Subject: [Rats] Fwd: New Version Notification for draft-moriarty-attestationsets-01.txt

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 2 Apr 2021 15:52:58 -0400

Hello!

The version below takes into account the feedback provided at IETF110.  I'd
like to see if this is of interest for working group adoption (I'm not
starting that as a poll as I am posting as a participant).

Best regards,

---------- Forwarded message ---------
From: <[email-masked]>
Date: Fri, Apr 2, 2021 at 3:41 PM
Subject: New Version Notification for draft-moriarty-attestationsets-01.txt
To: Kathleen M. Moriarty <[email-masked]>

A new version of I-D, draft-moriarty-attestationsets-01.txt
has been successfully submitted by Kathleen M. Moriarty and posted to the
IETF repository.

Name:           draft-moriarty-attestationsets
Revision:       01
Title:          Scalable Remote Attestation for Systems, Containers, and
Applications
Document date:  2021-04-02
Group:          Individual Submission
Pages:          7
URL:
https://www.ietf.org/archive/id/draft-moriarty-attestationsets-01.txt
Status:
https://datatracker.ietf.org/doc/draft-moriarty-attestationsets/
Htmlized:
https://datatracker.ietf.org/doc/html/draft-moriarty-attestationsets
Htmlized:
https://tools.ietf.org/html/draft-moriarty-attestationsets-01
Diff:
https://www.ietf.org/rfcdiff?url2=draft-moriarty-attestationsets-01

Abstract:
   This document establishes an architectural pattern whereby a remote
   attestation could be issued for a complete set of benchmarks or
   controls that are defined and grouped by an external entity,
   preventing the need to send over individual attestations for each
   item within a benchmark or control framework.  This document
   establishes a pattern to list sets of benchmarks and controls within
   CWT and JWT formats for use as an Entity Attestation Token (EAT).

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

-- 

Best regards,
Kathleen

---

From: Michael Richardson <[email-masked]>
Date: Sat, 03 Apr 2021 17:52:42 -0400

Hi, I tried to the read the document.

I found the Introduction to be very harsh, just peppering me with what seem
to be unrelated facts.
I think the first paragraph could perhaps just be deleted.
The second paragraph starts better, but then veers off as well.

I understand that this document aims to register a standard set of claims.

I get the impression that from what I understood from the introduction that
these claims are similar to work that has occured in the past in other fora,
but which did not really work out the way people had hoped.

I suggest that the WG adopt this document and work on it.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 5 Apr 2021 10:54:04 -0400

Hey Michael,

Thank you for reading the document.

> I found the Introduction to be very harsh, just peppering me with what seem
I'd like to understand what you see as harsh, was it the following:
"Posture assessment has long been desired, but has been difficult to
achieve due to complexities of customization requirements at each
organization."

I do see the rest as related, but could improve how it's written to better
demonstrate the relationship if helpful.  The aim is to provide motivation
for a switch and a push to the vendor instead of third parties for posture
assessment.  Security being built in and verified by the providing vendor
would reduce the number of engineers needed overall rather than having
posture assessment continue as a distributed function.

> The second paragraph starts better, but then veers off as well.

The point of this was to demonstrate a case where attestations are centered
around an established set of controls is in place today (NIST 800-193 &
TCG's Reference Integrity Measurements).  Being able to attest the result
of all the attestations and verifications that happen on the system would
then be a remote attestation.  Is an example of where this is working
helpful or not helpful?

> I suggest that the WG adopt this document and work on it.

Thank you.  I'm happy to revise as needed.  Getting the basic concept out
there, and providing the capability that should simplify at least some of
posture assessment is really the goal.

Best regards,
Kathleen

-- 

Best regards,
Kathleen

---

From: Michael Richardson <[email-masked]>
Date: Mon, 05 Apr 2021 19:33:57 -0400

Kathleen Moriarty <[email-masked]> wrote:
    > On Sat, Apr 3, 2021 at 5:52 PM Michael Richardson
    > <[email-masked]> wrote:

    >> I found the Introduction to be very harsh, just peppering me with what
    >> seem to be unrelated facts.

    > achieve due to complexities of customization requirements at each

It's not specific wording, it's the way that the facts are assembled.
They seem like random facts without any connection.  Maybe it makes sense to
you, but that's because you already know what the connection is.
I don't, and I found it very difficult to read.

    >> I think the first paragraph could perhaps just be deleted.  The second
    >> paragraph starts better, but then veers off as well.

    > The point of this was to demonstrate a case where attestations are
    > centered around an established set of controls is in place today (NIST
    > 800-193 & TCG's Reference Integrity Measurements).
    > Being able to attest the result of all the attestations and verifications that happen
    > on the system would then be a remote attestation.  Is an example of
    > where this is working helpful or not helpful?

I think that the examples are useful, but maybe you could do it a different style.
If you make me feel that I need to lookup five 200 page references in the first paragraph, then I
won't be read paragraph two :-)
(I don't know how big the references are.  I didn't look them up.)

    > Thank you.  I'm happy to revise as needed.  Getting the basic concept
    > out there, and providing the capability that should simplify at least
    > some of posture assessment is really the goal.

---

From: Guy Fedorkow <[email-masked]>
Date: Mon, 19 Apr 2021 14:04:43 +0000

Hi Kathleen,
  I think the goal of your draft is to produce a vendor-independent summary of attestation results from a verifier?
Have you looked at Eric's Trusted Path Routing draft?

He and I have been discussing restructuring that work.  Part of is it about routing, which clearly only matters to routers.  But the Trust Vector component might have similar goals to what you'd want to see...  it's a proposal for a standardized summary of the results of verification, with all the implementation and vendor-specific stuff stripped out.  The point is to summarize the results in a form that a downstream relying party could decide what to do without having to know too much about the specific device, e.g. "Device Identity looks valid, firmware integrity checks out, Some of the OS files are suspect", signed by the verifier.  I'd guess it would end up being coded as an EAT token, although I think we have a lot more discussion on the semantic content before we need to worry about coding...

  In restructuring, I think Eric has proposed breaking the draft into at least two parts, one that focuses strictly on the contents of the trust vector, the other that discusses the use in routing.
 Do you think what you're seeking might line up with the first section on Trust Vector?

  Thanks
/guy

Juniper Business Use Only
From: RATS <[email-masked]> On Behalf Of Kathleen Moriarty
Sent: Friday, April 2, 2021 3:53 PM
To: [email-masked]
Subject: [Rats] Fwd: New Version Notification for draft-moriarty-attestationsets-01.txt

[External Email. Be cautious of content]

Hello!

The version below takes into account the feedback provided at IETF110.  I'd like to see if this is of interest for working group adoption (I'm not starting that as a poll as I am posting as a participant).

Best regards,

---------- Forwarded message ---------
From: <[email-masked]<mailto:[email-masked]>>
Date: Fri, Apr 2, 2021 at 3:41 PM
Subject: New Version Notification for draft-moriarty-attestationsets-01.txt
To: Kathleen M. Moriarty <[email-masked]<mailto:[email-masked]>>

Name:           draft-moriarty-attestationsets
Revision:       01
Title:          Scalable Remote Attestation for Systems, Containers, and Applications
Document date:  2021-04-02
Group:          Individual Submission
Pages:          7
URL:            https://www.ietf.org/archive/id/draft-moriarty-attestationsets-01.txt<https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-moriarty-attestationsets-01.txt__;!!NEt6yMaO-gk!VOJooHKu8qo6TpWM4HeTyAWM9ObLNftXuxkZMrNa_7ivLGW7tYekzAmP9iIyqwk4ruQ$>
Status:         https://datatracker.ietf.org/doc/draft-moriarty-attestationsets/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-moriarty-attestationsets/__;!!NEt6yMaO-gk!VOJooHKu8qo6TpWM4HeTyAWM9ObLNftXuxkZMrNa_7ivLGW7tYekzAmP9iIycSIncXU$>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-moriarty-attestationsets<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/html/draft-moriarty-attestationsets__;!!NEt6yMaO-gk!VOJooHKu8qo6TpWM4HeTyAWM9ObLNftXuxkZMrNa_7ivLGW7tYekzAmP9iIyt9-wd2M$>
Htmlized:       https://tools.ietf.org/html/draft-moriarty-attestationsets-01<https://urldefense.com/v3/__https:/tools.ietf.org/html/draft-moriarty-attestationsets-01__;!!NEt6yMaO-gk!VOJooHKu8qo6TpWM4HeTyAWM9ObLNftXuxkZMrNa_7ivLGW7tYekzAmP9iIyGD1nQYE$>
Diff:           https://www.ietf.org/rfcdiff?url2=draft-moriarty-attestationsets-01<https://urldefense.com/v3/__https:/www.ietf.org/rfcdiff?url2=draft-moriarty-attestationsets-01__;!!NEt6yMaO-gk!VOJooHKu8qo6TpWM4HeTyAWM9ObLNftXuxkZMrNa_7ivLGW7tYekzAmP9iIywHb-9Bw$>

Abstract:

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<https://urldefense.com/v3/__http:/tools.ietf.org__;!!NEt6yMaO-gk!VOJooHKu8qo6TpWM4HeTyAWM9ObLNftXuxkZMrNa_7ivLGW7tYekzAmP9iIyQjVJCjE$>.

The IETF Secretariat

--

Best regards,
Kathleen