Subject: Re: [Rats] TPM background for RIV

From: Guy Fedorkow <[email-masked]>
Date: Tue, 8 Sep 2020 12:57:33 +0000

Hi Michael,

  Sorry for being slow on this.  I agree with Ira, that the RIV doc could
not qualify as a TPM Profile.  There's a lot of in a TPM; to make a profile,
it would have to all be sorted into Include and Exclude piles.

  Although I don't think this is the crux of your question, many of us have
shied away from specialized TPM Profiles for business reasons.  Staying in
sync with PC Client has enabled everyone to benefit from enormous production
volumes.

  But let me know if I'm missing the point of your question.

Thx

/guy

From: RATS <[email-masked] <mailto:[email-masked]> > on behalf
of Ira McDonald <[email-masked] <mailto:[email-masked]> >
Date: Wednesday, August 26, 2020 at 7:22 AM
To: Michael Richardson <[email-masked] <mailto:[email-masked]>
>, Ira McDonald <[email-masked] <mailto:[email-masked]> >
Cc: "[email-masked] <mailto:[email-masked]> " <[email-masked]
<mailto:[email-masked]> >
Subject: Re: [Rats] TPM background for RIV

Hi Michael,

The TCG Network Equipment WG could develop a TCG-approved TPM 2.0

profile for network equipment.  The IETF RATS RIV spec could not be that 

official profile, under TCG rules.  It's also not structured in the proforma

structure of a TCG profile.  For an example of that structure, see:

https://trustedcomputinggroup.org/wp-content/uploads/TPM_2.0_Mobile_Common_P
rofile_v2r31_FINAL.pdf
<https://urldefense.com/v3/__https:/trustedcomputinggroup.org/wp-content/upl
oads/TPM_2.0_Mobile_Common_Profile_v2r31_FINAL.pdf__;!!NEt6yMaO-gk!RakfIGcck
cPjqLYyrPS4mLzCJMXspXlhuBofV9rKb9S3qJYOB9_zfwLwepOIecp8vA8$> 

Cheers,

- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG

Co-Chair - TCG Metadata Access Protocol SG

Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
 
<https://urldefense.com/v3/__http:/sites.google.com/site/blueroofmusic__;!!N
Et6yMaO-gk!RakfIGcckcPjqLYyrPS4mLzCJMXspXlhuBofV9rKb9S3qJYOB9_zfwLwepOISGP2H
qs$> http://sites.google.com/site/blueroofmusic
 
<https://urldefense.com/v3/__http:/sites.google.com/site/highnorthinc__;!!NE
t6yMaO-gk!RakfIGcckcPjqLYyrPS4mLzCJMXspXlhuBofV9rKb9S3qJYOB9_zfwLwepOIKj6U-8
Q$> http://sites.google.com/site/highnorthinc
mailto: [email-masked] <mailto:[email-masked]> 
(permanent) PO Box 221  Grand Marais, MI 49839  906-494-2434

On Wed, Aug 26, 2020 at 10:11 AM Michael Richardson <[email-masked]
<mailto:[email-masked]> > wrote:

Ira McDonald <[email-masked] <mailto:[email-masked]> >
wrote:
    > Sorry for the confusion.

    > No, the MCP doesn't forbid PCR8-PCR15, but it doesn't prescribe
    > their usage either.  No impact on RIV for network equipment.  I was
    > merely noting that TPM 2.0 Library is largely silent on specifics of
    > PCR usage.  And there is presently no TPM 2.0 profile for network
    > equipment.

So, could RIV be that profile?

--
Michael Richardson <[email-masked] <mailto:[email-masked]>
>, Sandelman Software Works
 -= IPv6 IoT consulting =-

Juniper Business Use Only

---

From: Michael Richardson <[email-masked]>
Date: Tue, 08 Sep 2020 11:06:21 -0400

Guy Fedorkow <gfedorkow=[email-masked]> wrote:
    >   Sorry for being slow on this.  I agree with Ira, that the RIV doc
    > could not qualify as a TPM Profile.  There's a lot of in a TPM; to make
    > a profile, it would have to all be sorted into Include and Exclude
    > piles.

    >   Although I don't think this is the crux of your question, many of us
    > have shied away from specialized TPM Profiles for business reasons.

So, not being steeped in the art of TCG Profiles, I would respond with...
. o O ("The Emperor has no clothes")

Either:
    a) RIV should be extended such that it's a proper profile.
    b) TCG Profiles aren't that interesting or useful, so why care?

    > Staying in sync with PC Client has enabled everyone to benefit from
    > enormous production volumes.

It seems that the PC Client Profile has been hacked and abused a lot,
and might not be ideal for routers.

I think, but I could be wrong, that router manufacturers might have the right
volume, and maybe fTPMs are more reasonable now and would reduce the cost.

    >   But let me know if I'm missing the point of your question.

It seems that RIV needs more PCRs, and it can't rely upon them being
available, so it's doing dumb things.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Guy Fedorkow <[email-masked]>
Date: Wed, 9 Sep 2020 18:31:47 +0000

Hi Michael,
  I'd go with Option (b).  I'm not sure why we should worry about TPM profiles.
  Could you be more specific about the dumbness you have in mind?
Thanks
/guy

-----Original Message-----
From: RATS <[email-masked]> On Behalf Of Michael Richardson
Sent: Tuesday, September 8, 2020 11:06 AM
To: [email-masked]
Subject: Re: [Rats] TPM background for RIV

[External Email. Be cautious of content]

Either:

    > enormous production volumes.

It seems that the PC Client Profile has been hacked and abused a lot, and might not be ideal for routers.

I think, but I could be wrong, that router manufacturers might have the right volume, and maybe fTPMs are more reasonable now and would reduce the cost.

    >   But let me know if I'm missing the point of your question.

It seems that RIV needs more PCRs, and it can't rely upon them being available, so it's doing dumb things.