Subject: [Rats] Comments on work items 4 and 5 in charter

From: Laurence Lundblade <[email-masked]>
Date: Fri, 11 Jan 2019 13:20:48 -0800

From charter: 4. Specify interoperable protocols to securely convey assertions/claims.
It seems this can just be mostly HTTP POST/GET. Maybe we need to define where the nonce is conveyed in HTTP (body? header?). Is it much more than this? 

5. Specify interoperable protocols to appraise attestation evidence via reference values.
The obvious way to convey known-good-values is to use the same data model as the values in the token. It even comes with signing. So k-g-v is just a repurposed token. 

We can move then around with HTTP too.

Where it gets interesting is when k-g-v needs to be a range rather than just a comparison. For example you might want to allow for a range of SW versions or allow something to be up to 24 hours old, but no older. It would be good to think about how ranges of values might work when defining claims.

It could go further with complex Boolean expressions for matching claim values. If claim X == “zzz” or claim Y == “qqqq”….

If this work is kept really simple, for example just HTTP transport and simple comparison to known-good-values, it doesn’t seem too big a stretch to include in the scope of work.

LL

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 13 Jan 2019 11:09:59 -0600

> It seems this can just be mostly HTTP POST/GET. Maybe we need to define where the nonce is conveyed in HTTP (body? header?). Is it much more than this? 

It doesn't have to be complicated, but it does have to be specified.
(Is it necessarily embedded in a larger protocol or could it be a
.well-known/ resource?  What are the data structures conveyed in the HTTP
request/response?)

-Ben

> Where it gets interesting is when k-g-v needs to be a range rather than just a comparison. For example you might want to allow for a range of SW versions or allow something to be up to 24 hours old…

Indeed.  Though if things get tough we could consider alternatives to
reusing the token data model/format.

-Ben

> _______________________________________________
> RATS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rats