Re: [Rats] Paul Wouters' No Objection on draft-ietf-rats-architecture-21: (with COMMENT)

[Michael Richardson <[e-mail]>]

On 2022-09-07 18:00, Paul Wouters via Datatracker wrote:
> #1 Figure 3
> 
> I cannot make sense of Figure 3. I understand the text in Section 3.2, so it
> might not matter. But for instance the figure does not show to me at all that
> the bootloader attested the kernel.
I've spent fifteen minutes wondering how I can make the "Collect Claims" 
arc clearer.  Maybe part of the issue is that the bootloader did not 
attest the kernel.  It didn't check a signature on the kernel, which 
would be secure-boot.  We aren't doing secure-boot, because it's total 
lock-down, and has proven hostile and ineffective over the device lifecycle.

Rather, the bootloader measured the kernel, and it will the verifier 
which will be "Attest" the kernel.  Mostly, we try to avoid using the 
word "Attest" as a verb.

But, I'd like to improve the diagram if at all possible.
Since it's just a repeat of the elements of Figure 2, I wonder how you 
felt about Figure 2: 
https://www.ietf.org/archive/id/draft-ietf-rats-architecture-21.html#section-3.1-2.1.1