Re: [Rats] Implementation report

[Henk Birkholz <[e-mail]>]

Hi Kathleen,

thank you for the pointers! Will you be in Brisbane?

Looking at your last link, I am wondering if there are plans for future 
projects. Say... remote attestation based authenticity assurance in the 
software supply chain chain: and I am thinking along the lines of 
"Trustworthy SBOMs", which would be scenario that would combine various 
building blocks and that is definitely still in demand of more standards 
consolidation.

Because 
https://learn.cisecurity.org/built-in-security-scale-hardware-support
cited https://www.cisa.gov/securebydesign, I am reeling Alan into this 
reply. So that he is aware that we could do something meaningful here :-)


Viele Grüße,

Henk

On 13.02.24 15:58, Kathleen Moriarty wrote:
> Greetings!
> 
> Last year, I introduced my team to RATS work and pulled together a 
> project that was a lead in to the attestation sets draft, implementing 
> largely what's described in 
> https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/ 
> <https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/>
> 
> It took some time to complete due to some hyperscaler environments not 
> having a TPM or access to it from the container orchestration platform 
> or virtual server host. Once we secured an environment where this was 
> possible, through use of the IMA libraries (created for this purpose and 
> previously proven by RedHat), positive results were demonstrated. The 
> objective was to test assurance to CIS Benchmarks as that was my 
> employer at the time. We hope you find this report useful.
> 
> https://www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical <https://www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical>
> 
> This was done at the same time other team members were researching the 
> prevalence of TPMs and TEEs in infrastructure. The purpose of that work 
> was to signal that hardware support is increasingly available and should 
> be used to ease configuration management and posture assurance capabilities.
> 
> https://www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support <https://www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support>
> 
> The timeline could include more data points, we included key points.
> 
> I am copying John Schmidt who did the work. Sean Turner joined the 
> project in September and assisted with key management, application of 
> cryptography, and validation. Thank you both for your great work to 
> successfully implement this PoC!
> 
> --
> 
> Best regards,
> Kathleen
> 
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats