Subject: [Rats] Mail regarding draft-ietf-rats-tpm-based-network-device-attest

From: "Mark D. Baushke" <[email-masked]>
Date: Mon, 12 Oct 2020 07:43:27 -0700

Greetings fellow members of the IETF Rats Workinggroup.

https://tools.ietf.org/html/draft-ietf-rats-tpm-based-network-device-attest-04

I would like to vote in favor of moving to the next step of publshing
this draft as an RFC.

The following is mostly editorial feedback on the current -04 draft:

 * Section 1.4 has [IEEE-802-1AR] and Section 3 has [IEEE-802.1ae]. I
   have been under the possibly mistaken impression that 802.1AR and
   802-1AR should be consistent. and is it 'AR' or 'ar' and is it 'ae'
   or 'AE' ? I respectfully suggest use of IEEE-802-1AE and IEEE-802.1AR
   be used consistently throughout the document.
   
 * Figure 7: RIV Protcol Stacks
 
   This figure explicitly lists UDP, but does not mention TCP even though
   TLS and SSH are noted. It is not a big deal, just a small omission
   that may make the picture too busy.
 
 * Figure 8: Component status

   'TCG TPM DevID' used twice in the table as the controlling
   Specification should probably be something that ties you back to
   either [IEEE-802-1AR] or [Platform-DevID-TPM-2.0] or some other
   reference as 'TCG TPM DevID' is not otherwise identified as a
   specifiction in the document itself.
   
   Gets a bit messy with entries like draft-birkholz-yan-swid in the
   figure. I expect it will be better when that one is an [RFC nnnnn].
   The 'ISO/IEC 19770-2' entry could have been [SWID] to be able to find
   it in the references. There are likely a few other controlling
   specificaiton that are hard to correlate from the table to the
   informative references.

Editorial remark:

  Note that [IMA] has a spurious space before the comma ('and ,') the
  IETF Editor would likely have fixed it anyway.

-- 
Mark D. Baushke
[email-masked]
Distinguished Engineer
Juniper Networks, Inc.
www.juniper.net

---

From: Michael Richardson <[email-masked]>
Date: Mon, 12 Oct 2020 17:41:34 -0400

> be used consistently throughout the document.

802.1AR is _IEEE Standard for Local and Metropolitan Area Networks: Secure
           Device Identity. ("IDevID")

802.1ae is MACsec, which an L2 equivalent for IPsec.  It is appropriately
referenced at the end of section 3.3, I think.

Both references are appropriate, I think.
The IEEE names standards in a case sensitive way, as "ae" and "AE" are
different.

I'm not fond of the title.  It feels like an article is missing,
or just too many qualifiers in a row.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide