[Suit] SUIT-related Claims

Russ Housley <housley@vigilsec.com> Fri, 25 March 2022 19:04 UTC

From: Russ Housley <housley@vigilsec.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.21\))
Message-Id: <6E7C7269-799C-4E1F-BFF1-854F5A107B2D@vigilsec.com>
Date: Fri, 25 Mar 2022 15:04:55 -0400
To: suit <suit@ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/buPLUek8nCBVzUT3cwXoLajJ0wM>
Subject: [Suit] SUIT-related Claims
Precedence: list

When we ran out of time at the end of the IETF 113 session, four options for handling SUIT-related claims were outlined.  The way forward may have an impact on RATS and TEEP as well as SUIT, so we should resolve this issue as promptly as possible.

	• Dave Thaler: There are four possible ways to use SUIT reports:
		• (AS): Use SUIT report AS an evidence format instead of eat
		• (IN): Use SUIT report encapsulated IN an eat (what is on Brendan's slide)
		• (TO): Use SUIT report to translate claims TO an eat (e.g., what Brendan mentioned might do to translate info to attestation result fields)
		• (WITH): Use SUIT report separate from (i.e., WITH) attestation, e.g., send in a message to a relying party where the message has both evidence and the suit report in separate parts of the message
	• Dave Thaler: Today in TEEP there is no requirement that a TEEP Agent must generate SUIT reports at boot time, only at Update time.  Should there be?  Requiring #1 or #2 would introduce such a requirement.
	• Dave Thaler: Should we add SUIT reports to the QueryResponse message in TEEP to allow #4?

Please continue this discussion on the mailing list.

[Suit] SUIT-related Claims Russ Housley