Subject: [Rats] Call for charter consensus

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Fri, 18 Jan 2019 03:38:11 +0000

Hello RATS participants:

At the virtual meeting on 1/16/2019, there was consensus [1] that we should pursue chartering a Working Group with the text reflected in [2].

We need to continue this discussion on the email list as well as gauge continued interest in participating in this work.  Please do so by responding to the following questions:

  1.  Do you support this charter text (full text also provided at the end of email or at [1])?  Or do you have objections or blocking concerns?
  2.  Are you willing to author or participate in the development of the drafts of this WG?
  3.  Are you willing to help review the drafts of this WG?
  4.  Are you interested in implementing drafts of this WG?

Please provide comments including proposed text changes ASAP to provide ample time for discussion.  This call for consensus ends on February 1, 2019.

Thanks, Roman and Nancy

[1] Minutes sent: https://mailarchive.ietf.org/arch/msg/rats/xEwczqnoNgyBYlRTKg35Yo4ccWY
[2] Updated charter sent: https://mailarchive.ietf.org/arch/msg/rats/MQLZIkIK23ZlSBMB5wJjo71bOr0

---

From: Laurence Lundblade <[email-masked]>
Date: Thu, 17 Jan 2019 22:17:30 -0800

Hi Nancy,

The charter lists some types of claims/assertions in the introduction.  That list does not include things like GPS Location, public part of key pairs generated on device, enforced conditions for use of that key, identity of an app requesting a token, and app/user defined claims. Most of these types of claims have been implemented already either by FIDO, Android attestation or other products.  A vision here is that Android or other types of apps prove who they are to the server and pass a lot of data to the relying party via the token, often as input to authentication and financial transaction risk engines. 

I assume it will continue to hold that anyone can add any proprietary claim they want, but a lot of the types of claims/assertions I just mentioned would be valuable as a standard. Some will be relatively easy to standardize. Some may not be. My first thought is that some of the easy obvious ones should be in scope, but we need to draw a line somewhere so we’re not creating claims forever. Not sure where that line is.

Answers to other questions below.

LL

>> On Jan 17, 2019, at 7:38 PM, Nancy Cam-Winget (ncamwing) <[email-masked]> wrote:
> Hello RATS participants:
>  
> 	• Do you support this charter text (full text also provided at the end of email or at [1])?  Or do you have objections or blocking concerns?
Concern described above, not blocking.

> 	• Are you willing to author or participate in the development of the drafts of this WG?
Yes

> 	• Are you willing to help review the drafts of this WG?
Yes

> 	• Are you interested in implementing drafts of this WG?
Yes

> _______________________________________________
> RATS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rats

---

From: Michael Richardson <[email-masked]>
Date: Fri, 18 Jan 2019 09:27:44 -0500

Nancy Cam-Winget (ncamwing) <[email-masked]> wrote:
    > 1 Do you support this charter text (full text also provided at the end of
    > email or at [1])? Or do you have objections or blocking concerns?

I think the charter so far is good enough to start.

    > 2 Are you willing to author or participate in the development of the
    > drafts of this WG?

Yes... Though I am now uncertain about how much time I will get to spend.
(I thought it was going to be lots)

    > 3 Are you willing to help review the drafts of this WG?

Yes.

    > 4 Are you interested in implementing drafts of this WG?

Interested, but not resourced to do so.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 18 Jan 2019 14:50:23 +0000

Hi Nancy,

Yes. The charter is a good starting point.

  1.  Are you willing to author or participate in the development of the drafts of this WG?

Yes

  1.  Are you willing to help review the drafts of this WG?

Yes

  1.  Are you interested in implementing drafts of this WG?

My co-workers are implementing an early version already as part of our Arm Trusted Firmware-M.
We plan to bring our implementation inline with the specifications developed in this group.

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Giridhar Mandyam <[email-masked]>
Date: Fri, 18 Jan 2019 14:52:22 +0000

Yes, I support.  I also agree with the concerns outlined in https://mailarchive.ietf.org/arch/msg/rats/Md9Wo9uoM1t-aplZjUNA4MncOZQ so won’t object if minor changes are made.

Yes.  I am already a co-editor of the EAT draft and would be open to continuing development of https://tools.ietf.org/html/draft-mandyam-tokbind-attest-06 in this working group.

Yes.

Yes.

-Giri Mandyam

From: RATS <[email-masked]> On Behalf Of Nancy Cam-Winget (ncamwing)
Sent: Thursday, January 17, 2019 7:38 PM
To: [email-masked]
Subject: [Rats] Call for charter consensus

CAUTION: This email originated from outside of the organization.
Hello RATS participants:

Thanks, Roman and Nancy

---

From: "Eric Voit (evoit)" <[email-masked]>
Date: Fri, 18 Jan 2019 18:24:30 +0000

From: Nancy Cam-Winget, January 17, 2019 10:38 PM

Hello RATS participants:

1. Do you support this charter text (full text also provided at the end of email or at [1])?  Or do you have objections or blocking concerns?
<Eric> I believe this is the right starting point.

<Eric> Yes

<Eric> Yes

4. Are you interested in implementing drafts of this WG?
<Eric> I am hoping to be a system's level user. 

/Eric

Thanks, Roman and Nancy

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 18 Jan 2019 12:42:19 -0600

Hi Laurence,

> I assume it will continue to hold that anyone can add any proprietary claim they want, but a lot of the types of claims/assertions I just mentioned would be valuable as a standard. Some will be rel…

Those are good points.  I think it's probably premature to wire down a
specific list of claims at charter time, so the list in the introduction
should be treated as exemplary rather than normative, as is typical for
charter introductions.  Perhaps we want to add another bullet "other
factors that could influence trust decisions" to make that more clear.

-Ben

---

From: Laurence Lundblade <[email-masked]>
Date: Fri, 18 Jan 2019 10:51:18 -0800

> factors that could influence trust decisions" to make that more clear.

That definitely works for me.

LL

---

From: Henk Birkholz <[email-masked]>
Date: Fri, 18 Jan 2019 22:14:32 +0100

On 1/18/19 4:38 AM, Nancy Cam-Winget (ncamwing) wrote:
> Hello RATS participants:
> 
> At the virtual meeting on 1/16/2019, there was consensus [1] that we 
> should pursue chartering a Working Group with the text reflected in [2].
> 
> We need to continue this discussion on the email list as well as gauge 
> continued interest in participating in this work.  Please do so by 
> responding to the following questions:
> 
>  1. Do you support this charter text (full text also provided at the end
>     of email or at [1])?  Or do you have objections or blocking concerns?

+1

Comment/non-blocking: As highlighted by the minutes: the scope of 
initial assertions and the corresponding demarcation line wrt assertion 
semantics & reference values are topics to be addressed by the working 
group and not necessarily to be specified by the charter explicitly. If 
there is a list in the charter, staying exemplary and steering the 
course would be their purpose, I think.  Personally, I am leaning 
towards of including that as a working group goal.

>  2. Are you willing to author or participate in the development of the

+1

>  3. Are you willing to help review the drafts of this WG?

+1

>  4. Are you interested in implementing drafts of this WG?

+1

> 
> Please provide comments including proposed text changes ASAP to provide 
> ample time for discussion.  This call for consensus ends on February 1, 
> 2019.
> 
> Thanks, Roman and Nancy
> 
> [1] Minutes sent: 
> https://mailarchive.ietf.org/arch/msg/rats/xEwczqnoNgyBYlRTKg35Yo4ccWY
> 
> [2] Updated charter sent: 
> https://mailarchive.ietf.org/arch/msg/rats/MQLZIkIK23ZlSBMB5wJjo71bOr0

Viele Grüße,

Henk

---

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Fri, 18 Jan 2019 23:57:23 +0000

Thanks Ben and Laurence. It is correct that the intent of the preamble was for the list to be a sample, not an exhaustive list.
Adding the bullet makes good sense and I don't think it affects the actual scope of work or goals.

The charter now reads:

--[ snip ]--
Introduction
==========

Relying parties require evidence about the trustworthiness of remote system components [RFC4949] they interact with. Remote attestation procedures (RATS) enable relying parties to establish a level of confidence in the trustworthiness of remote system components by creating and processing attestation evidence. A relying party can then decide whether to consider a remote system component trustworthy or not.

To improve the confidence in a system component's trustworthiness a relying party may require evidence about:
* system component identity,
* composition of system components, including nested components,
* roots of trust,
* assertion/claim origination or provenance,
* manufacturing origin,
* system component integrity,
* system component configuration, 
* operational state and measurements of steps which led to the operational state, or
* other factors that could influence trust decisions

While domain-specific attestation mechanisms such as Trusted Computing Group (TCG) Trusted Platform Module (TPM)/Trusted Software Stack (TSS), Fast Identity Online (FIDO) Alliance attestation and Android Keystore attestation exist, there is no interoperable way to create and process attestation evidence to make determinations about system components among relying parties of different manufactures and origins. 

Goals
=====

This WG will standardize formats for describing assertions/claims about system components and associated evidence; and procedures and protocols to convey these assertions/claims to the relying parties.  While a relying party may use reference values to assess the assertions/claims the procedures for this activity are out of scope for this WG.

The working group will cooperate and coordinate with other IETF WG such as TEEP, SUIT and SACM as appropriate.  The WG will also evaluate prior work such as NEA and proprietary attestation technologies.

Program of Work
==============

The working group will develop standards supporting interoperable remote attestation procedures for system components. The main deliverables are as follows.

1. Specify a terminology, architecture and use cases that enable explicit (a set of verifiable assertion/claims is transported in the attestation) and implicit (a set of assertions/claims is implied by possession of a secret) attestation techniques.  The architecture may include a system security model for the signing key material and involve at least the system component, system component provider, and the relying authority.

2. Standardize an information model for assertions/claims which provide information about system components characteristics scoped by the specified use-cases.

3. Standardize data models that implements and secures the defined information model (e.g., CBOR Web Token structures [RFC8392], JSON Web Token structures [RFC7519]).

4. Standardize interoperable protocols to securely convey assertions/claims.
--[ snip ]--

On 1/18/19, 10:51, "Laurence Lundblade" <[email-masked]> wrote:

    
    LL

---

From: "Daniel P. Smith" <[email-masked]>
Date: Sat, 19 Jan 2019 15:38:04 -0500

Yes

Yes

Yes

Yes

> https://mailarchive.ietf.org/arch/msg/rats/MQLZIkIK23ZlSBMB5wJjo71bOr0

V/r,
Daniel P. Smith
Apertus Solutions, LLC

---

From: "Fuchs, Andreas" <[email-masked]>
Date: Mon, 21 Jan 2019 15:03:25 +0000

Thanks,
Andreas

---

From: Jessica Fitzgerald-McKay <[email-masked]>
Date: Tue, 22 Jan 2019 11:20:41 -0500

On Thu, Jan 17, 2019 at 10:38 PM Nancy Cam-Winget (ncamwing) <
[email-masked]> wrote:

>    1. Do you support this charter text (full text also provided at the
>    end of email or at [1])?  Or do you have objections or blocking concerns?
>
>
Yes.

>    1.
> Depending upon my availability, yes.

>
>    1.
>    2. Are you willing to help review the drafts of this WG?
>
> Yes.

>
>    1.
>    2. Are you interested in implementing drafts of this WG?
>
> Depending on the availability of others in my org, yes.

>    1.

---

From: William Bellingrath <[email-masked]>
Date: Wed, 23 Jan 2019 01:24:05 +0000

1.  Do you support this charter text (full text also provided at the end of email or at [1])?  Or do you have objections or blocking concerns?
Yes, I support the charter text.

Thank you,
William Bellingrath
Juniper Networks

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Thursday, January 17, 2019 at 7:38 PM
To: "[email-masked]" <[email-masked]>
Subject: [Rats] Call for charter consensus

Hello RATS participants:

Thanks, Roman and Nancy

---

From: "Xialiang (Frank, Network Standard & Patent Dept)" <[email-masked]>
Date: Wed, 23 Jan 2019 06:10:55 +0000

Hi,

B.R.
Frank

发件人: RATS [mailto:[email-masked]] 代表 Nancy Cam-Winget (ncamwing)
发送时间: 2019年1月18日 11:38
收件人: [email-masked]
主题: [Rats] Call for charter consensus

Hello RATS participants:

Thanks, Roman and Nancy

---

From: Monty Wiseman <[email-masked]>
Date: Wed, 23 Jan 2019 15:00:23 -0500

Yes, I support this charter with no objections.

