Subject: Re: [Rats] RATS Digest, Vol 35, Issue 24

From: "Oliver, Ian (Nokia - FI/Espoo)" <[email-masked]>
Date: Tue, 27 Apr 2021 06:21:21 +0000

Hi,

very quick comments from me and also aid my (mis)understanding

[DT7]: I'd argue that each Attesting Environment (e.g., each OS or firmware vendor) might similarly support a different set of claims so this is not unique to hardware chips.
[EV7]: We can change 'hardware chip' to 'Attesting Environment'.

Agree with this as hardware chip implies, eg: TPM, whereas "attesting environment" allows for a much broader implementation, eg: container etc.

[DT9]: Does this mean that the Verifier can authenticate both the hardware and the firmware?
[EV9]: In draft-voit-rats-trustworthy-path-routing, we broke out hardware and firmware.  However I was unable to find a real case where a customer might be good with the hardware being ok, but they were not ok with the firmware being not ok.   So from the perspective of the Relying Party + Verifier B, if Verifier A finds any issue here, then flag it.   In general, it is useful to collapse failure states where the Relying Party + Verifier will take the same action no matter what.

>From most practical perspectives F/W==H/W as the latter comes with implicit trust

[DT12]: executables != files. Some executables can be dynamically downloaded and installed without ever being stored as files. (Javascript code running in a browser is one example, but there are many more, including ones running natively, not in an interpreter)
[EV12] Good catch.  Will change 'file' to 'executable'.

Is there a reason for restricting this just to executable items?

t.

Ian

________________________________
From: RATS <[email-masked]> on behalf of [email-masked] <[email-masked]>
Sent: 27 April 2021 02:48
To: [email-masked] <[email-masked]>
Subject: RATS Digest, Vol 35, Issue 24

Send RATS mailing list submissions to
        [email-masked]

To subscribe or unsubscribe via the World Wide Web, visit
        https://www.ietf.org/mailman/listinfo/rats
or, via email, send a message with subject or body 'help' to
        [email-masked]

You can reach the person managing the list at
        [email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of RATS digest..."