Re: [Teep] Review of draft-ietf-teep-architecture-12

[Dave Thaler <[e-mail]>]

Thanks Russ for checking!

I've now entered this as issue #206 (https://github.com/ietf-teep/architecture/issues/206).

Dave

-----Original Message-----
From: TEEP <[e-mail]> On Behalf Of Russ Housley
Sent: Monday, July 27, 2020 12:51 PM
To: teep <[e-mail]>
Subject: Re: [Teep] Review of draft-ietf-teep-architecture-12

I had previously submitted comments on the -08 version of the document.

The following comments from the previous review do not seem to be addressed:

> 5) Section 3.3 talks about the Internet of Things.  It does not talk about the billions of devices being used to mount DDoS attacks.  Can it cover that too?  Without putting the network interface inside the TEE, I'm skeptical there is a solution.
> 
> 6) Section 3.4 talks about Confidential Cloud Computing.  Can something be said in Section 4.4.1 to make this less abstract?

Regarding 6), the original Section 4.4.1 gone, and Section 1 does not seem like a good place to resolve this comment.  In the current document structure, I think a sentence or two needs to appear in Section 3.4.

In addition, I have a few new comments based on the revised document.

Section 2: Since my last review, Raw Public Key was added.  Please add [RFC5280] as the reference for a "PKIX certificate".

Section 4.1: now says:

      ...  A TA Signer or
      Device Administrator may run their own TAM, but the devices they
      wish to manage must include this TAM's public key/certificate
      [RFC5280], or a certificate it chains up to, in the Trust Anchor
      Store.

The meaning of "/" is unclear.  I think it means "or",  Please spell it out.

Section 5: s/content encryption key/content-encryption key/

Section 9.2: s/provides protection/provide protection/

Section 9.2 says: "... user/tenant ...".  Again, I think the slash means "or".

Section 9.2 uses the term "payload security".  For alignment with Section 5.5, I think it should say "payload encryption".

Section 9.4 talks about compromise and expiration.  I do not think about expiration as a form of compromise, so I think the title of the section should be expanded.

Russ




_______________________________________________
TEEP mailing list
[e-mail]
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C786764eb45f742f8b79c08d8326672b9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637314762885446719&amp;sdata=i15FnuehPc9n8Eo81wvQG3bh9rdooYQIYI%2FocjJ3UsQ%3D&amp;reserved=0