[Rats] how does the Verifier work

[Michael Richardson <[e-mail]>]

In issue https://github.com/ietf-rats-wg/architecture/issues/210
and in quite a number of discussions in the design team, we ratholed on
whether or not we were specifiying a normative description of how verifiers
worked.

In the architecture document we want to specify what goes in to the Verifier
(from the Attester direction!), and what goes out of the Verifier (to the
Replying Party only).
https://www.ietf.org/archive/id/draft-ietf-rats-architecture-09.html#dataflow

We did not want to specify the other arcs (Endorsements, Appraisal Policy for
Verifiers), but we did need to place some requirements on what was possible.

For instance, that Evidence would be signed, and that Verifiers could verify
the signature on it.

The large X diagram at:
  https://www.ietf.org/archive/id/draft-ietf-rats-architecture-09.html#name-claims-encoding-formats

which in many ways started the entire architecture document, remains an
intentional black box from this document.

It seems that there is a desire among some participants to more clearly
articulate how many (but perhaps not all) Verifiers work.  It seems that with
an appropriate initial narrow scope that such a document could be written by
the IETF.   For pretty much all the cases of "perhaps not all", then it is
probably the case that the specifics will be very specific to a vertical, and
should be written in that technical consortium outside of the IETF.

This email is basically the concluding recommendation of the design team: we
aren't going to put this into the architecture document, but we don't object
if someone else wants to write _Architecture of common Verifiers_, or some
equivalently titled document.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [