Subject: [Rats] Reminder on RATS scope

From: Roman Danyliw <[email-masked]>
Date: Tue, 14 Dec 2021 17:40:36 +0000

Hi!

Congratulations to the WG on the recent push of documents heading to the IESG or in WGLC.  I am enthusiastic to see this progress.

As the WG considers the future work that needs to be done, I wanted to reiterate the charter scope [1] in terms of the common language we have established through the architecture document [2].  I appreciate that there might be ambiguity as the charter language wasn't written with the benefit of this common terminology or the insights the WG has gotten since starting in 2019.  

In scope activities are:
** Architecture (to include extensions, but not alternatives) and use cases (plural) documentation (informational documents) for RATS regardless of which components are involved
** Protocols, formats and procedures for the communication between (a) the attester and verifier, and (b) the verifier and the relying party

Out of scope activities are:
** Protocols involving the endorser, reference value provider, verification owner, relying party owner as their primary focus
** Formats for endorsements, reference values, appraisal policy for evidence, or appraisal policy for attestation results 

It has not escaped my attention that a number of the individual (unadopted) drafts [3], some under WG discussion, are out of scope per the charter.  I leave it to the WG to consider if they have both the energy and interest to consider broader scope.  I would strongly recommend that the next time the WG updates the charter with new scope, the terminology be harmonized. 

Regards,
Roman

[1] https://datatracker.ietf.org/wg/rats/about/
[2] Figure 1. https://datatracker.ietf.org/doc/draft-ietf-rats-architecture/
[3] https://datatracker.ietf.org/wg/rats/documents/

---

From: Thomas Hardjono <[email-masked]>
Date: Tue, 14 Dec 2021 20:43:22 +0000

Thanks Roman,

The field of trusted computing is fairly complex, and it is understandable that the RATS Charter was intentionally limited in scope initially.

However, the RATS Architecture is not a standalone work that lives in a vacuum. There are other organizations outside the IETF paying attention to the RATS Architecture.

With this in mind, another draft that has an impact beyond the IETF is the CoRIM draft (which is expressing the notion of RIMM that the TCG first published in 2006 in its Reference Architecture for Interoperability).

So I view the CoRIM draft as crucial for interoperability across systems, and could become a lowest denominator for Interop across standards organizations.

As such, I would like to indicate strong support for the CoRIM draft to be adopted as a work-item (even before the re-charter occurs, which may take some months yet).

Best

--thomas

________________________________________
From: RATS [[email-masked]] on behalf of Roman Danyliw [[email-masked]]
Sent: Tuesday, December 14, 2021 12:40 PM
To: [email-masked]
Subject: [Rats] Reminder on RATS scope

Hi!

In scope activities are:

Regards,
Roman

_______________________________________________
RATS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/rats

---

From: Roman Danyliw <[email-masked]>
Date: Tue, 14 Dec 2021 21:05:27 +0000

Hi Thomas!

> -----Original Message-----
> From: RATS <[email-masked]> On Behalf Of Thomas Hardjono
> Sent: Tuesday, December 14, 2021 3:43 PM
> To: Roman Danyliw <[email-masked]>; [email-masked]
> Subject: Re: [Rats] Reminder on RATS scope
> 
> 
> Thanks Roman,
> 
> The field of trusted computing is fairly complex, and it is understandable that
> the RATS Charter was intentionally limited in scope initially.
> 
> However, the RATS Architecture is not a standalone work that lives in a
> vacuum. There are other organizations outside the IETF paying attention to the
> RATS Architecture.

Wonderful.  We should help these outside entities building up the RATS work.

> With this in mind, another draft that has an impact beyond the IETF is the
> CoRIM draft (which is expressing the notion of RIMM that the TCG first
> published in 2006 in its Reference Architecture for Interoperability).
> 
> So I view the CoRIM draft as crucial for interoperability across systems, and
> could become a lowest denominator for Interop across standards organizations.
> 
> As such, I would like to indicate strong support for the CoRIM draft to be
> adopted as a work-item (even before the re-charter occurs, which may take
> some months yet).

To be clarify IETF process (and take no position on CoRIM), there is no construct for adopting a draft that is out of scope of the charter.  The WG can discuss this individual draft and even arrive at consensus for wanting to adopt it, but formal adoption requires the document to be in scope for the charter.  There are rare instances where mistakes happen -- documents are adopted without checking the charter, but then these documents will likely eventually stall pending scope resolution.  For example, [1] is in IESG review with a blocking DISCUSS since it appears it is out of scope.

Regards,
Roman

[1] https://datatracker.ietf.org/doc/draft-ietf-lwig-curve-representations/ballot/

> Congratulations to the WG on the recent push of documents heading to the
> IESG or in WGLC.  I am enthusiastic to see this progress.
> 
> As the WG considers the future work that needs to be done, I wanted to
> reiterate the charter scope [1] in terms of the common language we have
> established through the architecture document [2].  I appreciate that there
> might be ambiguity as the charter language wasn't written with the benefit of
> this common terminology or the insights the WG has gotten since starting in
> 2019.
> 
> In scope activities are:
> ** Architecture (to include extensions, but not alternatives) and use cases
> (plural) documentation (informational documents) for RATS regardless of which
> components are involved
> ** Protocols, formats and procedures for the communication between (a) the
> attester and verifier, and (b) the verifier and the relying party
> 
> ** Protocols involving the endorser, reference value provider, verification
> owner, relying party owner as their primary focus
> ** Formats for endorsements, reference values, appraisal policy for evidence,
> or appraisal policy for attestation results
> 
> It has not escaped my attention that a number of the individual (unadopted)
> drafts [3], some under WG discussion, are out of scope per the charter.  I leave
> it to the WG to consider if they have both the energy and interest to consider
> broader scope.  I would strongly recommend that the next time the WG
> updates the charter with new scope, the terminology be harmonized.
> 
> Regards,
> Roman
>

---

From: "Eric Voit (evoit)" <[email-masked]>
Date: Wed, 15 Dec 2021 19:27:04 +0000

> From: Roman Danyliw, December 14, 2021 4:05 PM
>
> Hi Thomas!
> 
> > The field of trusted computing is fairly complex, and it is
> > understandable that the RATS Charter was intentionally limited in scope
> initially.
> >
> > However, the RATS Architecture is not a standalone work that lives in
> > a vacuum. There are other organizations outside the IETF paying
> > attention to the RATS Architecture.
> 
> > With this in mind, another draft that has an impact beyond the IETF is
> > the CoRIM draft (which is expressing the notion of RIMM that the TCG
> > first published in 2006 in its Reference Architecture for
Interoperability).
> >
> > So I view the CoRIM draft as crucial for interoperability across
> > systems, and could become a lowest denominator for Interop across
> standards organizations.
> >
> > As such, I would like to indicate strong support for the CoRIM draft
> > to be adopted as a work-item (even before the re-charter occurs, which
> > may take some months yet).
> 
> To be clarify IETF process (and take no position on CoRIM), there is no
construct
> for adopting a draft that is out of scope of the charter.  The WG can
discuss this
> individual draft and even arrive at consensus for wanting to adopt it, but
formal
> adoption requires the document to be in scope for the charter.  There are
rare
> instances where mistakes happen -- documents are adopted without checking
> the charter, but then these documents will likely eventually stall pending
scope
> resolution.  For example, [1] is in IESG review with a blocking DISCUSS
since it
> appears it is out of scope.

We do need reference measurements covered somewhere.  Otherwise I am not
sure how a multi-vendor Verifier might be supportable.  So I would support a
limited charter change related to this.  I suspect this was previously
out-of-scope because the architecture wasn't done.

Eric

> > Congratulations to the WG on the recent push of documents heading to
> > the IESG or in WGLC.  I am enthusiastic to see this progress.
> >
> > reiterate the charter scope [1] in terms of the common language we
> > have established through the architecture document [2].  I appreciate
> > that there might be ambiguity as the charter language wasn't written
> > with the benefit of this common terminology or the insights the WG has
> > gotten since starting in 2019.
> >
> > In scope activities are:
> > (plural) documentation (informational documents) for RATS regardless
> > of which components are involved
> > ** Protocols, formats and procedures for the communication between (a)
> > the attester and verifier, and (b) the verifier and the relying party
> >
> > ** Protocols involving the endorser, reference value provider,
> > verification owner, relying party owner as their primary focus
> > ** Formats for endorsements, reference values, appraisal policy for
> > evidence, or appraisal policy for attestation results
> >
> > It has not escaped my attention that a number of the individual
> > (unadopted) drafts [3], some under WG discussion, are out of scope per
> > the charter.  I leave it to the WG to consider if they have both the
> > energy and interest to consider broader scope.  I would strongly
> > recommend that the next time the WG updates the charter with new scope,
> the terminology be harmonized.
> >
> > Regards,
> > Roman
> >
> > [2] Figure 1.
> > https://datatracker.ietf.org/doc/draft-ietf-rats-architecture/

---

From: Guy Fedorkow <[email-masked]>
Date: Wed, 15 Dec 2021 20:14:40 +0000

I agree with Eric; I understand that a blanket inclusion of anything that looks like a reference value would be a problem for RATS, but that in the context of RIV, it's pretty hard to see how it can be interoperable if we can't include material on reference measurements.
  Thanks,
  /guy

Juniper Business Use Only

-----Original Message-----
From: RATS <[email-masked]> On Behalf Of Eric Voit (evoit)
Sent: Wednesday, December 15, 2021 2:27 PM
To: Roman Danyliw <[email-masked]>; Thomas Hardjono <[email-masked]>
Cc: [email-masked]
Subject: Re: [Rats] Reminder on RATS scope

[External Email. Be cautious of content]

> > However, the RATS Architecture is not a standalone work that lives 
> > in a vacuum. There are other organizations outside the IETF paying 
> > With this in mind, another draft that has an impact beyond the IETF 
> > is the CoRIM draft (which is expressing the notion of RIMM that the 
> > TCG first published in 2006 in its Reference Architecture for
Interoperability).
> > to be adopted as a work-item (even before the re-charter occurs, 
> > which may take some months yet).
>
construct
discuss this
formal
rare
> instances where mistakes happen -- documents are adopted without 
> checking the charter, but then these documents will likely eventually 
> stall pending
scope
since it
> appears it is out of scope.

We do need reference measurements covered somewhere.  Otherwise I am not sure how a multi-vendor Verifier might be supportable.  So I would support a limited charter change related to this.  I suspect this was previously out-of-scope because the architecture wasn't done.

Eric

> > As the WG considers the future work that needs to be done, I wanted 
> > to reiterate the charter scope [1] in terms of the common language 
> > we have established through the architecture document [2].  I 
> > appreciate that there might be ambiguity as the charter language 
> > wasn't written with the benefit of this common terminology or the 
> > insights the WG has gotten since starting in 2019.
> >
> > In scope activities are:
> > ** Protocols, formats and procedures for the communication between
> > (a) the attester and verifier, and (b) the verifier and the relying 
> > party
> >
> > (unadopted) drafts [3], some under WG discussion, are out of scope 
> > per the charter.  I leave it to the WG to consider if they have both 
> > the energy and interest to consider broader scope.  I would strongly

---

From: Simon Frost <[email-masked]>
Date: Thu, 16 Dec 2021 14:14:27 +0000

<snip>
> From: Eric Voit (evoit) <[email-masked]>
>

I would agree with Eric. There were good reasons to leave the verifier procedures out of scope for the original charter, but as the architecture has progressed, it shows that there are some important parts of the data flows that will need more attention for any system wanting to implement to a standard. Rechartering for all of the top left corner of the architectural diagram seems like a very large scope while a limited change to bring in the CoRIM work appears to be manageable and appropriate.

-Simon
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Ira McDonald <[email-masked]>
Date: Thu, 16 Dec 2021 14:31:49 -0500

Hi Roman,

I agree with you that we should not broadly expand the scope of the RATS
charter.

But I also agree with Thomas H, Guy, Eric, and Simon that a narrow
extension of
the RATS charter to incorporate CoRIM work is very important.

Cheers,
- Ira

*Ira McDonald (Musician / Software Architect)*

*Chair - SAE Trust Anchors and Authentication TF*
*Co-Chair - TCG Trusted Mobility Solutions WG*

*Co-Chair - TCG Metadata Access Protocol SG*

*Chair - Linux Foundation Open Printing WGSecretary - IEEE-ISTO Printer
Working GroupCo-Chair - IEEE-ISTO PWG Internet Printing Protocol WGIETF
Designated Expert - IPP & Printer MIBBlue Roof Music / High North
Inchttp://sites.google.com/site/blueroofmusic
<http://sites.google.com/site/blueroofmusic>http://sites.google.com/site/highnorthinc
<http://sites.google.com/site/highnorthinc>mailto: [email-masked]
<[email-masked]>(permanent) PO Box 221  Grand Marais, MI 49839
906-494-2434*

On Thu, Dec 16, 2021 at 9:14 AM Simon Frost <[email-masked]> wrote:

> I would agree with Eric. There were good reasons to leave the verifier
> procedures out of scope for the original charter, but as the architecture
> has progressed, it shows that there are some important parts of the data
> flows that will need more attention for any system wanting to implement to
> a standard. Rechartering for all of the top left corner of the
> architectural diagram seems like a very large scope while a limited change
> to bring in the CoRIM work appears to be manageable and appropriate.
>
> -Simon
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>

---

From: Jessica Fitzgerald-McKay <[email-masked]>
Date: Thu, 16 Dec 2021 17:15:19 -0500

+1
A limited charter update to include reference measurements would be
beneficial to RIV interoperability, and I expect also CHARRA.

---

From: "Panwei (William)" <[email-masked]>
Date: Fri, 17 Dec 2021 03:42:11 +0000

+1 support of updating the charter to include the CoRIM work.

Regards & Thanks!
Wei Pan (潘伟)

From: RATS [mailto:[email-masked]] On Behalf Of Jessica Fitzgerald-McKay
Sent: Friday, December 17, 2021 6:15 AM
To: Ira McDonald <[email-masked]>
Cc: Roman Danyliw <[email-masked]>; [email-masked]; Thomas Hardjono <[email-masked]>; Eric Voit (evoit) <[email-masked]>; Simon Frost <[email-masked]>
Subject: Re: [Rats] Reminder on RATS scope

+1
A limited charter update to include reference measurements would be beneficial to RIV interoperability, and I expect also CHARRA.

On Thu, Dec 16, 2021, 2:32 PM Ira McDonald <[email-masked]<mailto:[email-masked]>> wrote:
Hi Roman,

I agree with you that we should not broadly expand the scope of the RATS charter.

But I also agree with Thomas H, Guy, Eric, and Simon that a narrow extension of
the RATS charter to incorporate CoRIM work is very important.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Chair - SAE Trust Anchors and Authentication TF
Co-Chair - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Access Protocol SG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]<mailto:[email-masked]>
(permanent) PO Box 221  Grand Marais, MI 49839  906-494-2434

On Thu, Dec 16, 2021 at 9:14 AM Simon Frost <[email-masked]<mailto:[email-masked]>> wrote:
<snip>
> From: Eric Voit (evoit) <[email-masked]<mailto:[email-masked]>>
>

-Simon

_______________________________________________
RATS mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/rats
_______________________________________________
RATS mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/rats

---

From: "Fuchs, Andreas" <[email-masked]>
Date: Fri, 17 Dec 2021 11:06:15 +0000

IMHO endorser and reference value formats and protocols seam highly important

________________________________________
Von: RATS <[email-masked]> im Auftrag von Roman Danyliw <[email-masked]>
Gesendet: Dienstag, 14. Dezember 2021 18:40
An: [email-masked]
Betreff: [Rats] Reminder on RATS scope

Hi!

In scope activities are:

Regards,
Roman

---

From: Henk Birkholz <[email-masked]>
Date: Mon, 20 Dec 2021 15:21:16 +0100

Hi Roman,

we tried to create proposal for a minimalist change to the charter with 
the intent to allow for endorsement and reference values to be in scope.

> https://github.com/ietf-rats/charter/compare/798fd27...2nd-RC1

Viele Grüße,

Henk

---

From: "Diego R. Lopez" <[email-masked]>
Date: Sun, 26 Dec 2021 23:55:09 +0000

Hi,

Taking advantage of the Christmas break for trying to get up-to-date with my pending email, let me share my support to the requests for extending the scope to address enforcer and reference value formats. And Henk's proposal looks good to me.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
https://www.linkedin.com/in/dr2lopez/

e-mail: [email-masked]
Mobile:  +34 682 051 091
----------------------------------

On 20/12/2021, 15:21, "RATS on behalf of Henk Birkholz" <[email-masked] on behalf of [email-masked]> wrote:

    Hi Roman,

    Viele Grüße,

    Henk

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição