Re: [Rats] draft-birkholz-rats-network-device-subscription-00

["Eric Voit (evoit)" <[e-mail]>]

Hi Ned,

> From: Smith, Ned, July 28, 2020 10:54 AM
> 
> Subscription models could be topic based rather than entity based. The use case
> below suggests that a Verifier is interested in system booting events. A topic-
> based approach might allow Verifiers to subscribe to "boot image X" as the
> topic. All entities that collect a Claim for "image X" would publish the Claim to
> the field of subscribers.
> 
> Is the use of YANG to describe pub/sub limiting the ability to do topic-based
> pub/sub?

There shouldn't be any limitations inherent in doing topic-based pub/sub.   In fact, the current draft does allow for a number of pre-packaged topics as part of the event stream, as long as they are PCR based.  For example,

- a Verifier can subscribe to all 'extend' and 'quote' operations for a set of PCRs (such as PCRs 0-8).  As pre-defined set of PCRs could be considered a micro-topic.
- based on the subscription parameters requested, the Attester can filter out information for PCRs which you don't care about.  

One thing that isn't currently supported are stateful filters.  I.e., if from one event you glean that you are not running "boot image X" then throw away all subsequent events.  It is not the YANG model which prevents this, it is that a stateful event filtering language would need to be defined.

Alternatively, you could always define a new stream called "boot image X" and let people subscribe to that.  RFC8639 encourages the definition of new event streams for purposes like this.

Eric

> -Ned
> 
> On 7/28/20, 7:19 AM, "RATS on behalf of Henk Birkholz" <rats-
> [e-mail] on behalf of [e-mail]> wrote:
> 
>     Hi Dave,
> 
>     a clarifying question:
> 
>     What exactly do you mean by the "who" in "a subscriber knows who to
>     subscribe to"?
> 
>     The I-D does not come with its own join/rendezvous/discovery capability.
>     That either comes related with YANG Push ("call home"). That would be a
>     "who" on the entity level.
> 
>     Another possibility is that you mean a YANG RPC with the "who"? That
>     would be a "who" on the management interface level.
> 
>     Or you could mean one of the Attesting Environment of a composite
>     Attester. Tha would be a "who" on the Attester level. And that is done
>     via the included data store.
> 
>     Or do you mean something I am missing here?
> 
>     Viele Grüße,
> 
>     Henk
> 
>     On 28.07.20 16:10, Dave Thaler wrote:
>     > I asked in the meeting how a subscriber knows who to subscribe to, and I
> believe the answer was
>     > that CHARRA answers that.  Well I looked in draft-ietf-rats-yang-tpm-
> charra-02 and it does not
>     > contain any mention of the subject.  I think one or the other of the two
> drafts needs to address
>     > this issue.  My preference is that it be in draft-birkholz-rats-network-device-
> subscription since
>     > that's the draft that talks about limitations like
>     >> Evidence is not streamed to an interested Verifier as soon as it is
> generated.
>     > Which certainly still applies, it's just another case... you didn't know to
> subscribe to it until
>     > after the evidence was generated when it booted.
>     >
>     > Dave
>     >
>     > -----Original Message-----
>     > From: RATS <[e-mail]> On Behalf Of Eric Voit (evoit)
>     > Sent: Wednesday, June 24, 2020 9:41 AM
>     > To: [e-mail]
>     > Cc: Wei Pan <[e-mail]>; Birkholz, Henk
> <[e-mail]>
>     > Subject: [Rats] draft-birkholz-rats-network-device-subscription-00
>     >
>     > Hi All,
>     >
>     > This draft defines how to subscribe to a stream of attestation related
> Evidence on TPM-based network devices.  When subscribed, a Telemetry
> stream of verifiably fresh YANG notifications (which are generated when TPM
> PCRs are
>     > extended) are pushed to the subscriber.
>     >
>     > This draft integrates:
>     >   *  Section 5 of draft-voit-rats-trusted-path-routing-01
>     >   *  Elements of draft-xia-rats-pubsub-model
>     >
>     > Thanks!
>     >
>     > Eric, Henk, and Wei
>     >
>     >
>     > -----Original Message-----
>     > From: [e-mail] <[e-mail]>
>     > Sent: Wednesday, June 24, 2020 12:19 PM
>     > To: Eric Voit (evoit) <[e-mail]>; Wei Pan
> <[e-mail]>; Henk Birkholz
> <[e-mail]>
>     > Subject: New Version Notification for
>     > draft-birkholz-rats-network-device-subscription-00.txt
>     >
>     >
>     > A new version of I-D, draft-birkholz-rats-network-device-subscription-
> 00.txt
>     > has been successfully submitted by Eric Voit and posted to the IETF
> repository.
>     >
>     > Name:		draft-birkholz-rats-network-device-subscription
>     > Revision:	00
>     > Title:		Attestation Event Stream Subscription
>     > Document date:	2020-06-24
>     > Group:		Individual Submission
>     > Pages:		20
>     > URL:
>     >
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i
> etf.org%2Finternet-drafts%2Fdraft-birkholz-rats-network-device-subscription-
> 00.txt&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2a3783
> 449230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C
> 0%7C637286137029115135&amp;sdata=MnEJ5ZwAh4BlTNs09fk0Vr1H39j5N
> %2BJdyBQHNJp7BdY%3D&amp;reserved=0
>     > Status:
>     >
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatr
> acker.ietf.org%2Fdoc%2Fdraft-birkholz-rats-network-device-
> subscription%2F&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C2582
> 5e2a3783449230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47
> %7C1%7C0%7C637286137029115135&amp;sdata=qukLQaq17P4ts20nW1L%
> 2B2dB9zIM9XB9SRcscFWcOeLw%3D&amp;reserved=0
>     > Htmlized:
>     >
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.i
> etf.org%2Fhtml%2Fdraft-birkholz-rats-network-device-subscription-
> 00&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2a3783449
> 230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%
> 7C637286137029125095&amp;sdata=Q0TfFjrfHZU%2FKFOT3li4JG0QoBa3Vo
> %2FkHTp00T6GbZY%3D&amp;reserved=0
>     > Htmlized:
>     >
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatr
> acker.ietf.org%2Fdoc%2Fhtml%2Fdraft-birkholz-rats-network-device-
> subscription&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2
> a3783449230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7
> C1%7C0%7C637286137029125095&amp;sdata=RLSvdRTcWX4Gew50X2DL7t
> 2pE7N%2FA%2BKWrAVz0NhsbiA%3D&amp;reserved=0
>     >
>     >
>     > Abstract:
>     >     This document defines how to subscribe to a stream of attestation
>     >     related Evidence on TPM-based network devices.
>     >
>     >
>     >
>     >
>     > Please note that it may take a couple of minutes from the time of
> submission until the htmlized version and diff are available at tools.ietf.org.
>     >
>     > The IETF Secretariat
>     >
>     >
> 
>     _______________________________________________
>     RATS mailing list
>     [e-mail]
>     https://www.ietf.org/mailman/listinfo/rats
> 
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats