Re: [Rats] Review of draft-birkholz-rats-daa

[Hannes Tschofenig <[e-mail]>]

Hi Chris,

You are the authors of the draft and you can put in there whatever you want. When it is an individual draft then you can do whatever you want.
Once it becomes a working group document the group decides what goes into the document...

Ciao
Hannes


-----Original Message-----
From: Christopher Newton <[e-mail]>
Sent: Monday, June 7, 2021 10:01 PM
To: Hannes Tschofenig <[e-mail]>; [e-mail]
Cc: [e-mail]; Thomas Fossati <[e-mail]>; Henk Birkholz <[e-mail]>; Liqun Chen <[e-mail]>
Subject: RE: Review of draft-birkholz-rats-daa

Dear Hannes,

This is a good idea, but how do we get access to edit the security considerations section to add some comments? We are both new to IETF standards and how they are developed and updated.

Regards,

Chris and Liqun.

--
Dr Christopher Newton
Surrey Centre for Cyber Security
Department of Computer Science
University of Surrey
Guildford, Surrey, GU2 7XH, UK
--

-----Original Message-----
From: Hannes Tschofenig <[e-mail]>
Sent: 07 June 2021 08:07
To: Newton, Christopher Dr (Computer Science) <[e-mail]>; [e-mail]
Cc: [e-mail]; Thomas Fossati <[e-mail]>; Henk Birkholz <[e-mail]>; Chen, Liqun Prof (Computer Science) <[e-mail]>
Subject: RE: Review of draft-birkholz-rats-daa

Hi Christopher,

I think it would be worthwhile to note in the security considerations section that you are making certain assumptions about the content of the token. It is easy to imagine that those using the token get this wrong.
There is also good privacy terminology you can rely on, see https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc6973&amp;data=04%7C01%7Cc.newton%40surrey.ac.uk%7C206268f908b0426f080c08d92982f12e%7C6b902693107440aa9e21d89446a2ebb5%7C0%7C1%7C637586464708416857%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=Yz2r4hPaY%2Ft0J03wSVvwCz5X1bw5loCvrVsmemDwFMY%3D&amp;reserved=0

Ciao
Hannes



-----Original Message-----
From: Christopher Newton <[e-mail]>
Sent: Sunday, June 6, 2021 10:20 PM
To: Hannes Tschofenig <[e-mail]>; [e-mail]
Cc: [e-mail]; Thomas Fossati <[e-mail]>; Henk Birkholz <[e-mail]>; Liqun Chen <[e-mail]>; Christopher Newton <[e-mail]>
Subject: RE: Review of draft-birkholz-rats-daa

Hi Hannes,

Thank you for your interest and comments.

> In any case, [DAA] has to be a normative reference.
Yes.

> I would also like to see the privacy properties articulated in more detail, particularly when DAA is used with an attestation token that potentially contains a lot of claims.

For DAA itself, we assume that the attestation token does not reveal the identity of the signer. However, if this is the case there is research into property based attestation that will anonymise the attestation token.

Regards,

Liqun and Chris.

--
Dr Christopher Newton
Surrey Centre for Cyber Security
Department of Computer Science
University of Surrey
Guildford, Surrey, GU2 7XH, UK
--

-----Original Message-----
From: Hannes Tschofenig <[e-mail]>
Sent: 26 May 2021 14:59
To: [e-mail]
Cc: [e-mail]; Thomas Fossati <[e-mail]>
Subject: RE: Review of draft-birkholz-rats-daa

Hi Henk,

I have not been following the RATS work closely and hence I was wondering whether this document is supposed to become part of the architecture document?
In any case, [DAA] has to be a normative reference. I would also like to see the privacy properties articulated in more detail, particularly when DAA is used with an attestation token that potentially contains a lot of claims IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.