Subject: [sacm] MUD

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 6 Jul 2018 09:31:47 -0400

Dear SACM list participants!

If Manufacturer Usage Description (MUD) gets traction, how does it fit
into SACM's work?  I'm assuming it's another possible avenue to
acquire policy information on systems and is a good fit.  This is more
limited than other mechanisms explored, but may be useful.  What are
your thoughts?

https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/?include_text=1

-- 

Best regards,
Kathleen

---

From: Eliot Lear <[email-masked]>
Date: Fri, 6 Jul 2018 17:01:49 +0200

Hi Henk,

This time around I will not be in Montreal but I am quite happy to
discuss in advance or after.  Remote attestation is quite the rage.  I
see that there is a separate EAT Bar BoF going on as well.  I strongly
suggest that you guys combine.  Now is a very good time to talk about
RIMM retrieval.  Can you repoint me to the spec for this?

Eliot

On 06.07.18 16:22, Henk Birkholz wrote:
> Hi Eliot!
>
> I hope you are well!
>
> Do you think this is an appropriate moment to bring up RIMM retrieval
> via MUD URI embedded in DevID or CoID?
>
> It's not exactly SACM, so I could reply to you and Kathleen (and not
> all SACM), because that is still a missing building block that I did
> not find the time for yet, to address.
>
> But we do a RATS (Remote Attestation Procedures) Bar BoF on Thursday
> evening (after sessions) in Montreal and maybe we could discuss that
> there, also?
>
> Viele Grüße,
>
> Henk
>
> On 07/06/2018 03:31 PM, Kathleen Moriarty wrote:

---

From: Henk Birkholz <[email-masked]>
Date: Fri, 6 Jul 2018 17:35:50 +0200

The RIMMs I am thinking of are (of course, minor bias) defined as an 
array of CoSWID in an appendix of 
https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/

The activity of appraisal of evidence conducted by a Verifier in the 
context of remote attestation is defined in 
https://datatracker.ietf.org/doc/draft-birkholz-attestation-terminology/

Viele Grüße,

Henk