Re: [Rats] Same claim in Evidence and Results (was Re: Second attempt at early allocation of CWT Labels (PR #152))

["Eric Voit (evoit)" <[e-mail]>]

Thanks Ned for your last two emails.   

 

I have been trying to track the overall conversation across forks.   I see your comments/questions on the UEID thread as coupled to the thoughts below.  (I.e., "Since scope is defined by the entity that asserts the claims, it would be better to describe claims using terminology that doesn’t assume scope IMHO.")

 

I agree with this sentiment.  For me this set of threads keeps coming back to establishing claim context to the Relying Party.   If the Policy for Attestation Results doesn't simply and unambiguously know the identity/source of a claim, the architectural role making the claim, and the freshness, then we are wasting our time here.   

 

So we need to minimize Relying Party policy language ambiguity.

 

For me, I like separating the names of claims which might come from different architectural roles.   Things are easier for Policy programming on the Relying Party this way.

And we won't suddenly find a claim from a Verifier which now can also come from an Attester.   

 

There are alternatives to doing this with namespaces.  But we no proposals going down this path yet.


Eric

 

> -----Original Message-----

> From: RATS <[e-mail]> On Behalf Of Smith, Ned

> Sent: Tuesday, February 22, 2022 3:31 PM

> To: Laurence Lundblade <[e-mail]>; Henk Birkholz

> <[e-mail]>

> Cc: [e-mail]

> Subject: Re: [Rats] Same claim in Evidence and Results (was Re: Second attempt

> at early allocation of CWT Labels (PR #152))

> 

> I asked for clarification about what attestation roles' perspectives were

> assumed when describing the various claims. This was because there is language

> that suggests Endorser / RVP roles were considered. There is language that

> suggests RP, Verifier and Attester roles are considered too. But it isn't clear that

> all roles are considered for all claims.

> 

> I suggested that if the goal was not to consider all roles for all claims, that the

> claims be described based on a least common denominator assumption. That is,

> only wording that is true for all roles would be included. It is a bit of a trick

> question in that you have to consider all roles in order to know what attributes

> will be common. It also means anything that is specific to a role or nuanced

> would not be included so as to avoid special case descriptions.

> 

> That means, terminology that is aimed at manufacturers, relying party, verifier,

> attester should be removed or clearly identified as informative. My guess is the

> result will be that the CDDL most closely captures normative expression and

> most everything else is informative.

> 

> On 2/22/22, 11:51 AM, "Laurence Lundblade" < <mailto:[e-mail]> [e-mail]> wrote:

> 

>     Absolutely do not want to expand the EAT doc to cover Endorsement and

> Reference Values in any way, but maybe another draft might make use of some

> stuff that is in EAT.

> 

>     Ned suggested it, not me. :-)

> 

>     LL

> 

> 

>     > On Feb 22, 2022, at 11:19 AM, Henk Birkholz

> < <mailto:[e-mail]> [e-mail]> wrote:

>     >

>     > You are kidding, right?

>     >

>     > On 22.02.22 20:12, Smith, Ned wrote:

>     >> Maybe that’s a good idea. Maybe it’s not. Not sure yet. :-)

> 

> 

> _______________________________________________

> RATS mailing list

>  <mailto:[e-mail]> [e-mail]

>  <https://www.ietf.org/mailman/listinfo/rats> https://www.ietf.org/mailman/listinfo/rats