQKCi4qQADjOBkakr7hdvAPKnX8UycZoDhkZigM7KYhewTd9dkdB8v6tmwb3x7IinA8tovFfM47Iv2mW6f5dW8yG6iLDOSVOtbpUrxP9i75jtw/2iRcghaNeiQs5cg08G+lhuPAXCs5oklGUX38faO8Ls7bEr6uQ=
Received: from DU2PR04CA0279.eurprd04.prod.outlook.com (2603:10a6:10:28c::14) by AM9PR08MB7276.eurprd08.prod.outlook.com (2603:10a6:20b:437::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4755.21; Fri, 10 Dec 2021 07:57:51 +0000
Received: from DB5EUR03FT022.eop-EUR03.prod.protection.outlook.com (2603:10a6:10:28c:cafe::be) by DU2PR04CA0279.outlook.office365.com (2603:10a6:10:28c::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4778.12 via Frontend Transport; Fri, 10 Dec 2021 07:57:51 +0000
X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;dmarc=pass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by DB5EUR03FT022.mail.protection.outlook.com (10.152.20.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4778.12 via Frontend Transport; Fri, 10 Dec 2021 07:57:50 +0000
Received: ("Tessian outbound de6049708a0a:v110"); Fri, 10 Dec 2021 07:57:50 +0000
X-CR-MTA-TID: 64aa7808
Received: from dfa8bce5017d.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 4FE5CDD8-06D8-4396-A198-F10415E72B58.1; Fri, 10 Dec 2021 07:57:43 +0000
Received: from EUR03-AM5-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id dfa8bce5017d.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Fri, 10 Dec 2021 07:57:43 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UeoKFG2b5AfxgIn5U9WkkSBsUlm/QApbdq1Wj/+xceN6tH9J5DmIHzehV6PWcy15GniPx1r+If30f+sVN09tZBrJtH6rwi6YZ+HQP/5Ex0YA18HEnMjHSQ0i+C4hgBbU4H8vM6KRJImoUVZDxzFp3Krin1vHz8rScuglJCSI9jEcN0ZU00E2L6UQ3sdsSyV2++wHXNz6mwZs2vlUfVGOVW7QDaj9zwP6yOLfR9fnvBWCqhI0X3BlVi5zJ90IjSfJH9eMBWTCklDQ850DZVyRKad202QA2SbdIRjGx9FBEJkr4JDbGDtOb7JBXGt0lFre5jwPruqKtgngim/EWw8ddQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=HRH3n2m7NwB292sWVrVxlrraUamrpAzdbAOFZMe8IeQ=; b=ee7tdd5AMdwhveeVb1B+DuIaODxkFN0MOLTVIn4gD31MoGBYd2iQdFHdDjTIFuswcueHgXBXAAnrlfHAefG0GfAmFw79qPrzQ0xlTJAk+qLCMChoop1C3dYpEw60N92yc7HNio6HbMENfyyzQz+63HtPMXaFaEwl0HztAHgQmlRt3mixLfnfI/WTWCG/745k0E/IbmfIF14rcpT+foWtqKsyqy7WFKzmrPSg/JZM+8b9qt0gMkcq5DtyT1fkq1K/urxdDy9vNQ2OrGctbpLPcs7fKgpmc10w9y0R4F+b2W8uSGbK0PR4xndoBoYP7eiKseCRyN2YMAV3iuaaLbU+Hw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HRH3n2m7NwB292sWVrVxlrraUamrpAzdbAOFZMe8IeQ=; b=4sw6JUjrXQjtQKCi4qQADjOBkakr7hdvAPKnX8UycZoDhkZigM7KYhewTd9dkdB8v6tmwb3x7IinA8tovFfM47Iv2mW6f5dW8yG6iLDOSVOtbpUrxP9i75jtw/2iRcghaNeiQs5cg08G+lhuPAXCs5oklGUX38faO8Ls7bEr6uQ=
Received: from DBBPR08MB5915.eurprd08.prod.outlook.com (2603:10a6:10:20d::17) by DB9PR08MB6908.eurprd08.prod.outlook.com (2603:10a6:10:2a0::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4778.14; Fri, 10 Dec 2021 07:57:42 +0000
Received: from DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::dd96:eb7:b263:b290]) by DBBPR08MB5915.eurprd08.prod.outlook.com ([fe80::dd96:eb7:b263:b290%4]) with mapi id 15.20.4778.015; Fri, 10 Dec 2021 07:57:41 +0000
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
To: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>, Laurence Lundblade <lgl@island-resort.com>
CC: "rats@ietf.org" <rats@ietf.org>
Thread-Topic: [Rats] EAT Review Comments
Thread-Index: AdfrXtD82TqKBMPPTvW26/ecfE3BXwAVcq+AAExCBMAALQl5AAAATmAQ
Date: Fri, 10 Dec 2021 07:57:41 +0000
Message-ID: <DBBPR08MB59152EA489927AC3C1E59B69FA719@DBBPR08MB5915.eurprd08.prod.outlook.com>
References: <DBBPR08MB59150EEE386E675005A52124FA6E9@DBBPR08MB5915.eurprd08.prod.outlook.com> <B81765CF-8515-440B-A021-977FCD59D5E2@island-resort.com> <DBBPR08MB5915DD8BAA394E7D665E4C7DFA709@DBBPR08MB5915.eurprd08.prod.outlook.com> <7e8275a1-10ce-bff8-9252-8c0d32d3e395@sit.fraunhofer.de>
In-Reply-To: <7e8275a1-10ce-bff8-9252-8c0d32d3e395@sit.fraunhofer.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ts-tracking-id: 8E4CDA40A89C5341B839DD2F8A888B3F.0
x-checkrecipientchecked: true
