Re: [Rats] watchdog use case ... RE: Use cases in draft-ietf-rats-architecture-04

Hannes Tschofenig <Hannes.Tschofenig@arm.com> Wed, 17 June 2020 12:34 UTC

Return-Path: <Hannes.Tschofenig@arm.com>
X-Original-To: rats@ietfa.amsl.com
Delivered-To: rats@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DFBD3A0420 for <rats@ietfa.amsl.com>; Wed, 17 Jun 2020 05:34:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=Zre1tUFl; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=Zre1tUFl
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zAvcr0n1kFXk for <rats@ietfa.amsl.com>; Wed, 17 Jun 2020 05:34:02 -0700 (PDT)
Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-eopbgr70044.outbound.protection.outlook.com [40.107.7.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7679B3A0415 for <rats@ietf.org>; Wed, 17 Jun 2020 05:34:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3zTXCZpPBv+KhwLeSS1jcw6JygX5Z7O2EYgW4DuX398=; b=Zre1tUFldGrsqDfYk1XGUgMDP35oQqjJeyB6QkYWWMvl2iCn/lzMNx/EtYkYzUNmTudfWEppDQe+y1uSPedR9LtJTp+6v4fodRY8OIC8f6QABqHMjnmk0y35+CgRPB4aKYIzSOKUV9vJCsC32kQ2afS26G8Nft7um/2ZDi1FjcM=
Received: from AM0PR01CA0083.eurprd01.prod.exchangelabs.com (2603:10a6:208:10e::24) by DBBPR08MB4521.eurprd08.prod.outlook.com (2603:10a6:10:cd::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3088.18; Wed, 17 Jun 2020 12:33:58 +0000
Received: from VE1EUR03FT019.eop-EUR03.prod.protection.outlook.com (2603:10a6:208:10e:cafe::59) by AM0PR01CA0083.outlook.office365.com (2603:10a6:208:10e::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3109.22 via Frontend Transport; Wed, 17 Jun 2020 12:33:58 +0000
X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT019.mail.protection.outlook.com (10.152.18.153) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3109.22 via Frontend Transport; Wed, 17 Jun 2020 12:33:58 +0000
Received: ("Tessian outbound 13f833fb3c6d:v59"); Wed, 17 Jun 2020 12:33:58 +0000
X-CR-MTA-TID: 64aa7808
Received: from fb3806623fa5.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id E88702AF-F419-4036-B324-5AE9EE0FEA6B.1; Wed, 17 Jun 2020 12:33:53 +0000
Received: from EUR01-HE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id fb3806623fa5.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Wed, 17 Jun 2020 12:33:53 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ki6koGgYsaaN00TT2W9Hfz6Sy3r2z7zamtR+agpReVOoeR+xfIESWws9h780ECNzWiBB9ve1KbCBXJvLRkpKFyf6lki+uRJN24HDmRMrZblJVnWZgNLGXgx+o/E4iA98ffAlJEr4JRDuw6SU1XS+QUcPmFU7tTeAUvvssiEvuCSSfGb/lS4GwNmwvslVorcoPookXdW305eIQ+5AIkd3ErKHBkqNloaptjbP9d+Saf1VyRCJuZSKPOFuPVNnXH00TZZhKGV6hxfOKt//LLv+r9HOfqVBcSrOXCTuhtG8tlASJ36Kza8ZvsrBRHWSrJdrCkliPryA3hIyeMMS3RcCJw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3zTXCZpPBv+KhwLeSS1jcw6JygX5Z7O2EYgW4DuX398=; b=HFvvfumd9g4itrywXLtNwKGlx8wFVLS0TG4SMrwBsUwnN0eBCqawTZoJgNzh4DHLD6q+OGIZe8dbLkWDYUFZjptSMiIKGqTkHPXEGFO4EVpweCnIl8dNxAxn88vOYQCRyvNzaM2jt814c7H+TFxZ8gbhfTufEgeBvLBzDwzjmAY+GY41xdVo6In/g0k6QUvYnWP78aqIE1tUTeGZ9cCf04nxcoFRtiRb+aYOTX4I2c2iAtY6gO7+tVTtYAOY3GU+YkhEICubyTba+rPCpap6G8XD3qyxAetpjqcKB5hDhJFndqwELaD/2+Nofib4IJQkUu7738AfmGtM8zJ8vXHRww==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3zTXCZpPBv+KhwLeSS1jcw6JygX5Z7O2EYgW4DuX398=; b=Zre1tUFldGrsqDfYk1XGUgMDP35oQqjJeyB6QkYWWMvl2iCn/lzMNx/EtYkYzUNmTudfWEppDQe+y1uSPedR9LtJTp+6v4fodRY8OIC8f6QABqHMjnmk0y35+CgRPB4aKYIzSOKUV9vJCsC32kQ2afS26G8Nft7um/2ZDi1FjcM=
Received: from AM0PR08MB3716.eurprd08.prod.outlook.com (2603:10a6:208:106::13) by AM0PR08MB4227.eurprd08.prod.outlook.com (2603:10a6:208:13d::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3109.22; Wed, 17 Jun 2020 12:33:51 +0000
Received: from AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::39f5:e4d9:51ff:eae]) by AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::39f5:e4d9:51ff:eae%7]) with mapi id 15.20.3109.021; Wed, 17 Jun 2020 12:33:51 +0000
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
To: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>, Michael Richardson <mcr+ietf@sandelman.ca>
CC: "Oliver, Ian (Nokia - FI/Espoo)" <ian.oliver@nokia-bell-labs.com>, "rats@ietf.org" <rats@ietf.org>
Thread-Topic: [Rats] watchdog use case ... RE: Use cases in draft-ietf-rats-architecture-04
Thread-Index: AQHWRKHogdWuHIa0MkSpF8nyrgo23ajcvSmg
Date: Wed, 17 Jun 2020 12:33:51 +0000
Message-ID: <AM0PR08MB3716C8E22B305611D15B807AFA9A0@AM0PR08MB3716.eurprd08.prod.outlook.com>
References: <AM0PR08MB3716A2C59320D3FB8D403FADFA9D0@AM0PR08MB3716.eurprd08.prod.outlook.com> <12088.1592338780@localhost> <AM0PR08MB3716F8C518E0CDF43FA23D40FA9A0@AM0PR08MB3716.eurprd08.prod.outlook.com> <53a1c6c3-5e85-cb04-b10b-e0d8d5b5ded5@sit.fraunhofer.de>
In-Reply-To: <53a1c6c3-5e85-cb04-b10b-e0d8d5b5ded5@sit.fraunhofer.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ts-tracking-id: 190910d7-ae27-4b3a-b8e0-28c41bda4575.1
x-checkrecipientchecked: true
Authentication-Results-Original: sit.fraunhofer.de; dkim=none (message not signed) header.d=none;sit.fraunhofer.de; dmarc=none action=none header.from=arm.com;
x-originating-ip: [80.92.122.58]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: 3658f049-d0ce-40c6-349d-08d812bab51b
x-ms-traffictypediagnostic: AM0PR08MB4227:|DBBPR08MB4521:
X-Microsoft-Antispam-PRVS: <DBBPR08MB4521CFEA3AD11562EB330952FA9A0@DBBPR08MB4521.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:9508;OLM:9508;
x-forefront-prvs: 04371797A5
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: EEASg8vmbMqmtJGXSZEyL5Hfqqh4odbL3S1nzr+oBMT9abh5poqpdwwzCTowM/NBrm29Oet66eL3WuoAN8sve/AHqgNM9GhrZEQ1P+Jr9P5PKwlAsL3s0bner18sx28ZkxgidYxaJr1WCLnDhD9vgEyf7couEABsjHqG4zpksqXcVAQMI5Eujt8raANLbYPxWTFiBy5VuDYrXv7ZwXMLKdVdHIaQYceYDGw7MIhbZ4ssyXCNrX6scoyhR/Lqo1RimztPwfFmQv/T2wEDdmGnhYXbWRmycoGRRMPG7GUCf9TxK4AiTwZvcwh9Fpghk0ShOiLxoWDP71EOIvyRaYOiarKbtttpO5jtemoctyZREu0PLXMfMMABuR2nL/AT2yJqBnLbb94/dOwZB5gt52B2Zg==
