Subject: Re: [Rats] I-D Action: draft-birkholz-rats-mud-00.txt

From: "Panwei (William)" <[email-masked]>
Date: Tue, 28 Apr 2020 09:10:57 +0000

Hi Henk,

I've read your draft of using MUD in RATS, it's a very clever and practical idea. MUD provides a mechanism for the manufacturer to describe the usage or characteristics of the device, and the Appraisal Policy for Evidence and Endorsement are also one kind of information that the manufacturer knows and can describe in the MUD File.

Below are some personal ideas:

1. For now, in the draft, you only define three URIs in the MUD File, and the Verifier needs to retrieve the CoSWID-styled RIMs and CWT-styled Endorsements based on these URIs. I agree that this is one way to do. Still, I also think there is an alternative way that is directly defining the YANG module for the RATS-related information (reference values, endorsements, etc.). The MUD File is already YANG-modeled, so defining YANG-styled RATS-related information can save the implementation work for those Verifiers which don't support CoSWID or CWT.

2. Except embedding the MUD URL in DevID, RFC8520 also describes using DHCP and LLDP to convey the MUD URL. Although the latter two ways can't provide explicit protection for the authenticity and integrity of the MUD URL, RFC8520 doesn't forbid these two ways and leave the security to the industry to consider because the trust may come from other out-of-band methods. So I suggest not to limit to only use DevID in this draft, but allow the DHCP and LLDP ways and let the industry to consider how to provide trust.

3. You use MUD URI in this draft while RFC8520 uses MUD URL, I think it's better to be consistent with RFC8520.

Regards & Thanks!
Wei Pan

> -----Original Message-----
> From: I-D-Announce [mailto:[email-masked]] On Behalf
> Of [email-masked]
> Sent: Tuesday, March 10, 2020 7:54 AM
> To: [email-masked]
> Subject: I-D Action: draft-birkholz-rats-mud-00.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> 
> 
>         Title           : MUD-Based RATS Resources Discovery
>         Author          : Henk Birkholz
> 	Filename        : draft-birkholz-rats-mud-00.txt
> 	Pages           : 9
> 	Date            : 2020-03-09
> 
> Abstract:
>    Manufacturer Usage Description (MUD) files and the MUD URI that
> point
>    to them are defined in RFC 8520.  This document introduces a new type
>    of MUD file to be delivered in conjunction with a MUD file signature
>    and/or to be referenced via a MUD URI embedded in an IEEE 802.1AR
>    Secure Device Identifier (DevID).  A DevID is a device specific pub-
>    key identity document that can be presented to other entities, e.g. a
>    network management system.  If this entity is also a verifier as
>    defined by the IETF Remote ATtestation procedureS (RATS)
>    architecture, this verifier can use the references found in the MUD
>    file specified in this document in order to discover appropriate
>    Reference Integrity Measurements (RIM), Endorsement Documents, or
>    even globally suitable Remote Attestation Services (RAS).  All three
>    types of theses resources are required to conduct RATS.  Hence, the
>    MUD file defined in this document enables remote attestation
>    procedures by supporting the discovery of these required resources or
>    services.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-birkholz-rats-mud/
> 
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-birkholz-rats-mud-00
> https://datatracker.ietf.org/doc/html/draft-birkholz-rats-mud-00
> 
> 
> Please note that it may take a couple of minutes from the time of
> submission until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html or
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt