[saag] Re: 回复: FW: Interests on Initiating the standardization work related to "Zero Trust"?

[Xueting Li <[e-mail]>]

Hi Usama,
Thank you for your valuable comments and references—they help clarify the positioning of our document and we greatly appreciate your engagement. Below is our response to your points:

1. Core Differences from the Two SEAT Drafts
Your referenced drafts [1][2] focus on communication-layer device state verification (via TLS post-handshake attestation) to supplement TLS with device/software integrity checks. Our document targets network-layer trust mechanism reconstruction:
Scope: Addresses systemic risks of the perimeter-centric model (lateral movement, control/management plane vulnerabilities) by extending zero trust to the entire network, not just endpoint communication.
Verification Object: Validates all network entities and interactions (internal communications, control messages, management operations), not just individual device runtime states.
Goal: Transforms the "hard shell, soft interior" network into a resilient system with dynamic trust assessment—an architecture upgrade, not just a protocol supplement. 
2. Response to Specific Comments
Sec.8 Performance Overhead: Included as unaddressed latency/load may degrade availability or prompt disabling security controls, creating gaps—aligning with IETF’s focus on operational risks impacting security.
Missing Reference Details: We have supplemented it in the new version.
3. Document Update
We’ve released a new version of the draft: draft-li-zt-consideration-01, which adds detailed descriptions of management plane risks (e.g., API/orchestration vulnerabilities) to strengthen the problem statement.
URL: https://www.ietf.org/archive/id/draft-li-zt-consideration-01.txt

Thank you again for your constructive feedback. We welcome further feedback on the updated draft.

Best regards,
Xueting 
China Telecom


[e-mail]
 
发件人： Muhammad Usama Sardar
发送时间： 2025-12-31 16:31
收件人： Xueting Li; saag
抄送： wangaijun
主题： Re: [saag] 回复: FW: Interests on Initiating the standardization work related to "Zero Trust"?
Hi Xueting and Aijun,

On 31.12.25 03:58, Xueting Li wrote:
We warmly welcome your comments, suggestions, and involvement. Please feel free to share your feedback.
I appreciate that you warmly welcome further comments, but I kindly ask you to warmly address them as well. How is it addressing my questions/concerns in [0]? In particular, see network infrastructure integrity [1]. 
Your goal seems to be "continuous, dynamic verification" which can be done by post-handshake attestation [2*].

Sec.8: I don't understand what performance overhead has got to do with security consideration? 
References are missing important details, e.g., author names and links.
And why is it standards track?

-Usama

[0] https://mailarchive.ietf.org/arch/msg/saag/5yJGI21NKtUz18jD-AQbF7pJdok/
[1] https://www.ietf.org/archive/id/draft-mihalcea-seat-use-cases-00.html#section-3.3
[2*] https://tls-attestation.github.io/exported-attestation/draft-fossati-seat-expat.html

* Apologies for mentioning the editors' draft. We will roll out the updates in the corresponding draft early next year.