[Rats] Re: Call for adoption: draft-deshpande-rats-multi-verifier-04 (Ends 2026-04-24)

[Ned Smith IETF <[e-mail]>]

[nms] See my comments below as chair.

On 4/22/26, 8:19 AM, "Muhammad Usama Sardar" <[e-mail]> wrote:


Hi all,

I didn't notice that this is already ongoing.


# Technical concerns

On 17.04.26 16:31, Ned Smith via Datatracker wrote:

Please reply to this message and indicate whether or not you support adoption
of this Internet-Draft by the rats WG. Comments to explain your preference
are greatly appreciated.

I strongly oppose adoption of this draft -04 in its current form because of substantial technical concerns already mentioned several times on the list, in the meetings and in my draft [0].

[nms] The comments in [0] are asking for additional text to highlight potential risks associated with multi-verifier approaches. That isn’t identifying an unresolvable technical gap, rather it suggests approval to move forward but with appropriate guidance on potential risks. Once a draft is adopted it becomes owned by the working group. I don’t see any reason why the WG couldn’t address the concerns raised in [0].

Some recent discussions are [1,2] to which no technical response has been provided. IMHO, this draft in its current form is doing disservice to the community by not properly highlight the security and privacy risks, and by implicitly promoting the blind trust in vendors.

[nms] [1] is making a general request for specialized guidance. Adopting a draft means the WG will give the draft specialized attention. [2] is documenting your concern raised in [0].

Given that neither the draft has addressed these substantial technical concerns nor any technical argument has been provided on list, I believe the document would benefit from further discussion and revision before being considered for adoption. Please let me know if I have missed something.

[nms] There has been significant time for discussion on the list since 124 and 125. This thread is the only discussion that has been rasied.

# Procedural concerns

## Repeated misuse of "Consensus"

I watched the recording of meeting 125. I am deeply concerned about the repeated misuse of the word "consensus" in authors' recent presentations of this draft, because this has happened repeatedly.

In IETF 123, authors said verbally that "consensus has been reached in a side meeting" which is absolutely wrong, because WG business cannot be done in side meetings.

Now in IETF 125, authors are saying and even writing in the slides [3]

"consensus reached in IETF 124"

[nms] This is correct. There was consensus in the meeting at 124 and again at 125. The remaining consideration is whether there are objections from the list.

which is not correct because I voted "no" in IETF 124 and even mentioned on mic that my concerns should be addressed before adoption. I believe claiming "consensus" while my substantial technical concerns remain unaddressed undermines the IETF process. I request technical answers to my technical concerns before adoption.

[nms] The chairs are following appropriate procedures in that they decide the duration of adoption calls. The chairs can chainge their minds about the duration if they so choose.

## Duration of adoption call

IIUC the chairs said two times adoption call will be for at least 2 weeks [4,5] and then Henk asking it again on mic saying "2 or 3 weeks" and chairs confirming it [6]. I don't know what changed it to one week, especially given the confusion in the other thread about adoption. I would like to know if I have missed something.

[nms] This is the only objection that has been raised and based on the time that has expired since the original request in 124 there has been ample time for the topic to be raised on the list. Your objections appear to be captured in [0] which can be addressed by the WG post adoption. Hence, [0] is not a reason to not adopt the draft.


Best,

-Usama


[0] https://www.ietf.org/archive/id/draft-sardar-rats-sec-cons-02.html#section-8.1

[1] https://mailarchive.ietf.org/arch/msg/rats/bL70CcpPS8UwuNbSKygDlMIONdw/

[2] https://mailarchive.ietf.org/arch/msg/rats/dsmW2IODYw2886qju1RwQwdUoyA/

[3] https://datatracker.ietf.org/meeting/125/materials/slides-125-rats-remote-attestation-with-multiple-verifiers-00

[4] https://youtu.be/uNLHwnJRSCI?t=5630

[5] https://youtu.be/uNLHwnJRSCI?t=5652

[6] https://youtu.be/uNLHwnJRSCI?t=5680