Subject: Re: [Rats] Next Steps after IETF 103 BoF

From: Michael Richardson <[email-masked]>
Date: Tue, 01 Jan 2019 19:51:03 -0500

Roman Danyliw <[email-masked]> wrote:
    > The IETF 103 BoF demonstrated the need for continued discussion on
    > scoping the proposed work.  Robust private conversations have occurred,
    > but none on the list -- a key ingredient to charter work.  To foster
    > the further conversation:

    > Almost every step forward will require some charter language.

I liked your explanation.
Is there a way that scope 1 is not a subset of scope 2?

I see how the slide to rows correspond to the charter "Program of work",
but I don't understand where the scope 1/scope 2 (columns) comes from.

Perhaps there is a private conversation that needs to be summarized?

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Roman Danyliw <[email-masked]>
Date: Wed, 2 Jan 2019 01:52:54 +0000

Hi Michael!

> -----Original Message-----
> From: RATS [mailto:[email-masked]] On Behalf Of Michael Richardson
> Sent: Tuesday, January 1, 2019 7:51 PM
> To: Roman Danyliw <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [Rats] Next Steps after IETF 103 BoF
> 
> 

We heard different user stories which stressed different sets of devices (and their related assumptions).  Scope 2 is a subset of Scope 1 with regards to roots of trust (Scope 1 makes no assumptions; Scope 2 assumes a TPM).  Scope 1 is a subset in the broadest sense of the program work items -- anyone disagree?

> I see how the slide to rows correspond to the charter "Program of work", but
> I don't understand where the scope 1/scope 2 (columns) comes from.
> 

The categories named Scope 1 and 2 are something invented by Nancy and me to summarize what we've heard at the BoF and observed in private conversations.  Practically, Scope 1 roughly aligns around an EAT-like model (draft-mandyam-eat-00) and Scope 2 around the more comprehensive architecture described in draft-birkholz-rats-architecture-00.  At the BoF we heard significant ambiguity about standardization work that would line up under program work items #4 - 5 (the work items that primarily distinguish Scope 1 and 2).

These slides were made to foster discussion and get us discussing how to move forward.  Please do comment if they do or do not represent what we need to work out to advance.

Roman

---

From: Laurence Lundblade <[email-masked]>
Date: Mon, 7 Jan 2019 13:59:47 -0800

Comments below.

> On Jan 1, 2019, at 5:52 PM, Roman Danyliw <[email-masked]> wrote:
> 
> Hi Michael!
> 

I agree.

> The categories named Scope 1 and 2 are something invented by Nancy and me to summarize what we've heard at the BoF and observed in private conversations.  Practically, Scope 1 roughly aligns around…

The frame up of scope 1 and 2 makes sense to me.

I see this whole attestation topic as one that unfolds over a period of many years. This comes from personal experience with its evolution inside Qualcomm and the FIDO Alliance. It takes time for people to absorb it. That means I hope this WG continues for a while (probably some re chartering) to fully build out the solution.

So, I’m OK with just biting of scope 1 to start with.

If we are going to consider scope 2, I’d like to see some concrete real examples of what it would look like. For example the EAT draft shows something about what scope 1 looks like. Something similar for work items #4 and #5 might make me much more comfortable with scope 2.

LL

---

From: Michael Richardson <[email-masked]>
Date: Wed, 09 Jan 2019 10:57:52 -0500

Laurence Lundblade <[email-masked]> wrote:
    > I see this whole attestation topic as one that unfolds over a period of
    > many years. This comes from personal experience with its evolution
    > inside Qualcomm and the FIDO Alliance. It takes time for people to
    > absorb it. That means I hope this WG continues for a while (probably
    > some re chartering) to fully build out the solution.

I agree with both points.

    > If we are going to consider scope 2, I’d like to see some concrete real
    > examples of what it would look like. For example the EAT draft shows
    > something about what scope 1 looks like. Something similar for work
    > items #4 and #5 might make me much more comfortable with scope 2.

It is my intention to start a use-case document this month, and see if the WG
likes it.