Re: [Rats] my comments on the mic line

Hi Kathleen, 

I have just re-read the draft myself and have similar questions. 
The architecture is not clear to me. A figure would help me.

I also believe there is a bit of a terminology mix-up. The RATS architecture already defines an extensive list of terms and you add even more (without defining them). I have challenges understanding many of the sentences.

There are also lots of references missing. Is it necessary to even talk about these specifications/technologies to get the idea across?

I believe a simplified example would help the reader understand. 

In general, there is also the question about what you are proposing. It seems that you propose the following:

-  an architecture extension (in the style of how draft-ietf-rats-daa extends the RATS architecture)	, and
- new claims for EAT.

Is this correct?

The document is somewhat incomplete. The claim definition is missing, the IANA consideration section for those claims is empty, the reference to RATS cannot be informative, the appendices should be removed, etc. 

Ciao
Hannes

-----Original Message-----
From: RATS <rats-bounces@ietf.org> On Behalf Of Thomas Fossati
Sent: Mittwoch, 8. November 2023 13:12
To: Kathleen Moriarty <Kathleen.Moriarty.ietf@gmail.com>; rats <rats@ietf.org>
Subject: [Rats] my comments on the mic line

Hi Kathleen,

sorry you didn't feel good, I hope you'll recover soon!

This is a copy of the comments I made on the mic line, feel free to address them whenever you feel better.

First of all, for me, it is important to get a grasp of the system architecture you have in mind to understand whether this work is in the scope of RATS.

IIUC, you have a composite device that produces complex, multi-layered evidence.  Then a (local) verifier appraises the evidence and produces an attestation result.  Then a relying party (i.e., some kind of governance/risk-compliance application) uses its application-specific appraisal policy to process the attestation result and create an “attestation” (= NIST definition #2, see [1]) using the claims you want to define/register.

If that is the case, it'd seem to me that the claims set is outside of the RATS picture - they'd be a message coming out of the RP box in the bottom right-hand corner of the architecture picture.

If that is not the case - apologies if I misconstrued your design :-)
- and the claims set is part of the attestation result coming out of the verifier, then it's good to go for me because this would be semantics encoded in one of the RATS conceptual messages.

In any case, RATS or not, this is very relevant work.

cheers, thanks!

[1] https://csrc.nist.gov/glossary/term/attestation

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats