Re: [Rats] draft-ounsworth-rats-x509-evidence-00

[Henk Birkholz <[e-mail]>]

Well....

they are self-assertions included in Evidence (as roots of trusts cannot 
produce Evidence about themselves).

Theses assertions about roots of trusts will have to be checked (I am 
deliberately not writing appraised) by a Verifier, to see if they match 
the capabilities of said root of trust's Endorsements.

But I agree, these Claims can appear in Evidence.


On 09.11.23 14:26, [e-mail] wrote:
> Hi Jeremy
> 
> We briefly talked about the relationship between the DLOA claim and the 
> newly defined FIPS claim in the draft.
> 
> The difference is that DLOAs are essentially endorsements and the newly 
> defined FIPS claim is evidence. The idea is that the device performs a 
> self-test to compute the value.
> 
> Ciao
> 
> Hannes
> 
> *From:*Jeremy O'Donoghue <[e-mail]>
> *Sent:* Donnerstag, 9. November 2023 14:08
> *To:* [e-mail]; 'lgl island-resort.com' 
> <[e-mail]>; 'rats' <[e-mail]>
> *Subject:* Re: [Rats] draft-ounsworth-rats-x509-evidence-00
> 
> Hi Laurence,
> 
> The existing DLOAs claim is one way that FIPS and/or CC claims could be 
> transmitted (since that is exactly what it was defined for).
> 
> Jeremy
> 
> On 09/11/2023, 15:06, "RATS" <[e-mail] 
> <mailto:[e-mail]>> wrote:
> 
> *WARNING:*This email originated from outside of Qualcomm. Please be wary 
> of any links or attachments, and do not enable macros.
> 
> Hi Laurence,
> 
> The charter says:
> 
> “
> 
> Standardize data models that implement and secure the defined 
> information model (e.g., CBOR Web Token structures [RFC8392 
> <https://datatracker.ietf.org/doc/rfc8392/>], JSON Web Token structures 
> [RFC7519 <https://datatracker.ietf.org/doc/rfc7519/>]).
> 
> “
> 
> CWT and JWT are mentioned as examples. The group already works on 
> another evidence format, namely the TPM-based stuff.
> 
> I would say that the document fits nicely within the scope of the charter.
> 
> Regarding the document split. I am open to discussions about your 
> suggestion, which assumes adoption in the group.
> 
> Ciao
> 
> Hannes
> 
> *From:*RATS <[e-mail] <mailto:[e-mail]>> *On 
> Behalf Of *lgl island-resort.com
> *Sent:* Donnerstag, 9. November 2023 13:59
> *To:* rats <[e-mail] <mailto:[e-mail]>>
> *Subject:* [Rats] draft-ounsworth-rats-x509-evidence-00
> 
> I think it might be better to split this into two drafts.
> 
>     First, define how to put CWT/JWT claims into ASN.1 and make an X.509
>     attestation token.
> 
>     Second, define the FIPS and CC status claims for CBOR, JSON and ASN.1.
> 
> I wish we didn’t have to do the first, but understand that we might. 
> Note that the RATS charter says we work on CBOR and JSON. There was a 
> little discussion about ASN.1 back in the early days and we certainly 
> put it off back then. There was also YANG discussion. Search the RATS 
> mail archive for ASN.1.
> 
> I’m much more interested in the FIPS and CC status claims. I would like 
> to define them for CBOR, JSON and ASN.1. If they are booleans this is 
> trivial. The would get registered in the CWT and JWT IANA registries.
> 
> One of the reasons I’d like to define them for CBOR and JSON is so 
> there’s a known and accepted way to translate their ASN.1 claims into JSON.
> 
> Also, the X.509 definition should be for Attestation Results as well as 
> Evidence. There’s no reason to restrict it and there’s no work to allow 
> use as Attestation Results.
> 
> LL
> 
> (sent incorrectly the first time only to the rats-chairs; meant it for 
> the list)
> 
> 
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats