Subject: [Rats] Call for adoption draft-moriarty-attestationsets

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Fri, 12 Nov 2021 15:56:02 +0000

Hi,
As we ran out of time in IETF 112, we’ll start the call for adoption for https://datatracker.ietf.org/doc/draft-moriarty-attestationsets/
On the mail list starting today and will close on Nov. 29.

Please provide feedback and comment to this thread, if you are in support please state if you are willing to contribute or review (or both) to the draft; otherwise, please post your concerns.

Thanks,
   Nancy
(as WG chair)

---

From: Michael Richardson <[email-masked]>
Date: Thu, 18 Nov 2021 13:55:41 -0500

I think that the point of this document is to register five claims:
   MPS, LEM, PCR,  FMA,  HSH

I guess that I would expect to find a section on each claim?

While the Introduction has been simplified a bit.
There are four paragraphs in the Introduction, some points, and a closing paragraph:
      -(*) posture automation
      - CIS
      - TPM/boot/NIST
      -(*) PCR values + EAT
      - some things to measure
      - policy/conclusion

I see how (*) relate to section 2's claims, but the rest I still find
irrelevant.  If I skip those paragraphs, then I find that I've lost nothing.

Note that I am in favour of adopting documents early: as soon as the problem
statement has been clearly articulated. I would support adoption of this
document.    {I'm not sure what criteria this WG is using}

I'd also like to understand how this document interacts with the many other
desktop TPM systems out there... the whole SACM/PA-TNC and related NEA works.
It feels like a reset-to-blank, start over again.  (I'm not opposed to that)

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 22 Nov 2021 15:33:31 -0500

Hi Michael,

When grouping sets of attestations, they should align to something, that's
in the sections you've listed as "nothing lost". How do you convey the set
name if it's not part of what is conveyed? To reach scalable automation,
where attestations are shared remotely, we'll indeed have some alignment to
defined sets. CIS Benchmarks, NIST standards, TCG Reference Integrity
measurements are all examples of defined sets with NIST SP 800-193 already
fully attested in local hardware for traditional and hyperscaler vendors.

What needs to be registered will become more clear as implementations flush
out the details and there are a few vendors looking at this model to help
with this problem set - making security simpler to manage.

I hope that helps.

Thanks,
Kathleen

On Thu, Nov 18, 2021 at 1:56 PM Michael Richardson <[email-masked]>
wrote:

> _______________________________________________
> RATS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rats
>

-- 

Best regards,
Kathleen

---

From: Michael Richardson <[email-masked]>
Date: Tue, 23 Nov 2021 05:10:49 -0500

Kathleen Moriarty <[email-masked]> wrote:
    > name if it's not part of what is conveyed?

I don't know what the set name is.
I suspect that the Introduction is not the place to put it.

    > To reach scalable automation,

Great, so why not put this into a section, each, on how those fit into the
claims you want to register?

    > with this problem set - making security simpler to manage.

Great, again, why in the introduction?

    >> document.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 23 Nov 2021 06:47:03 -0500

Thanks for your feedback. I’ll look at updating the draft to address it.

Best regards,
Kathleen 

Sent from my mobile device

> On Nov 23, 2021, at 5:10 AM, Michael Richardson <[email-masked]> wrote:
> 
>