Re: [Rats] [ietf-rats-wg/eat] Definition and usage of the term 'entity' (#16)

[Kathleen Moriarty <[e-mail]>]

On Fri, Oct 4, 2019 at 1:56 PM Smith, Ned <[e-mail]> wrote:

> The architecture defines:
>
>    - Entity:  a user, organization, device or computing environment.
>    - Principal:  an Entity that implements RATS Roles and creates
>    provable Claims or Attestation Results (see [ABLP] and [Lampson2007]).
>    - Attesting Computing Environment:  a Computing Environment capable of
>    monitoring and attesting a target Computing Environment.
>    - Attested Computing Environment:  a target Computing Environment that
>    is monitored and attested by an Attesting Computing Environment.
>
>
>
> The attested computing environment is the subject of attestation which
> clearly is creating provable claims.
>
>
>
> The ‘attested’ environment may be less clearly a Principal. At one point
> the list suggested the architecture should define a term “target of
> attestation” or “attestation target” (or something similar). The term
> “attested computing environment” seems close to this. Do we think the
> attested environment is semantically the same as “subject of the
> attestation”?
>
>
>
> Using Lampson’s definition of Principal, an expression of attributes (aka
> claims) is itself a principal.
>
>
>
> There are lots of cases where ‘entity’ is used to refer to organizations
> and users (see https://csrc.nist.gov/glossary/term/entity ). Given the
> broad use of the term to mean: a “user, organization, device or process” it
> might not make sense for RATs to change its scope. The RATS Arch used the
> term “computing environment” instead of process because not every computing
> environment has an operating system.
>
>
>
> An “attested computing environment” is clearly intended to be a “computing
> environment” and hence is an Entity according to the arch draft.
>

And from a review of the EAT draft (again), I am reading this as the
attestation based on the installed code with the attestation performed at
boot to match what was installed.  This would verify that the code was what
the system administrator installed and configured.  As opposed to code
being attested by the creator, which might be done with the same format,
but would assure the code was as he creator expected.

I'm asking about this clarification in light of supply chain and the flow
document:
https://datatracker.ietf.org/doc/draft-fedorkow-rats-network-device-attestation/?include_text=1

Does the supply chain use case hold in these definitions or is there some
reason why we might not care about attestations on code from the originator
that might include code it relies upon when chained attestations are
considered?  This would expand out the definition of entity as well.


>
> If the EAT draft’s use of entity is semantically equal to the architecture
> draft use of “attested computing environment” then possibly it makes sense
> for the EAT draft to begin using this term instead?
>
>
>
> The architecture draft potentially could be more clear as to whether an
> “Attested computing environment” is both an entity and a principal or just
> an entity. It seems clear that an “attesting computing environment” is a
> Principal.
>

Is EAT limited to 'attested computing environments' or a broader definition
of entity?

Kathleen


>
> Ned
>
>
>
> On 10/4/19, 10:27 AM, "Laurence Lundblade" <[e-mail]>
> wrote:
>
>
>
> EAT and Architecture are absolutely NOT aligned on the term entity. See my
> recent email comments on the architecture document.
>
> My basis for closure is that the architecture document will define some
> term that is the is used to refer to the subject of the attestation. Maybe
> we shouldn't close this until the architecture doc starts tracking issues
> formally.
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub
> <https://github.com/ietf-rats-wg/eat/issues/16?email_source=notifications&email_token=ABPMCSG6S47KPNKHPDRK3TDQM54ILA5CNFSM4ID7KXSKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEAMLBKY#issuecomment-538489003>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ABPMCSAPK5BFFBWNGO2SLZTQM54ILANCNFSM4ID7KXSA>
> .
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats
>


-- 

Best regards,
Kathleen