Subject: Re: [Rats] Review of draft-birkholz-rats-uccs-01

From: Henk Birkholz <[email-masked]>
Date: Mon, 17 Aug 2020 12:38:48 +0200

Thank Russ!

we will discuss all feedback as soon as we find a time for an author's 
meeting. Sorry for for the latency, I was out-of-office for a while.

Viele Grüße,

Henk

On 30.07.20 22:45, Russ Housley wrote:
> # Major Concerns
> 
> In Section 3.1, the re are two MUST requirements, but they are not presented clearly.  The are:
> 
>     1)  The secure channel MUST authenticate the Verifier to the Attester.
> 
>     2)  The secure channel MUST protect the integrity of the communications from the Verifier to the Attester.
> 
> The way it is written also requires integrity protection in both directions.  Is that really needed?
> 
> In Section 3.1, says:
> 
>     Further, the provider of the UCCS SHOULD be
>     authenticated by the reciever to ensure the channel is truly secured
>     and the sender is validated.
> 
> I do not understand what this is trying to say beyond the MUST requirement above.  Maybe part of the problem is the mixing of the discussion about authentication and integrity.
> 
> In Section 3, when talking about confidentiality, I think that it would be better to say:
> 
>        If confidentiality is also required, the secure channel SHOULD mutually authenticate Verifier and the Attester.
> 
> 
> # Minor concerns
> 
> In section 1, the phrase "Secure Channel provides the correct properties" is a bit troublesome.  The properties are not difficult to explain in a sentence or two, so they should just be stated here.  Also, the sentences that follow can be omitted if you simply include in the summary of the "correct properties" that the party sending the UCCS is authenticated.
> 
> In Section 1.1, please add Verifier and Attester the the terms that are defined.
> 
> 
> # Nits
> 
> General: Why are Claim and Secure Chanel capitalized?
> 
> In section 1.1, please add a reference for the CWT Claims Registry.
> 
> In section 2, please add a reference for a device's trusted execution environment (probably the TEEP architecture draft).
> 
> 
> Russ
> _______________________________________________
> RATS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rats
>