Re: [Rats] I-D Action: draft-xia-rats-pubsub-model-01.txt

["Eric Voit (evoit)" <[e-mail]>]

Hi Frank,

> From: Xialiang (Frank, Network Standard & Patent Dept), Wednesday, October 23, 2019 11:32 PM
> To: Eric Voit (evoit) <[e-mail]>
> 
> Hi Eric,
> Thank you for good comments!
> 
> Please see inline:
> 
> -----邮件原件-----
> 发件人: RATS [mailto:[e-mail]] 代表 Eric Voit (evoit)
> 发送时间: 2019年10月24日 5:38
> 收件人: Xialiang (Frank, Network Standard & Patent Dept)
> <[e-mail]>; [e-mail]
> 主题: Re: [Rats] I-D Action: draft-xia-rats-pubsub-model-01.txt
> 
> Hi Frank,
> 
> A few quick thoughts.
> 
> (1) The best way to deliver a nonce is to augment the <establish-
> subscription> RPC from RFC8639.  This requires just one object update.   To
> make this work effectively, we would need to expand the draft-birkholz-rats-
> basic-yang-module to also include data nodes for PCR state, rather than just
> the current RPCs.  BTW: If we base the data nodes on existing groupings, this
> actually is not a big change.
> [Frank]: I don't understand your point exactly. Since nonce for freshness
> checking and protecting against replay attack is used by a randomly
> generating and varied in each notification message way, I think current
> dynamic subscription or configured subscription both need some extension
> for achieving this goal. And what is the point of your next statement of
> including data nodes for PCR state rather than just the current RPCs? Do you
> mean by this way the PCR state can be acquired by netconf push solution?

Yes.  One way to do this would be sending a TUDA Sync token in the RPC response, or the subscription-started notification.

Eric
 
> (2) Figure 2 & 3 mix the context of both stream subscriptions (RFC8639) and
> datastore subscriptions (RFC8641).  What you want is an RFC8641
> subscription to draft-birkholz-rats-basic-yang-module, and an independent
> RFC8639 subscription to event streams like pcr-trust-evidence.  The results of
> these subscriptions can be independently correlated at the verifier.
> [Frank]: You are right. Figure 2 is an example of using configured
> subscriptions to acquire the on-change state of PCR since they are very
> important event for RATS protocol. Figure 3 is an example of using netconf
> push (datastore subscriptions) to periodically get bios-log-trust-evidence for
> normal checking task. Figure 4 is an example of using the pre-defined events
> as the update trigger according the relatively new ECA netconf method. But I
> generally agree with your idea of their relation.
> 
> (3) Interestingly, the need to subscribe on-change to the values of individual
> PCRs (rather than a hash across multiple PCRs) is a perfect example of why a
> router will need to do pre-processing and summarization of signed
> information coming off a TPM.  This is in contrast to people who believe that
> a cryptoprocessor's raw feed is sufficient for all off-router applications.  A
> raw feed from a TPM is simply not sufficent.
> 
> Eric
> 
> > From: Xialiang (Frank, Network Standard & Patent Dept), October 21,
> > 2019 9:13 AM
> >
> > Hi,
> > We submit a new draft describing a method of using the netconf pub/sub
> > model in the RATS interaction procedure, to increase its flexibility,
> > efficiency and scalability.
> >
> > Warmly welcome your comments!
> >
> > B.R.
> > Frank
> >
> >
> > -----邮件原件-----
> > 发件人: I-D-Announce [mailto:[e-mail]] 代表
> > [e-mail]
> > 发送时间: 2019年10月21日 21:09
> > 收件人: [e-mail]
> > 主题: I-D Action: draft-xia-rats-pubsub-model-01.txt
> >
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> >
> >
> >         Title           : Using Netconf Pub/Sub Model for RATS Interaction
> > Procedure
> >         Authors         : Liang Xia (Frank)
> >                           Wei Pan
> > 	Filename        : draft-xia-rats-pubsub-model-01.txt
> > 	Pages           : 14
> > 	Date            : 2019-10-21
> >
> > Abstract:
> >    This draft defines the a new method of using the netconf pub/sub
> >    model in the RATS interaction procedure, to increse its flexibility,
> >    efficiency and scalability.
> >
> >
> > The IETF datatracker status page for this draft is:
> > https://datatracker.ietf.org/doc/draft-xia-rats-pubsub-model/
> >
> > There are also htmlized versions available at:
> > https://tools.ietf.org/html/draft-xia-rats-pubsub-model-01
> > https://datatracker.ietf.org/doc/html/draft-xia-rats-pubsub-model-01
> >
> > A diff from the previous version is available at:
> > https://www.ietf.org/rfcdiff?url2=draft-xia-rats-pubsub-model-01
> >
> >
> > Please note that it may take a couple of minutes from the time of
> > submission until the htmlized version and diff are available at
> tools.ietf.org.
> >
> > Internet-Drafts are also available by anonymous FTP at:
> > ftp://ftp.ietf.org/internet-drafts/
> >
> > _______________________________________________
> > I-D-Announce mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/i-d-announce
> > Internet-Draft directories: http://www.ietf.org/shadow.html or
> > ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> > _______________________________________________
> > RATS mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/rats