[Teep] Trusted Applications vs Trusted Components

[Dave Thaler <[e-mail]>]

Section 4 of draft-ietf-teep-architecture explains that personalization data can
be a separate package that a TA depends on (not bundled with the TA), and
goes on to say:

Ø  The TEEP protocol treats each TA, any dependencies the TA has, and

Ø  personalization data as separate components with separate

Ø  installation steps that are expressed in SUIT manifests, and a SUIT

Ø  manifest might contain or reference multiple binaries (see

Ø  [I-D.ietf-suit-manifest] for more details).
Thus, the TEEP protocol can install anything representable by a SUIT manifest,
whether the binaries represent code or personalization data, or both.

Recall that a TA is defined as:

Ø  - Trusted Application (TA): An application (or, in some implementations,

Ø   an application component) that runs in a TEE.
Thus the "that runs" means a TA is specifically code, not something that might
refer to a SUIT manifest containing only personalization data.

Elsewhere in the arch doc it talked about the TAM installing "Trusted Applications", such as

Ø  A TA Signer selects one or more TAMs and communicates the TA(s) to the TAM.
for example (plenty of other places too), except that such statements should also apply
to personalization data expressed via their own manifest, but the term "TA" implies the
relevant text is limited to things containing code.

The term "trusted components" does appear in the doc in a way that refers to
TAs and/or personalization data, such as in this sentence:

Ø  When the TEEP Agent subsequently receives the TA to install and the TA's manifest

Ø  indicates dependencies on any other trusted components, each dependency can include

Ø  a list of TAM URIs for the relevant dependency.

As a document editor, I would like to make "Trusted Components" a term defined in the
terminology section as referring to TAs and/or Personalization Data, and fix text
that says TA that should instead say Trusted Components more generally.

In theory an alternative approach would be to redefined TAs to not just be code but to also include
only data.  But that would seem to go against the normal human expectation that "app" means
something that has code (and maybe data too, but not data-only).

https://github.com/ietf-teep/architecture/pull/212/files shows proposed diffs if we go ahead
and make the change to use Trusted Components as a more formal term, just like TA is.

Please speak up if you have strong opinions on this editorial change.  I would like to make
a decision one way or the other before the I-D deadline.

Dave