[Drip] Discussion on Registries using RATS, SUIT and ACE

[Adam Wiethuechter <[e-mail]>]

All,

This was brought up during IETF112 session by Robin Wilton (?) as it may have some good synergy.

I personally think this is a good insight. Previously I had considered it but without a strong sense of the interactions/parties at the time decided to shelve the question until it was clearer. When Daniel asked the specific question of which entity in RATS it would be mapped to (Relying Party or Verifier) the collective answer between me and Rob was "uhhh".

Here are my current thoughts:

I am more familiar with RATS and SUIT than ACE so I will discuss on those points more specifically.

RATS is mostly likely too heavy for small UAS (sUAS). They most likely won't have such ability to perform attestation anyways and the manufacturers would be reluctant to add such ability into their low-end/low-cost sUAS - in fear of increase the cost of the product. The only thing I foresee is maybe SUIT being used to perform firmware updates - but this area I am unfamiliar with what is current anyway. This is speculation of course but I tread cautiously being unfamiliar with what is available and how fragmented/diverse the drone hardware/software space is.

Now for larger UAS the likelihood of such capabilities, to perform RATS and use SUIT regularly, becomes a bit more obvious and practical. UAS like this are custom built for a task and cost significantly more. Those customers are more likely organization that have the infrastructure to support such things - where sUAS owners are a typical citizen so the infrastructure would have to be provided (for free or at cost) to them by some other party. This means that the provider would need to support the many different methods manufacturers implement - most of which will be low-cost drones without such capabilities.

So, a potential way forward to me is as follows:

The current draft-wiethuechter-drip-registries should stay somewhat generic and define a baseline standard to perform registration. I propose that the standard moethod is using EPP/RDAP - which mostly uses HTTP and other well defined and non-intrusive methods. The draft also outlines the overall registry architecture. A new draft specifying how RATS/SUIT/ACE can be used. It would be more of an extension to the first document - allowing a different interface that gives more trust (always a good thing!).

We could in theory tool the current draft-wiethuechter-drip-registries to be more Registry Architecture specific (perhaps rename when we adopt?) and have two "implementation" drafts: an EPP/RDAP one that is required to be implemented (in the Registry Architecture) for DRIP and a RATS/SUIT/ACE one that is optional.

Overall, I see the value in have RATS and SUIT in the registry discussion - the question is how and where we bring it into play.
Thoughts?

--------
73,
Adam T. Wiethuechter
Software Engineer; AX Enterprize, LLC