2. Are you willing to author or participate in the development of the 
drafts of this WG?

Yes

Yes

Yes

Monty Wiseman

On 1/17/19 10:38 PM, Nancy Cam-Winget (ncamwing) wrote:
> Please provide comments including proposed text changes ASAP to 
> provide ample time for discussion.  This call for consensus ends on 
> February 1, 2019.
>
> Thanks, Roman and Nancy
>
> [1] Minutes sent:

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 24 Jan 2019 17:58:32 +0100

> 	• Do you support this charter text (full text also provided at the end of email or at [1])?  Or do you have objections or blocking concerns?

I support the charter text as the initial charter of the WG.
(As I said in the call, I believe that, if the WG successfully addresses its work, there will be other items we want to make sure are being addressed; but this can wait a little until the WG gets some real work done and submitted to the IESG.)

Yes.

Yes.

> 	• Are you interested in implementing drafts of this WG?

(I’d expect students to do much of the actual implementation work, but in the sense of making the implementation happen and having a hand in that:)  Yes.

Grüße, Carsten

---

From: Frank MATTHIAS KOVATSCH <[email-masked]>
Date: Wed, 30 Jan 2019 16:10:47 +0000

> 1. Do you support this charter text (full text also provided at the end of email or at [1])?  Or do you have objections or blocking concerns?

Yes, no objections/concerns

Yes

Yes

Yes

Regards,
Matthias

---

From: "Laffey, Tom (HPE Aruba)" <[email-masked]>
Date: Wed, 30 Jan 2019 21:32:41 +0000

Hi,

Thanks for getting this started. I reviewed the updated charter posted on January 17. Questions answered inline below.

Regards,
Tom

From: RATS [mailto:[email-masked]] On Behalf Of Nancy Cam-Winget (ncamwing)
Sent: Thursday, January 17, 2019 7:38 PM
To: [email-masked]
Subject: [Rats] Call for charter consensus

Hello RATS participants:

  1.  Do you support this charter text (full text also provided at the end of email or at [1])?
TL> Yes
Or do you have objections or blocking concerns?

TL> Yes

TL> Yes

TL> Yes.

Thanks, Roman and Nancy

---

From: Anthony Nadalin <[email-masked]>
Date: Thu, 31 Jan 2019 18:07:30 +0000

Here is my response

  1.  Do you support this charter text (full text also provided at the end of email or at [1])?  Or do you have objections or blocking concerns? In full support, and no objections
  2.  Are you willing to author or participate in the development of the drafts of this WG? Yes
  3.  Are you willing to help review the drafts of this WG? yes
  4.  Are you interested in implementing drafts of this WG? yes

Thanks, Roman and Nancy

[1] Minutes sent: https://mailarchive.ietf.org/arch/msg/rats/xEwczqnoNgyBYlRTKg35Yo4ccWY<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmailarchive.ietf.org%2Farch%2Fmsg%2Frats%2FxEwczqnoNgyBYlRTKg35Yo4ccWY&data=02%7C01%7Ctonynad%40microsoft.com%7Ca13beffa603a41f947c408d682e6d7b1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636840325314024880&sdata=qj3UEZt3JhVuNwfhAINtkrFRpvNbZpxc2i8RQ67lW9A%3D&reserved=0>
[2] Updated charter sent: https://mailarchive.ietf.org/arch/msg/rats/MQLZIkIK23ZlSBMB5wJjo71bOr0<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmailarchive.ietf.org%2Farch%2Fmsg%2Frats%2FMQLZIkIK23ZlSBMB5wJjo71bOr0&data=02%7C01%7Ctonynad%40microsoft.com%7Ca13beffa603a41f947c408d682e6d7b1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636840325314024880&sdata=LpkDTO%2Babk%2Fyet5zF9Xt4pgnHzAApwCqUE0a0ala6OI%3D&reserved=0>

_______________________________________________
RATS mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/rats<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Frats&data=02%7C01%7Ctonynad%40microsoft.com%7Ca13beffa603a41f947c408d682e6d7b1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636840325314024880&sdata=PFbBxEivE7W6YNXIsQUSD4x7tZo%2F7HeO7C4yfXM9rD8%3D&reserved=0>