Re: [Teep] Status of TEEP protocol draft, and its dependency on SUIT

[[e-mail]]

Thanks Hannes!   

 

I merged 364.

366 has a conflict to resolve, and then can be merged.

I will look at 358 tomorrow.

Regarding 356, we need feedback from the suit-mti authors, I don’t have an opinion myself.

 

Dave

 

From: TEEP <[e-mail]> On Behalf Of Hannes Tschofenig
Sent: Tuesday, October 17, 2023 9:13 PM
To: Dave Thaler <[e-mail]>
Cc: Mingliang Pei <[e-mail]>; Akira Tsukamoto <[e-mail]>; [e-mail]; [e-mail]; Brendan Moran <[e-mail]>
Subject: Re: [Teep] Status of TEEP protocol draft, and its dependency on SUIT

 

Hi Dave,

 

thanks for your email. 

 

- I closed PR #359 ("s/bit is clear/bit is cleared") since you guys didn't agree with it.

- I changed PR#366 ("Encryption-related editorial improvements")  and reversed the change regarding the normative reference.

- I added a comment regarding PR# 358 ("Removing statement about Token Usage")

- I approved PR# 364 ("*.suit Filename") 

 

Regarding PR #356 ("No reference to each suit-cose-profiles") I need your feedback to tell me whether I am on the wrong track with my view about AES-CTR.

I shared my views on the mailing list about it. 

 

Ciao

Hannes

 

On Tue, Oct 17, 2023 at 11:05 PM Dave Thaler <[e-mail] <mailto:[e-mail]> > wrote:

Hi TEEP folks, I'd really like to get done with the teep-protocol specification.
It's gone through WGLC and has a shepherd write-up associated with the document already, last changed in July:
https://datatracker.ietf.org/doc/draft-ietf-teep-protocol/shepherdwriteup/
And we discussed the draft at the joint SUIT/TEEP interim meeting.

That said, there are several github pull requests waiting for review or chairs to confirm consensus.

* https://github.com/ietf-teep/teep-protocol/issues/356 ("No reference to each suit-cose-profiles")
        In this issue Ken pointed out that we reference profiles that no longer exist in draft-ietf-suit-mti-02,
        And proposed changing from GCM to CTR.  I filed https://github.com/ietf-teep/teep-protocol/pull/373
        to do that, which we discussed in the interim meeting.
        Since then, Hannes argued that draft-ietf-suit-mti should be changed to put GCM back in, but I haven't
        seen any of the suit-mti authors respond to that, which is holding up the teep protocol spec.
        https://mailarchive.ietf.org/arch/msg/suit/qJayE5LG6mmYaSfaEHUGxT0OSDQ/
        Hence cc'ing Brendan and the SUIT chairs on this email.
        Earlier Ken had filed https://github.com/ietf-teep/teep-protocol/pull/351 which is an alternative
        that uses GCM rather than CTR and so we're in limbo not knowing whether PR 351 or 356 can be done
        in referencing suit-mti or diverging from it.

All the other issues below are, I believe, purely editorial cleanup...

* https://github.com/ietf-teep/teep-protocol/issues/364 ("*.suit Filename")
        In this issue Hannes didn't like the examples having a manifest filename ending in .suit but didn't propose
        how to address. Last week I filed https://github.com/ietf-teep/teep-protocol/pull/376 that just removes
        the .suit from the end of the example filenames, and it is still waiting for approval from other authors.

* https://github.com/ietf-teep/teep-protocol/pull/358 ("Removing statement about Token Usage")
        Hannes filed this claiming there is no relationship between the token and the attestation bit.
        But as I mentioned in the PR comments 2 weeks ago there is a relationship that was discussed at
        IETF 109 and 110, with pointers in the comments, so I believe it reflects consensus as is.  I'm happy to
        reopen discussion if a technical reason is given to remove the relationship but so far no rationale has
        been provided, so this PR has not been approved so far.

* https://github.com/ietf-teep/teep-protocol/pull/366 ("Encryption-related editorial improvements")
        This PR has not been approved since it proposes changing firmware encryption to be a normative
        reference while not changing the citing language, which is at least in my reading, informative.

* https://github.com/ietf-teep/teep-protocol/pull/359 ("s/bit is clear/bit is cleared")
        This one is a trivial grammatical debate that should not hold up the doc.  Grammarly says the doc
        is more correct as written, so this PR has not been approved so far.

The I-D deadline is next Monday but I am traveling starting this Friday so want to see it
submitted by Friday.  If others have views, please weigh in asap.

Thanks,
Dave