Subject: [Rats] Re: Security considerations of remote attestation (RFC9334)
From: "Smith, Ned" <[email-masked]>
To: Muhammad Usama Sardar <[email-masked]>, "Michael Richardson" <[email-masked]>, Thomas Fossati <[email-masked]>, Henk Birkholz <[email-masked]>, junzhang <[email-masked]>, Giridhar Mandyam <[email-masked]>, lgl island-resort.com <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Fri, 13 Dec 2024 23:41:10 +0000
List-Id: Remote ATtestation procedureS <rats.ietf.org>

>Pointing to specific text that is “wong” would be helpful
I meant to say “wrong”

From: Smith, Ned <[email-masked]>
Date: Friday, December 13, 2024 at 13:23
To: Muhammad Usama Sardar <[email-masked]>, Michael Richardson <[email-masked]>, Thomas Fossati <[email-masked]>, Henk Birkholz <[email-masked]>, junzhang <[email-masked]>, Giridhar Mandyam <[email-masked]>, lgl island-resort.com <[email-masked]>, [email-masked] <[email-masked]>
Subject: [Rats] Re: Security considerations of remote attestation (RFC9334)
>I believe the following statement in RFC9334 (Sec. 7.4) is wrong.
Pointing to specific text that is “wong” would be helpful since there is general consensus that the section as a whole is reasonable.

From: Muhammad Usama Sardar <[email-masked]>
Date: Friday, December 13, 2024 at 06:34
To: Michael Richardson <[email-masked]>, Thomas Fossati <[email-masked]>, Henk Birkholz <[email-masked]>, junzhang <[email-masked]>, Giridhar Mandyam <[email-masked]>, lgl island-resort.com <[email-masked]>, [email-masked] <[email-masked]>
Subject: [Rats] Re: Security considerations of remote attestation (RFC9334)

Hi Michael,

On 28.11.24 22:22, Michael Richardson wrote:

You can write ten documents, one every 4 months if you like, that *Update* 9334.
I don't think that's a very optimal solution. Also, from the reader perspective, reading RFC9334 first and then finding, "oh wait, what I just read in RFC9334 has been updated in these 10 documents."

They will be very much as legitimate as 9334.

I just don't see a reason to re-open the rest of the document to

second-system effect today.  The WG could disagree

I believe some things can be better fixed in RFC9334bis itself rather than opening a number of new different documents updating RFC9334. For example, I believe the following statement in RFC9334 (Sec. 7.4) is wrong. Would someone disagree? Does WG think I should write a new I-D just to say why this is wrong?

> "A conveyance protocol that provides authentication and integrity protection can be used to convey Evidence that is otherwise unprotected (e.g., not signed)."

Usama