Authentication-Results-Original: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=arm.com;
X-MS-Office365-Filtering-Correlation-Id: aef1d96e-db4d-4d0a-b5f8-08d9bbb2c38a
x-ms-traffictypediagnostic: DB9PR08MB6908:EE_|DB5EUR03FT022:EE_|AM9PR08MB7276:EE_
X-Microsoft-Antispam-PRVS: <AM9PR08MB72767D767652F501EC5A9C75FA719@AM9PR08MB7276.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:8882;OLM:9508;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: lwQrVe4tjyt9v6o1I178QtCo2nmkkukl/I+Vn8/qegclCXX14QkE/TorphT9Da/a0HIIKe1KI7ouZGzHIm1vfbD+qbCxkx47pNOrwGo8wHftVfB8PTp1MIDGco3BEtk58Imvd+qIiYhjSmXKfxn9G0QKH4auip68a4nN1hBne/6ve3LigSu9NImm7gyOCpG8pd0FhKSXSdQU7uIGfKJOYmk/rErX/okM6JHI7+vX2Wq85BjoBG6bMmWKkb9DHysDEx3zV82b7qFTt4B3L46T6lwNDFWKByP8TLENlJWgrax4MYSShkj672acWjQ8YMIukCST2l9yw5zAXywK1ZpyYamUb34YkHofFEw72m2G/mQ3uIlnt75FRNEVMZFS/lA9BXKZ7ydtBEL22s35tyVIp8aP/WzVW8OOi98vVhL2Kre4R3mIaR3h5AQVCsUHC8W1nkEzT5usg60B28HpNMr/Egjhwy73tu7iJF1bKp2omG/SHQun1siBh6Hf/684iQimI2LplTXLZaGNPAslxz7awNo7y1qB27dKF3Css7CwLAZAggecjR+M5Ds0LmSS8bB8EKFrka3s76CAs9+4ZzAQpUGtduwnJJytlvoqytocSilnDSBL0gkbCMKoMyAoZ8uwKobKWKxTNvRvXiudWCuzlGvgKqzD287Rhybtm22OvPuyb9fpTAabSq4IWclF1WnYLD9Q4PIv38egdCV30SylCA==
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DBBPR08MB5915.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(55016003)(52536014)(122000001)(7696005)(71200400001)(5660300002)(8676002)(86362001)(38070700005)(186003)(38100700002)(9686003)(6506007)(4326008)(76116006)(2906002)(8936002)(508600001)(316002)(33656002)(66946007)(26005)(66556008)(64756008)(66446008)(83380400001)(66476007)(110136005); DIR:OUT; SFP:1101;
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB6908
Original-Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR03FT022.eop-EUR03.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id-Prvs: 1f4e1147-d3c2-4377-068a-08d9bbb2be38
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: EuBCO/gyC/VyB1BwR7DtopqfzZzvKNk10Fq1B3nHww06ea/0++pk5ubPGfEawYJJlVbC8r0RqzmwLOKxeAgSMK/A4Hw01bbhZclfszN9NjDQWTjo7KRg/Mw8/mz0KQttIpZv2ARJmSd8U17w9bmhLa3jbCJ4oTgFWoFDf4e01RwJ257v7Lp0Yl/Jzqc7sojSnDlhsP67KhGihqT3UorF430Fmh+2DVIe7jzM5Zs3fWVGd2he16a6CYV3YBs66AmDXMpYyTAcQb2z636MT+Ue3yD0WfyzNaUfwtSpLW5qefN/7uQ7x/HqDikJFqSMc75SNpgD+aK6ftQOF1e2NSLoy+oqnAaAJn5FufIdvkDbyDJs/Ob64eD+kjw1S+nZDZobNRhmQ47fJ67A4MXL3GPMHWxfQiFZo433PdewW3xBs8G9T5gTR8qlqwSIslIkIIlL0Gv4JohJsb4omrrEBeVR3C3RcVp+20qY3B5lK5yYgtWbM6LbWZst4KMdYL5o0uG/tq3V6K88e7BpbFsWHLgDTELzjTPjPb+pGeGPMJz0AsMcTdXxo/35ZeOp1/43panTHMVlS2VRHt39WLGFFciK8ZXN81GMeFEHqbPRTibZfbgybNOs6w9RruNSg/MNX9c/6VRwWXdkb+KektB3AF6VppoAEU/KxYfOvj0iNmy8qBJo2BHR3Z3Mhm95lG//lT7AUCeeyXg4989bzw+XoiZws9jxkw8iPXWCGyIJEwYAwOA9KcZDE1ir7VUIAOGVT4dmkS14CJ6svU4pWcAfKIdjQA==
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(36840700001)(46966006)(40470700001)(40460700001)(316002)(6506007)(36860700001)(81166007)(7696005)(356005)(2906002)(86362001)(82310400004)(55016003)(336012)(508600001)(70586007)(8676002)(4326008)(9686003)(26005)(33656002)(8936002)(110136005)(47076005)(186003)(83380400001)(70206006)(52536014)(5660300002); DIR:OUT; SFP:1101;
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Dec 2021 07:57:50.8786 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: aef1d96e-db4d-4d0a-b5f8-08d9bbb2c38a
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-AuthSource: DB5EUR03FT022.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR08MB7276
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/_FAOq25jKU7F6grYdmIqp5uIn4U>
Subject: Re: [Rats] EAT Review Comments
X-BeenThere: rats@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Remote ATtestation procedureS <rats.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rats>, <mailto:rats-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rats/>
List-Post: <mailto:rats@ietf.org>
List-Help: <mailto:rats-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rats>, <mailto:rats-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 10 Dec 2021 07:58:00 -0000

Hi Henk,

You write:

> My biggest point of concern is the scope creep into JWT.

> EAT was intended to be a CWT (more on that detail below). The
> implementation complexity of including JWT now is kind of mind-boggling.
> I have been for a while and will continue to be in strong support of
> moving JSON encoding related normative text out of the EAT core doucment
> to supplemental EAT document.

> Fundamentally, I am still opposed to EAT being a CWT. It allows to
> include any kind of CWT claims from an increasingly growing CWT Claims
> registry. I am allowed to include a nonce and a cnonce Claim
> simultaneous due to that. Or simply mix an exi Claim in. How shall an
> implementation act on that? That is a valid EAT composition. Is "ignore
> what you do not understand" the strategy here? That is not a really
> useful approach, if your goal is to establish an interoperable way to
> assert trustworthiness. I'd very much prefer a better scoped usage
> scenario for EAT for RATS by making an EAT something more specialized
> than a CWT (on the CBOR tag level). Maybe someone can explain to my why
> this is not an implementer's nightmare as I might miss something obvious
> here.

We are long past the point of deciding that an EAT is a CWT with special claims. Companies have spend a lot of resources implementing it that way. Practically, there is no problem since you will not randomly add claims to an EAT. As stated in the draft, a profile needs to determine what claims must be present and what to do with optional claims. Then, this is not an issue at all.

Can you have a look at how this works in existing implementations and why this is not a problem at all.

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

v2.39.1 | Report a Bug | By Email | System Status