Re: [Rats] Implementation report

[Tom Jones <[e-mail]>]

Yeah wallets. It doesn't really belong there. But we do need to find a
friendly place to support it.

thx ..Tom (mobile)

On Fri, Feb 23, 2024, 12:09 PM Friedman, Allan <[e-mail]>
wrote:

> Lovely to be pulled into the cool standards kids group!
>
>
>
> Always happy to chat more about where SBOM sits today, and where there’s
> room for trying to help layer trust on without breaking some of the
> existing efforts.
>
>
>
> On the hardware side, I’ll also flag that a whole lot of people are
> interested in a more holistic approach to hardware transparency side, and
> there may be some public calls for more information and ideas coming soon.
> Some work that happened at CISA (
> https://www.cisa.gov/resources-tools/resources/hardware-bill-materials-hbom-framework-supply-chain-risk-management
> ) highlighted the challenge of meaningful cross-organization supply chain
> visibility even before you get to the trust and trust anchor pieces.
>
>
>
> allan (the SBOM guy)
>
>
>
> *From: *Tom Jones <[e-mail]>
> *Date: *Friday, February 23, 2024 at 2:40 PM
> *To: *Henk Birkholz <[e-mail]>
> *Cc: *Kathleen Moriarty <[e-mail]>, rats <
> [e-mail]>, John Schmidt <[e-mail]>, Sean Turner <
> [e-mail]>, Friedman, Allan <[e-mail]>
> *Subject: *Re: [Rats] Implementation report
>
> *CAUTION: *This email originated from outside of DHS. DO NOT click links
> or open attachments unless you recognize and/or trust the sender. Contact
> your component SOC with questions or concerns.
>
>
>
> We are exploring the use of SBOM in OWF.
>
> The last time I raised anything like that in a RATS thread I was met with
> outright hostility.
>
> ..tom
>
>
>
>
>
> On Wed, Feb 21, 2024 at 3:11 AM Henk Birkholz <[e-mail]>
> wrote:
>
> Hi Kathleen,
>
> thank you for the pointers! Will you be in Brisbane?
>
> Looking at your last link, I am wondering if there are plans for future
> projects. Say... remote attestation based authenticity assurance in the
> software supply chain chain: and I am thinking along the lines of
> "Trustworthy SBOMs", which would be scenario that would combine various
> building blocks and that is definitely still in demand of more standards
> consolidation.
>
> Because
> https://learn.cisecurity.org/built-in-security-scale-hardware-support
> <https://urldefense.us/v3/__https:/learn.cisecurity.org/built-in-security-scale-hardware-support__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzOoZwUZw$>
> cited https://www.cisa.gov/securebydesign, I am reeling Alan into this
> reply. So that he is aware that we could do something meaningful here :-)
>
>
> Viele Grüße,
>
> Henk
>
> On 13.02.24 15:58, Kathleen Moriarty wrote:
> > Greetings!
> >
> > Last year, I introduced my team to RATS work and pulled together a
> > project that was a lead in to the attestation sets draft, implementing
> > largely what's described in
> > https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/
> <https://urldefense.us/v3/__https:/datatracker.ietf.org/doc/draft-ietf-rats-endorsements/__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGz7PcIVlM$>
> > <https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/
> <https://urldefense.us/v3/__https:/datatracker.ietf.org/doc/draft-ietf-rats-endorsements/__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGz7PcIVlM$>
> >
> >
> > It took some time to complete due to some hyperscaler environments not
> > having a TPM or access to it from the container orchestration platform
> > or virtual server host. Once we secured an environment where this was
> > possible, through use of the IMA libraries (created for this purpose and
> > previously proven by RedHat), positive results were demonstrated. The
> > objective was to test assurance to CIS Benchmarks as that was my
> > employer at the time. We hope you find this report useful.
> >
> >
> https://www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical
> <https://urldefense.us/v3/__https:/www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzwhBhTTg$>
> <
> https://www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical
> <https://urldefense.us/v3/__https:/www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzwhBhTTg$>
> >
> >
> > This was done at the same time other team members were researching the
> > prevalence of TPMs and TEEs in infrastructure. The purpose of that work
> > was to signal that hardware support is increasingly available and should
> > be used to ease configuration management and posture assurance
> capabilities.
> >
> >
> https://www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support
> <https://urldefense.us/v3/__https:/www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGz7ddhyPc$>
> <
> https://www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support
> <https://urldefense.us/v3/__https:/www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGz7ddhyPc$>
> >
> >
> > The timeline could include more data points, we included key points.
> >
> > I am copying John Schmidt who did the work. Sean Turner joined the
> > project in September and assisted with key management, application of
> > cryptography, and validation. Thank you both for your great work to
> > successfully implement this PoC!
> >
> > --
> >
> > Best regards,
> > Kathleen
> >
> > _______________________________________________
> > RATS mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/rats
> <https://urldefense.us/v3/__https:/www.ietf.org/mailman/listinfo/rats__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzo4pHZ_4$>
>
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats
> <https://urldefense.us/v3/__https:/www.ietf.org/mailman/listinfo/rats__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzo4pHZ_4$>
>
>