Subject: Re: [Rats] IETF draft for NFV remote attestation use-cases

From: AndreRein <[email-masked]>
Date: Wed, 7 Mar 2018 14:33:39 +0000

Hello Henk,

Please find my comments/answers/questions inline.

> -----Original Message-----
> From: Henk Birkholz [mailto:[email-masked]]
> Sent: Mittwoch, 7. März 2018 13:47
> To: AndreRein <[email-masked]>; DIEGO LOPEZ GARCIA
> <[email-masked]>
> Cc: [email-masked]
> Subject: Re: IETF draft for NFV remote attestation use-cases
> 
> Hello Andre,
> 
> cc'ing this reply to the rats list as this is an excellent focus point of discussion.
> 
> A few initial questions: Is an RAIP an Attestor? With respect to...
> 
> > https://henkbirkholz.github.io/draft-birkholz-attestation-terminology/
> > draft-birkholz-attestation-terminology.html
> 
> Correspondingly, is a RAIC a Verifier?

Yes, a RAIP is an Attestor and a RAIC is a Verifier in accordance with your terminology

> 
> It seems that both could also be intermediate roles, as the Pre-Conditions
> sections states: "Relevant collected evidence (RA measurement information)
> is available." The Attestor seems to include a component that is the actual
> data source of evidence - is that a correct assumption?

Also correct, the Attestor implements a component that collects the evidence and offer this evidence to
other systems. With regard to this, the draft used the term RAIP that should indicate this behaviour
(which may not be obvious just from the term)

> 
> Typically, appraisal is about integrity. Are "RA appraisal information"
> therefore "Reference Integrity Measurements" or is the intended scope
> larger here?

You are right, RA appraisal information corresponds to "Reference Integrity Measurements".
I introduced a different terms to avoid the overuse of the terms measurement and attestation, which can sometimes 
becomes ambiguous when talking about the "measurement process", "reference measurements" and
the "verification/appraisal process".

Once we agree on a particular terminology we should update the draft accordingly. (I do explicitly not insist to adopt
my terms; still, I suppose we should have some discussion about the terminology to avoid ambiguity and facilitate preciseness)

> 
> If evidence can be collected, it is implied that it can also be stored, It think. Is
> freshness or recentness of evidence relevant to your use case?

Yes, both freshness and recentness are requirements that are very relevant in this case.

> 
> In general, the CSP is the "external entity" and the CSC is an "internal entity"
> if I understand that correctly?

No, both the CSP and CSC are NFV-internal entities. Internal in this case means that they are
responsible for the operation of the infrastructure or services that are provided.
In contrast to this, a CSU simply uses a service that is provided and is, therefore, considered as an external entity.
More precisely, a CSU is a specific external entity.
(I hope this makes any sense) 

> 
> Does your use case imply any specific characteristics for statements about
> appraisal?

I'm not sure what you mean with characteristics. Can you elaborate what you mean?

> 
> These are the first questions that come to mind. Probably, some answers are
> more obvious than I think :-)
> 
> Viele Grüße,
> 
> Henk
> 
> 
> On 03/06/2018 04:18 PM, AndreRein wrote:
> > I just wanted to inform you that we (Frank Xialiang and me) submitted
> > a draft to the IETF yesterday.
> >
> > You can find it here:
> > https://datatracker.ietf.org/doc/draft-rein-remote-attestation-nfv-use
> > -cases/
> >

---

From: Henk Birkholz <[email-masked]>
Date: Wed, 7 Mar 2018 13:47:14 +0100

Hello Andre,

cc'ing this reply to the rats list as this is an excellent focus point 
of discussion.

> https://henkbirkholz.github.io/draft-birkholz-attestation-terminology/draft-birkholz-attestation-terminology.html

It seems that both could also be intermediate roles, as the 
Pre-Conditions sections states: "Relevant collected evidence (RA 
measurement information) is available." The Attestor seems to include a 
component that is the actual data source of evidence - is that a correct 
assumption?

If evidence can be collected, it is implied that it can also be stored, 
It think. Is freshness or recentness of evidence relevant to your use case?

In general, the CSP is the "external entity" and the CSC is an "internal 
entity" if I understand that correctly?

Does your use case imply any specific characteristics for statements 
about appraisal?

These are the first questions that come to mind. Probably, some answers 
are more obvious than I think :-)

Viele Grüße,

Henk

On 03/06/2018 04:18 PM, AndreRein wrote:
> I just wanted to inform you that we (Frank Xialiang and me) submitted a 
> draft to the IETF yesterday.
> 
> You can find it here: 
> https://datatracker.ietf.org/doc/draft-rein-remote-attestation-nfv-use-cases/
>