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB3716.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39850400004)(366004)(346002)(396003)(136003)(376002)(4326008)(7696005)(478600001)(966005)(9686003)(186003)(26005)(71200400001)(53546011)(316002)(55016002)(6506007)(54906003)(110136005)(86362001)(8936002)(33656002)(8676002)(66574015)(83380400001)(66476007)(64756008)(5660300002)(76116006)(2906002)(66556008)(66946007)(52536014)(66446008); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: bJoO/52v+6qWgtnz7/J8/m6GXs7BCskKV1s4D20edhjHCz1VMnDt+7kflhXXlDBGIesNp32NH3SGlaTs84nWe1GL36D0fPGpC01f7CaH+wq/mO8aXHc78xVNrr8+SMzZJxAGkVwuJMhgo+dyaNM1kYZ1R4zMRsxFET73SkXHMU9YoHBs6o9aFSCh/ZPNCygPfU9CjNbnWfxLnpocc/Q3lY7EIciacleM5oCfDNQ8NYyf8XllD/JA4Bz4c05pISvJoUs/8kQ2w1YjhlWkBjcHWdty+xM5QwnUQnu5/fDclk1kCbn9KjLHqdP4HCAyrFcF6bjs0QIzRTx6WZJdIcWJkaz6F8LA7GmzRUmRz6iY/m188iGFxOSmK7sr4A+5mtrcLh8U5SnIh/mhDSg7gMud7TIcvYRorg9T1g7skEjHpwhLaCzr2Csx4qv+INv7g2sf7Jpkdtg+tsfGfZCIW2v5WvApAwWH72OhgqXmWP5vPsI=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB4227
Original-Authentication-Results: sit.fraunhofer.de; dkim=none (message not signed) header.d=none;sit.fraunhofer.de; dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT019.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(4636009)(376002)(346002)(136003)(39860400002)(396003)(46966005)(33656002)(2906002)(26005)(8936002)(5660300002)(7696005)(110136005)(8676002)(66574015)(54906003)(4326008)(9686003)(55016002)(316002)(36906005)(6506007)(52536014)(70206006)(82740400003)(478600001)(83380400001)(70586007)(53546011)(186003)(336012)(966005)(356005)(81166007)(82310400002)(86362001)(47076004); DIR:OUT; SFP:1101;
X-MS-Office365-Filtering-Correlation-Id-Prvs: e643cbfa-b169-4844-9bbf-08d812bab107
X-Forefront-PRVS: 04371797A5
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: GJ5NkBq/1p+ovuC9VzmP1BEH5tSB2gMPhGlLEgSkrsV38cziHs9zQs1njXJeR+ZASIlDPQQZqawKyOD8J5gFOAdcvJTanf++6iEMl6mQg0gcf36z1Xl81+uUH2J7W7t1mQOaBab3CeJsfCJ+M0LsSkeCfYPmoVHN2dLtS9ZGNqYFnHlbxuD0oRugSm75f6wRk2WGAFyCxGbUVcBSh1I2yicvMtQCfX74bMEYJvf6vDgpNi0vGzuiCjmKgFwMICBmeS9QE3lnykSnG0vvyUeJpWTwbTs7s0sYXkNRph477drRR7XNmug2YZviNdy1N81AMLlLR8fnHKPV950yswukfesMdnkc/HZoOhuaivmRkb2oH1KzZ4XXGGO/4ql/U/k6ugTon5FTMZk/uHHqj/TCz6p3gPMQN4AiLoY65lvEVlNy71ZspAjf+fGoKj66/jC6yAzG0EYHZGakezDHu98VX6A2kAjY30QkzNlO7vbaWPo=
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Jun 2020 12:33:58.3178 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 3658f049-d0ce-40c6-349d-08d812bab51b
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB4521
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/EkLcWKiStnIjd6Wo-j7YPlWLYn8>
Subject: Re: [Rats] watchdog use case ... RE: Use cases in draft-ietf-rats-architecture-04
X-BeenThere: rats@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Remote ATtestation procedureS <rats.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rats>, <mailto:rats-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rats/>
List-Post: <mailto:rats@ietf.org>
List-Help: <mailto:rats-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rats>, <mailto:rats-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Jun 2020 12:34:04 -0000

Hi Henk,

It is quite possible that I was the only person who did not understood this use case and the rest of group was puzzled about me not understanding it. Ian was the other person commenting and understood it as well.

Now I get it and I am happy.

Ciao
Hannes

-----Original Message-----
From: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>
Sent: Wednesday, June 17, 2020 2:22 PM
To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>om>; Michael Richardson <mcr+ietf@sandelman.ca>
Cc: Oliver, Ian (Nokia - FI/Espoo) <ian.oliver@nokia-bell-labs.com>om>; rats@ietf.org
Subject: Re: [Rats] watchdog use case ... RE: Use cases in draft-ietf-rats-architecture-04

Hi Hannes,

the fact remains that the corresponding use case text alone was not enough to get you exited (I am glad that you are now *g*). Are you in a position to maybe provide a proposal how to rephrase the use case description in a way that would have helped you from the very start?

Viele Grüße,

Henk

On 17.06.20 14:17, Hannes Tschofenig wrote:
> Hi Michael,
>
> thanks for the reference to the TCG "Authenticated Countdown Timer" spec. I have not seen that spec before.
>
> It says:
>
> "
> A typical example for the use of an ACT is as a watchdog timer that
> will cause a platform reset when the timer reaches zero (expires). In
> a system using an ACT, a periodic platform action outside the TPM
> indicates that the timeout should be set anew using
> TPM2_ACT_SetTimeout(). The most common reason why timeout is not set
> anew is that the local system is not behaving properly because of some type of corruption (either inadvertent or malicious). The intent of the timer is that, in the absence of a properly authorized timeout extension, the platform would be reset, putting it back into a known state with the expectation that the corruption can be removed.
> "
>
> Thanks for the description of a possible message flow. This makes much more sense to me now.
>
> In fact, we have the building blocks to get this working already when you combine the EAT token (for the attestation), the CWT for authorization (as mentioned in the TPM spec above), and SUIT (for the update of the software that is needed to fix the system). When we look at TEEP then we actually see these building blocks combined to get this use case working via a standardized protocol.
>
> Now I am excited about this and maybe someone in the RATS/TEEP group wants to prototype it.
>
> Ciao
> Hannes
>
> -----Original Message-----
> From: Michael Richardson <mcr+ietf@sandelman.ca>
> Sent: Tuesday, June 16, 2020 10:20 PM
> To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
> Cc: Oliver, Ian (Nokia - FI/Espoo) <ian.oliver@nokia-bell-labs.com>om>;
> rats@ietf.org
> Subject: Re: watchdog use case ... RE: [Rats] Use cases in
> draft-ietf-rats-architecture-04
>
>
> Hannes Tschofenig <Hannes.Tschofenig@arm.com> wrote:
>      > Could the authors of the use case explain the watchdog use case a bit
>      > more?
>
> Sure.
> Dave's reference to the TCG "Authenticated Countdown Timer" is rather detailed, but perhaps misses the forest for the trees.
> Perhaps I can be a bit more concise.
> Ian, please let us know if this describes your situation as well.
>
>      > I do not understand how this is supposed to work. How is the device
>      > allowed to reboot when it sends attestation information to a remote
>      > server?
>
> There are usual three parties: Attester, Verifier, Relying Party.
>
> The Attester (secure enclave/TPM/etc.) collects Evidence as to health and sends this to a remote Verifier.
>
> The Verify creates an Attestation Result as normal.
>
> But, in the case, the Relying Party is the Watch Dog timer in the TPM/secure enclave itself.  So the Attestation Results are returned to the PC, and provided to the enclave.
>
> If the watch dog does not receive regular, and fresh, Attestation Results as to the systems' health, then it forces a reboot.
>
>      > If malware prevents the device from rebooting, as the text indicates,
>      > why doesn't that malware also prevent the interaction with the
>      > attestation server (for example, pretending that network connectivity
>      > is down)?
>
> The arrangement is that of a deadman's switch: if the malware were to prevent the communication, then the watch dog would go off.
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>ca>, Sandelman Software Works
> -= IPv6 IoT consulting =- IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
>
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats
>
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.