Re: [Rats] looking for better terms -- request for bike shed discussion

[Laurence Lundblade <[e-mail]>]

Here’s some rough text:

Conceptually, the “attester” produces a set of “claims” about a “target”. The claims are known as “attestation evidence” and are sent to the “verifier”. The verifier additionally takes in “endorsements”, processes the attestation evidence and produces the “attestation result” for the final consumer, the “relying party”.

This description left conceptual for easy understanding and discussion. Actual implementations are usually more complex in at least one or more of these ways:

* The attester is also the target
* One attester produces claims about several targets (submodules)
* The verifier and the relying party are the same
* Claims may be simple or complex, many or few
* Some claims are measurements and some are not
* Some claims in in the attestation evidence may be simply passed through the verifier, others may be heavily processed.
* Daisy chaining  -- the evidence from one attester goes through a verifier producing results which are taken as claims that are input to another attester that outputs a different set of evidence that goes on through a different verifier.
* Daisy chaining may happen on the device producing the attestations or in the infrastructure evaluating the device or both.

(Next I’d write a plethoras of simple examples for attester, target, claims… assuming only the simplest implementation that maps to the conceptual description )


I am starting to prefer the basic conceptual / abstract description over one that is inherently mappable to every possible.

LL



 



> On Jan 7, 2020, at 1:43 PM, Smith, Ned <[e-mail]> wrote:
> 
> It may be helpful to note that the Attester may not be the same as the environment that measures. In some cases it is the same but not in all cases. The Attester contains both (1) and (2) so it seems we don't want to overload (1) or (2) with a term that is the superset of both. 
> 
> If there is consensus terminology for either (1) or (2) then we only need to change one of them. 
> 
> The analogy to CC seems somewhat apropos as attestation could be described as the partial automation of a (manual) certification process. Indeed, the result of CC evaluation could be a claim in a manifest or certificate issued by an Endorser. The Verifier likely would expect to find an overlap between the ToE and the "Attested Environment".
> 
> -Ned
> 
> 
> On 1/7/20, 8:54 AM, "RATS on behalf of Schönwälder, Jürgen" <[e-mail] on behalf of [e-mail]> wrote:
> 
>    Attesterr and target have also been my first thought...
> 
>    /js
> 
>    On Tue, Jan 07, 2020 at 08:37:28AM -0800, Laurence Lundblade wrote:
>> How about (1) “attester" and (2) “target" or “subject”? 
>> 
>> Currently the EAT draft roughly uses “entity” and “submodule” for (2), but only roughly because it doesn’t distinguish between (1) and (2).
>> 
>> Attestation is not certification, but somewhat similarly Common Criteria certification uses “target of evaluation”.
>> 
>> LL
>> 
>>> On Jan 7, 2020, at 8:04 AM, Michael Richardson <[e-mail]> wrote:
>>> 
>>> 
>>> None of us have been happy with the confusion due to the alliterative
>>> terms "Attesting Environment"(1) and "Attested Environment"(2)
>>> 
>>> We agree that (1) *measures* (2).
>>> 
>>> We think that we could keep one of the terms (1) or (2) if we could come with
>>> a different enough term for the other.  There is an issue open:
>>> https://github.com/ietf-rats-wg/architecture/issues/14
>>> 
>>> I asked Google, "What is a person who measures", and the answer it gave me
>>> was "surveyor".  There was criticism of this term because it sounds too
>>> active. (To "survey" in the civil engineering sense is quite active)
>>> 
>>> What do you think?
>>> 
>>> https://www.thesaurus.com/browse/surveyor?s=t
>>> 
>>> assessor
>>> cartographer
>>> measurer
>>> land surveyor
>>> mapmaker
>>> topographer
>>> 
>>> 
>>> https://www.thesaurus.com/browse/survey?s=t
>>> 
>>> includes a bunch of interesting words, some of which we use already:
>>> 
>>> assess
>>> canvass
>>> check
>>> check out
>>> estimate
>>> evaluate
>>> examine
>>> inspect
>>> look over
>>> observe
>>> overlook
>>> oversee
>>> review
>>> scan
>>> supervise
>>> appraise
>>> assay
>>> case
>>> contemplate
>>> measure
>>> plan
>>> plot
>>> prospect
>>> rate
>>> read
>>> reconnoiter
>>> research
>>> scope
>>> size
>>> study
>>> summarize
>>> superintend
>>> valuate
>>> value
>>> view
>>> check over
>>> check up
>>> give the once over
>>> look upon
>>> set at
>>> size up
>>> stake out
>>> test the waters
>>> 
>>> 
>>> 
>>> 
>>> --
>>> Michael Richardson <[e-mail]>, Sandelman Software Works
>>> -= IPv6 IoT consulting =-
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> RATS mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/rats
>> 
>> _______________________________________________
>> RATS mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/rats
> 
>    -- 
>    Juergen Schoenwaelder           Jacobs University Bremen gGmbH
>    Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
>    Fax:   [phone]         <https://www.jacobs-university.de/>
>    _______________________________________________
>    RATS mailing list
>    [e-mail]
>    https://www.ietf.org/mailman/listinfo/rats
> 
>