Re: [Teep] Status of TEEP protocol draft, and its dependency on SUIT

[Hannes Tschofenig <[e-mail]>]

Hi Dave,

thanks for your email.

- I closed PR #359 ("s/bit is clear/bit is cleared") since you guys didn't
agree with it.
- I changed PR#366 ("Encryption-related editorial improvements")  and
reversed the change regarding the normative reference.
- I added a comment regarding PR# 358 ("Removing statement about Token
Usage")
- I approved PR# 364 ("*.suit Filename")

Regarding PR #356 ("No reference to each suit-cose-profiles") I need your
feedback to tell me whether I am on the wrong track with my view about
AES-CTR.
I shared my views on the mailing list about it.

Ciao
Hannes

On Tue, Oct 17, 2023 at 11:05 PM Dave Thaler <[e-mail]> wrote:

> Hi TEEP folks, I'd really like to get done with the teep-protocol
> specification.
> It's gone through WGLC and has a shepherd write-up associated with the
> document already, last changed in July:
> https://datatracker.ietf.org/doc/draft-ietf-teep-protocol/shepherdwriteup/
> And we discussed the draft at the joint SUIT/TEEP interim meeting.
>
> That said, there are several github pull requests waiting for review or
> chairs to confirm consensus.
>
> * https://github.com/ietf-teep/teep-protocol/issues/356 ("No reference to
> each suit-cose-profiles")
>         In this issue Ken pointed out that we reference profiles that no
> longer exist in draft-ietf-suit-mti-02,
>         And proposed changing from GCM to CTR.  I filed
> https://github.com/ietf-teep/teep-protocol/pull/373
>         to do that, which we discussed in the interim meeting.
>         Since then, Hannes argued that draft-ietf-suit-mti should be
> changed to put GCM back in, but I haven't
>         seen any of the suit-mti authors respond to that, which is holding
> up the teep protocol spec.
>
> https://mailarchive.ietf.org/arch/msg/suit/qJayE5LG6mmYaSfaEHUGxT0OSDQ/
>         Hence cc'ing Brendan and the SUIT chairs on this email.
>         Earlier Ken had filed
> https://github.com/ietf-teep/teep-protocol/pull/351 which is an
> alternative
>         that uses GCM rather than CTR and so we're in limbo not knowing
> whether PR 351 or 356 can be done
>         in referencing suit-mti or diverging from it.
>
> All the other issues below are, I believe, purely editorial cleanup...
>
> * https://github.com/ietf-teep/teep-protocol/issues/364 ("*.suit
> Filename")
>         In this issue Hannes didn't like the examples having a manifest
> filename ending in .suit but didn't propose
>         how to address. Last week I filed
> https://github.com/ietf-teep/teep-protocol/pull/376 that just removes
>         the .suit from the end of the example filenames, and it is still
> waiting for approval from other authors.
>
> * https://github.com/ietf-teep/teep-protocol/pull/358 ("Removing
> statement about Token Usage")
>         Hannes filed this claiming there is no relationship between the
> token and the attestation bit.
>         But as I mentioned in the PR comments 2 weeks ago there is a
> relationship that was discussed at
>         IETF 109 and 110, with pointers in the comments, so I believe it
> reflects consensus as is.  I'm happy to
>         reopen discussion if a technical reason is given to remove the
> relationship but so far no rationale has
>         been provided, so this PR has not been approved so far.
>
> * https://github.com/ietf-teep/teep-protocol/pull/366
> ("Encryption-related editorial improvements")
>         This PR has not been approved since it proposes changing firmware
> encryption to be a normative
>         reference while not changing the citing language, which is at
> least in my reading, informative.
>
> * https://github.com/ietf-teep/teep-protocol/pull/359 ("s/bit is
> clear/bit is cleared")
>         This one is a trivial grammatical debate that should not hold up
> the doc.  Grammarly says the doc
>         is more correct as written, so this PR has not been approved so
> far.
>
> The I-D deadline is next Monday but I am traveling starting this Friday so
> want to see it
> submitted by Friday.  If others have views, please weigh in asap.
>
> Thanks,
> Dave
>
>
>