Subject: [Rats] Primary and secondary trust flows in RATS

From: Laurence Lundblade <[email-masked]>
Date: Thu, 30 Jul 2020 18:05:28 -0700

In recently reviewing the RATS architecture, I think the trust flows between the major entities can be classified as primary and secondary.

The primary trust flow is how the RP comes trust to the attester/device/manufacturer. It is the main purpose of attestation.

The secondary trust flow is about privacy and confidentiality of endorsements, policy, evidence and results. You can do attestation without it if there is nothing to hide.

Below are diagrams for both.  

I went through the Trust Model (7) section of  draft-thaler-rats-architecture-05 and could easily classify each paragraph as to whether it addresses the primary or secondary trust flow, which I think validates the primary/secondary distinction.

I’m sharing this here on the RATS list rather than just filing issues and PRs against RATS architecture because I think it is a useful general concept, but also think it would be helpful to incorporate it into the document:
Consider adding the diagrams below to the document and the transitive nature of the primary trust flow
The sections on the Attester (7.2) and Endorser (7.5) only discuss the secondary trust flow. I think they really need to have text about there role in the primary trust flow.
7.4 on the Verifier Trust is very confusing to me. I don’t think Verifiers ever trust Attesters directly. It is only through the Endorser/Manufacturer that they come to transitively trust an  Attester
LL