[Rats] Re: New Version Notification for draft-sardar-rats-sec-cons-03.txt

[camilo ayerbe <[e-mail]>]

Hi Usama, Yogesh, Jun, Houda, Henk, and the RATS WG,

I support adding Usama's proposed §8.1.1 [1] and §8.1.2 [2] to the deshpande
multi-verifier draft.

RATS has historically been built around the single-verifier model — RFC 9334
and the bulk of subsequent RATS work assume one Verifier per appraisal. The
multi-verifier topology in this draft is a meaningful departure from that
baseline.

The current §7 and §8 of the deshpande draft acknowledge TCB expansion and
information leakage as facts within the multi-verifier architecture, but the
proposed additions are necessary to surface the comparison against the
single-verifier baseline at the top of each section — making the security/
privacy trade-off explicit relative to the standard readers are already
familiar with from RATS.

Thanks,
Camilo

[1]
https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.html#section-8.1.1-3
[2]
https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.html#section-8.1.2-3

On Fri, May 8, 2026 at 1:06 AM David Condrey <david=
[e-mail]> wrote:

> Hi Usama, Yogesh, Jun, Houda, Henk, and the RATS WG,
>
> I am replying to voice my strong support for Usama's request to include
> the security and privacy considerations from draft-sardar-rats-sec-cons-03
> (Sections 8.1.1 and 8.1.2) into the multi-verifier draft.
>
> From the perspective of other active work in this space, preserving the
> security and privacy guarantees of TLS Exported Authenticators (expat) is
> critical. As the author of drafts utilizing the Proof of Process (PoP)
> framework and related cryptographic proofs (such as
> draft-condrey-cfrg-posme and draft-condrey-rats-pop), my proposed
> architectures fundamentally rely on those expat guarantees remaining intact.
>
> If the multi-verifier architecture breaks the expat guarantees, it creates
> a cascading issue that undermines the threat models of downstream drafts
> that depend on them.
>
> David Condrey
>
> On Apr 29, 2026, at 4:08 PM, Muhammad Usama Sardar <
> [e-mail]> wrote:
>
> Hi Yogesh, Jun, Houda, and Henk,
>
> We are doing research on the security and privacy of multi-verifiers, and
> we will share any solution that we will have from our analysis.
>
> For now, we have revised the proposal for security considerations
> statement [0] based on the adoption call discussion that we would like to
> be added in the draft until you or we find some reasonable solution.
>
> Privacy statement is unchanged [1] and we would like that to be added in
> the draft as well.
>
> Thank you.
>
> Best regards,
>
> -Usama
>
> [0]
> https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.html#section-8.1.1-3
>
> [1]
> https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.html#section-8.1.2-3
>
>
>
>
> -------- Forwarded Message --------
> Subject: New Version Notification for draft-sardar-rats-sec-cons-03.txt
> Date: Wed, 29 Apr 2026 15:44:15 -0700
> From: [e-mail]
> To: Muhammad Sardar <[e-mail]>
> <[e-mail]>, Muhammad Usama Sardar
> <[e-mail]>
> <[e-mail]>
>
> A new version of Internet-Draft draft-sardar-rats-sec-cons-03.txt has been
> successfully submitted by Muhammad Usama Sardar and posted to the
> IETF repository.
>
> Name: draft-sardar-rats-sec-cons
> Revision: 03
> Title: Guidelines for Security Considerations of RATS
> Date: 2026-04-29
> Group: Individual Submission
> Pages: 14
> URL: https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.txt
> Status: https://datatracker.ietf.org/doc/draft-sardar-rats-sec-cons/
> HTML: https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-03.html
> HTMLized: https://datatracker.ietf.org/doc/html/draft-sardar-rats-sec-cons
> Diff:
> https://author-tools.ietf.org/iddiff?url2=draft-sardar-rats-sec-cons-03
>
> Abstract:
>
> This document aims to provide guidelines and best practices for
> writing security considerations for technical specifications for RATS
> targeting the needs of implementers, researchers, and protocol
> designers. This is a work-in-progress, and the current version
> mainly presents an outline of the topics that future versions will
> cover in more detail.
>
> * Corrections in published RATS RFCs
>
> * Security concerns in two RATS drafts
>
> * General security guidelines, baseline, or template for RATS
>
>
>
> The IETF Secretariat
>
>
> _______________________________________________
> RATS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>
>
> _______________________________________________
> RATS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>