Re: [Rats] challenges of building dependant specifications against Internet-Drafts -- a way forward for EAT

[Giridhar Mandyam <[e-mail]>]

Thanks Michael/Hannes for moving this discussion along, and to Laurence for the solid proposal.  I can confirm that from a FIDO perspective, this proposal is acceptable.

-Giri Mandyam

From: RATS <[e-mail]> On Behalf Of Simon Frost
Sent: Thursday, December 10, 2020 10:11 AM
To: Laurence Lundblade <[e-mail]>om>; Michael Richardson <[e-mail]>ca>; Nancy Cam-Winget (ncamwing) <ncamwing=[e-mail]>rg>; Kathleen Moriarty <[e-mail]>om>; Smith, Ned <[e-mail]>
Cc: [e-mail]
Subject: Re: [Rats] challenges of building dependant specifications against Internet-Drafts -- a way forward for EAT

I can confirm approval from the Arm team to register these standard claims.

Thanks
Simon

From: Laurence Lundblade <[e-mail]<mailto:[e-mail]>>
Sent: 04 December 2020 19:57
To: Michael Richardson <[e-mail]<mailto:[e-mail]>>; Nancy Cam-Winget (ncamwing) <ncamwing=[e-mail]<mailto:ncamwing=[e-mail]>>; Kathleen Moriarty <[e-mail]<mailto:[e-mail]>>; Smith, Ned <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: Re: [Rats] challenges of building dependant specifications against Internet-Drafts -- a way forward for EAT

So I read RFC 7120 which is super clear and exactly what is needed. It lines up with my third proposal. We will ask IANA to pre-register claims in the Standards Action space of the CWT registry and also in the JWT registry. Or rather per the 7120, the WG chairs determine consensus here, then will ask the AD(s) and then ask IANA.

Is there consensus on pre-registration of these?

Name      Description         CWT     JWT                     Type
nonce     Nonce               10      <already registered>    byte string
ueid      Universal Entity ID 11      ueid                    byte string
oemid     OEM ID              13      oemid                   byte string
seclevel  Security Level      14      seclevel                integer
secboot   Secure boot         15      secboot                 integer
dbgstat   Debug status        16      dbgstat                 integer
location  Location            17      location                map
submods   Submodules Section  20      submods                 map

These have all been in the EAT document for a long time and are described well in draft-ietf-rats-eat-06. They are fairly well understood and have either no open issues or only small open issues in GitHub against them. They include the most essential claims (nonce, ueid, oemid & submods) to implement an EAT.

I have chosen not to ask for the others because I don’t think they are as essential or as well understood yet and thus don’t meet the criteria in RFC 7120.

CWT numbers aren’t contiguous so as to line up with examples that have been in the EAT draft for a while. I’ve shortened the JWT claims keys to less than 8 per RFC 7519.

If approved and registered, we’ll quickly publish a new EAT draft.

LL





On Nov 30, 2020, at 3:16 PM, Michael Richardson <[e-mail]<mailto:[e-mail]>> wrote:


Laurence Lundblade <[e-mail]<mailto:[e-mail]>> wrote:
The trouble is that I think many claims should be in the Standards
Action range (-255 to 255).  For example, nonce, ueid, submods section,
location, CoSWID and probably a few others should be in the standard
space. If I were IANA I would hesitate to register these in the
Standards Action range until the EAT document is further along.

The WG can ask for Early Allocation.
It should do it immediately, so that the Expert will provided feedback immediately.

It also seems poor practice to unilaterally pre-assign Standards Action
range claims in an EAT draft and then use them in a bunch of
implementations. Those numbers could be assigned to some one else
before EAT is an RFC.

You can do that if a registry you are just creating.
But, yes, you can't do that if you are using CWT.

Register them in the Specification Required space (255 to 65535) once
and for all. That will result in 3-byte map labels rather than 1-byte
map labels, but there’s no transition.

Finally, a third proposal:

Maybe we can convince IANA to pre-register a small clear set in the
standard space? Perhaps just nonce and UEID.

Please go read RFC7120.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]<mailto:[e-mail]>  http://www.sandelman.ca/        |   ruby on rails    [

_______________________________________________
RATS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/rats

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.