Re: [Rats] Comments on draft-birkholz-rats-architecture-01

[Laurence Lundblade <[e-mail]>]

> On Jul 15, 2019, at 7:07 AM, Smith, Ned <[e-mail]> wrote:
> 
> I think both perspectives are correct. If the context of evaluation is an access decision then trust is binary. If the context is analytics, logging or risk management then trust is (can be) probabilistic.
>  
> The relying party has the necessary context. The main objective for RATS is to define Attester-Verifier interactions.
>  
> I’m just wondering, for the purposes of RATS architecture, if we need to resolve this question now?


For the EAT claims document, I don’t think there is much of an issue with “trust”. It hardly uses the word.

However the architecture document has a lot of orientation around trusted or not. Here’s some example text from 4.1.3:

   o  Evaluates trustworthiness during manufacturing, supply chain and
      onboarding

   o  Produces trustworthiness assertions applicable to the Attestor
      role

I don’t think the architecture document should be adopted until we resolve how it treats trust.

My fundamental argument is that no notion of trusted/untrusted is possible in our documents. Only the relying party can decide that and they will decide that based on their individual and wildly varying requirements (payments large or small, enterprise access, web site access…).

Further, the notion that an individual implementation can be deemed trustworthy seems flawed. How many HW chip defenses does it require? What strength of cryptography? Is EAL 5 Common Criteria evaluation enough?

LL