Re: [Rats] Attestation of implementation vs authenticity of service

Hi,

+1 to Laurence's insight here on Attestation for Devices versus
TLS/HTTPS for Services.

Cheers,
- Ira

On Mon, Aug 3, 2020 at 3:03 PM Salz, Rich <rsalz=40akamai.com@dmarc.ietf.org>
wrote:

>
>    - Another way to look at this is from a certification / regulatory
>    view. If the thing you're looking at is a candidate for implementation
>    certification such as Common Criteria, FIPS, FIDO certification, then it
>    probably lines up with device attestation. On the other hand, if the thing
>    your are looking at lines up with regulation (e.g., banking regulation,
>    GDPR,...) and to some degree OWASP
>    <https://urldefense.proofpoint.com/v2/url?u=https-3A__owasp.org&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=i2HHx7M5shXvUZmbo2H9JWFNah1cQYR9QL8xSUTJHcw&s=D7ncLvRq-bcYsr722qYkwbNUSyi2i1Ap7rstjSY-zZ0&e=>,
>    then it probably lines up with service authenticity.
>
>
>
> That is a **very** interesting way to slice things; I’ll have to think
> about it more. Thanks!
>
>
>
>    - I think the RATS architecture document should probably have text
>    that describes when attestation is applicable and when it is not, for
>    example saying something like “attestation is not a replacement or
>    augmentation for HTTPS/TLS"
>
>
>
> Excellent point.  Doing so will likely avoid a round-trip with the
> security AD’s.
>
>
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats
>