Subject: [Rats] Use case document -05

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 7 Oct 2019 16:43:47 -0400

Hi Michael,

I just did a quick review and sent one nit separately before coming up with some more clarification questions/suggestions.

Nit in 5.1.4:

The
      infrastructure is in control of a single operator and is already trusted.

I think you meant “is in the control”.  

Otherwise, we are in trouble. :-)

Also, what is being validated?  The running and configured software from root of trust and/or the software from vendors as provided?

5.1.5
Would each system really do the assessments themselves?  Wouldn’t it be easier to have a relying party (management station/repository) of collected information from each administrative domain?  How do you scale the interactions in a highly complex data center scenario with virtualized systems that are also isolating tenants in container clusters for instance?

5.1.6 - my question above spills into this one.
Also note the typo of having medium in this one.

5.5 critical infrastructure 
Are you providing protection from malware by only allowing specific signers or specific attested code  or both forms of white listing?  Or something else?  I’m assuming both forms of white listing and it would be good to explain that if it’s the case.

Excellent work on this document!  I think we should formally adopt it.

Best regards,
Kathleen 

Sent from my mobile device

---

From: Michael Richardson <[email-masked]>
Date: Tue, 08 Oct 2019 10:21:13 +0200

Kathleen Moriarty <[email-masked]> wrote:
    > I just did a quick review and sent one nit separately before coming up
    > with some more clarification questions/suggestions.

    > Otherwise, we are in trouble. :-)

Oh, yes, that is an interesting change in meaning by the loss of an article.
("I for one, welcome our new skynet overloads")

    > Also, what is being validated?  The running and configured software
    > from root of trust and/or the software from vendors as provided?

My understanding is that this use case is primarily about the NEA situation.
Desktops have to provide attestation that they are running a valid configuration.

    > 5.1.5
    > Would each system really do the assessments themselves?  Wouldn’t it be
    > easier to have a relying party (management station/repository) of
    > collected information from each administrative domain?  How do you
    > scale the interactions in a highly complex data center scenario with
    > virtualized systems that are also isolating tenants in container
    > clusters for instance?

okay, let me think about how to rephrase this.
Individual data centers/buildings would act like 5.1.4, but then would have
to cross-attest.   That's why the N:1:M process.
This is the large university with many departments, each of which might have
their own IT standards, or the government with multiple agencies.

    > Also note the typo of having medium in this one.

This is the case where it's every mobile phone in an operator, and many of
the phones are BYO.

    > Are you providing protection from malware by only allowing specific
    > signers or specific attested code  or both forms of white listing?  Or
    > something else?  I’m assuming both forms of white listing and it would
    > be good to explain that if it’s the case.

This comes out of the side-meeting, about having some critical system
(some safety valve, plant-shutdown switch, Starship Enterprise-Self-Destruct)
want to know more about the device sending the critical instruction.
I'm not sure what it would be.

I can see it invoking much of the FIDO stuff too: making sure that the device
that authenticated the authorizing human was sane.

    > Excellent work on this document!  I think we should formally adopt it.

Sure, that's a good idea so that it occupy 1st class WG schedule time.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 8 Oct 2019 06:49:32 -0400

Hi Michael,

> Desktops have to provide attestation that they are running a valid

OK, NEA is about validating software and controls on systems, it requires
an agent to interrogate systems and is too cumbersome for many to deploy
and manage. Here we will be evaluating a JWT or CWT if EAT is used, ideally
leveraging OTrPv2 from TEEP.  There's the attestations that could come from
the state of the running system from the "root of trust", let's say TEE.
Vendors could also provide an attestation on shipped software that relies
upon other software packages as that vendor has tested and is willing to
provide an assurance on.

> Sure, that's a good idea so that it occupy 1st class WG schedule time.

Thank you for your quick response and consideration.
Kathleen

-- 

Best regards,
Kathleen