Re: [Rats] Orthogonal: UUID? (was RE: Some new comments for CHARRA YANG module)

[Laurence Lundblade <[e-mail]>]

I would suggest avoiding UUIDs if possible. Nowadays good RNGs are available and you can just use them to generate a nonce or such. Good RNGs were not available commonly in CPUs when UUIDs were invented, but they are now.  If you just want a nonce, then the internal structure of a UUID is of no value and just adds complexity and confusion.

LL

> On Aug 14, 2020, at 12:25 PM, Eric Voit (evoit) <evoit=[e-mail]> wrote:
> 
> Hi Wei Pan,
>  
> Just slightly related to the question you asked previously, I have a question on the model/tree you sent back (in-line...)
>  
> > From: Panwei, August 14, 2020 6:01 AM
> > To: Eric Voit (evoit) <[e-mail] <mailto:[e-mail]>>; Shwetha Bhandari (shwethab)
> >
> > Hi Eric,
> >
> > Thanks for your reply, please see inline.
> >
> > Regards & Thanks!
> > Wei Pan
> >
> > From: Eric Voit (evoit) [mailto:[e-mail] <mailto:[e-mail]>]
> > Sent: Thursday, August 13, 2020 10:32 PM
> > To: Panwei (William) <[e-mail] <mailto:[e-mail]>>; Shwetha Bhandari
> > (shwethab) <[e-mail] <mailto:[e-mail]>>
> > Cc: [e-mail] <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>
> > Subject: RE: Some new comments for CHARRA YANG module
> >
> > Hi Wei Pan,
> >
> > From: Panwei (William), August 13, 2020 8:29 AM Hi Eric,
> >
> >
> > 2. The styles of challenge input for TPM1.2 and TPM2.0 are different.
> >       +---x tpm20-challenge-response-attestation {TPM20}?
> >       |  +---w input
> >       |  |  +---w tpm20-attestation-challenge
> >       |  |     +---w nonce-value          binary
> >       |  |     +---w challenge-objects* []
> >       |  |        +---w pcr-list* [TPM2_Algo]
> >       |  |        |  +---w TPM2_Algo        identityref
> >       |  |        |  +---w pcr-index*       tpm:pcr
> >       |  |        +---w TPM2_Algo?          identityref
> >       |  |        +---w (key-identifier)?
> >       |  |        |  +--:(public-key)
> >       |  |        |  |  +---w pub-key-id?   binary
> >       |  |        |  +--:(uuid)
> >       |  |        |     +---w uuid-value?   binary
> >       |  |        +---w tpm-name*           string
> > In the TPM2.0 challenge input, the nonce is put aside and the challenge-objects
> > is a list. So you can challenge for different pcr-lists of different TPMs in one
> > challenge input.
> >       +---x tpm12-challenge-response-attestation {TPM12}?
> >       |  +---w input
> >       |  |  +---w tpm1-attestation-challenge
> >       |  |     +---w pcr-index*              pcr
> >       |  |     +---w nonce-value             binary
> >       |  |     +---w TPM12_Algo?             identityref
> >       |  |     +---w (key-identifier)?
> >       |  |     |  +--:(public-key)
> >       |  |     |  |  +---w pub-key-id?       binary
> >       |  |     |  +--:(TSS_UUID)
> >       |  |     |     +---w TSS_UUID-value
> >       |  |     |        +---w ulTimeLow?       uint32
> >       |  |     |        +---w usTimeMid?       uint16
> >       |  |     |        +---w usTimeHigh?      uint16
> >       |  |     |        +---w bClockSeqHigh?   uint8
> >       |  |     |        +---w bClockSeqLow?    uint8
> >       |  |     |        +---w rgbNode*         uint8
>  
> UUID is represented differently in the TPM1.2 and TPM2 models.   In fact in the TPM1.2 modeling has the UUID broken into constituent parts, none of which are mandatory where other UUID parts exist.  Shwetha told me that the UUID structures originally came from Huawei.    A few questions:
>  
> (1) UUID only appears in RPCs.  It doesn't appear in the datanodes.   Nor does UUID appear in draft-ietf-netconf-keystore.  As a result it is hard to see how it might correspond to a key, at least in an IETF YANG ecosystem.  Is support for UUID really essential?   Why?
>  
> (2) Assuming you really want UUIDs, I am hoping the datatypes can be reconciled between TPM1.2 and TPM2 RPCs.    Is there reason you wouldn't just use the uuid YANG typedef of RFC6991 for both?
>  
> (3) Assuming you really want UUIDs, you need to propose how a UUID might relate to keys within the IETF ecosystem of YANG models.  
>  
> BTW: If you don't need UUIDs, we could always drop them from the model.  (Leaving them to vendor specific augmentations if necessary.)
>  
> Thanks,
> Eric
>  
> >       |  |     +---w add-version?            boolean
> >       |  |     +---w tpm-name*               string
>  
>  
> _______________________________________________
> RATS mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/rats <https://www.ietf.org/mailman/listinfo/rats>