Subject: Re: [Rats] draft-birkholz-rats-network-device-subscription-00

From: Dave Thaler <[email-masked]>
Date: Tue, 28 Jul 2020 14:10:28 +0000

I asked in the meeting how a subscriber knows who to subscribe to, and I believe the answer was
that CHARRA answers that.  Well I looked in draft-ietf-rats-yang-tpm-charra-02 and it does not
contain any mention of the subject.  I think one or the other of the two drafts needs to address
this issue.  My preference is that it be in draft-birkholz-rats-network-device-subscription since
that's the draft that talks about limitations like
> Evidence is not streamed to an interested Verifier as soon as it is generated.
Which certainly still applies, it's just another case... you didn't know to subscribe to it until
after the evidence was generated when it booted.

Dave

-----Original Message-----
From: RATS <[email-masked]> On Behalf Of Eric Voit (evoit)
Sent: Wednesday, June 24, 2020 9:41 AM
To: [email-masked]
Cc: Wei Pan <[email-masked]>; Birkholz, Henk <[email-masked]>
Subject: [Rats] draft-birkholz-rats-network-device-subscription-00

Hi All,

This draft defines how to subscribe to a stream of attestation related Evidence on TPM-based network devices.  When subscribed, a Telemetry stream of verifiably fresh YANG notifications (which are generated when TPM PCRs are
extended) are pushed to the subscriber.

This draft integrates:
 *  Section 5 of draft-voit-rats-trusted-path-routing-01
 *  Elements of draft-xia-rats-pubsub-model

Thanks!

Eric, Henk, and Wei

-----Original Message-----
From: [email-masked] <[email-masked]>
Sent: Wednesday, June 24, 2020 12:19 PM
To: Eric Voit (evoit) <[email-masked]>; Wei Pan <[email-masked]>; Henk Birkholz <[email-masked]>
Subject: New Version Notification for
draft-birkholz-rats-network-device-subscription-00.txt

A new version of I-D, draft-birkholz-rats-network-device-subscription-00.txt
has been successfully submitted by Eric Voit and posted to the IETF repository.

Name:		draft-birkholz-rats-network-device-subscription
Revision:	00
Title:		Attestation Event Stream Subscription
Document date:	2020-06-24
Group:		Individual Submission
Pages:		20
URL: 
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Finternet-drafts%2Fdraft-birkholz-rats-network-device-subscription-00.txt&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2a3783449230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637286137029115135&amp;sdata=MnEJ5ZwAh4BlTNs09fk0Vr1H39j5N%2BJdyBQHNJp7BdY%3D&amp;reserved=0
Status: 
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-birkholz-rats-network-device-subscription%2F&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2a3783449230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637286137029115135&amp;sdata=qukLQaq17P4ts20nW1L%2B2dB9zIM9XB9SRcscFWcOeLw%3D&amp;reserved=0
Htmlized: 
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-birkholz-rats-network-device-subscription-00&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2a3783449230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637286137029125095&amp;sdata=Q0TfFjrfHZU%2FKFOT3li4JG0QoBa3Vo%2FkHTp00T6GbZY%3D&amp;reserved=0
Htmlized: 
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-birkholz-rats-network-device-subscription&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2a3783449230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637286137029125095&amp;sdata=RLSvdRTcWX4Gew50X2DL7t2pE7N%2FA%2BKWrAVz0NhsbiA%3D&amp;reserved=0

Abstract:
   This document defines how to subscribe to a stream of attestation
   related Evidence on TPM-based network devices.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Henk Birkholz <[email-masked]>
Date: Tue, 28 Jul 2020 16:17:50 +0200

Hi Dave,

a clarifying question:

What exactly do you mean by the "who" in "a subscriber knows who to 
subscribe to"?

The I-D does not come with its own join/rendezvous/discovery capability. 
That either comes related with YANG Push ("call home"). That would be a 
"who" on the entity level.

Another possibility is that you mean a YANG RPC with the "who"? That 
would be a "who" on the management interface level.

Or you could mean one of the Attesting Environment of a composite 
Attester. Tha would be a "who" on the Attester level. And that is done 
via the included data store.

Or do you mean something I am missing here?

Viele Grüße,

Henk

---

From: "Smith, Ned" <[email-masked]>
Date: Tue, 28 Jul 2020 14:53:45 +0000

Subscription models could be topic based rather than entity based. The use case below suggests that a Verifier is interested in system booting events. A topic-based approach might allow Verifiers to subscribe to "boot image X" as the topic. All entities that collect a Claim for "image X" would publish the Claim to the field of subscribers. 

Is the use of YANG to describe pub/sub limiting the ability to do topic-based pub/sub?
-Ned

On 7/28/20, 7:19 AM, "RATS on behalf of Henk Birkholz" <[email-masked] on behalf of [email-masked]> wrote:

    Hi Dave,

    a clarifying question:

    Viele Grüße,

    Henk

    > Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

    _______________________________________________
    RATS mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/rats

---

From: "Eric Voit (evoit)" <[email-masked]>
Date: Tue, 28 Jul 2020 16:20:34 +0000

> Dave Thaler, July 28, 2020 10:10 AM
> 
> I asked in the meeting how a subscriber knows who to subscribe to, and I
> believe the answer was that CHARRA answers that.  

The answer I gave was that the problem was the same as Charra.  I believe I
also said the problem itself is generic to any YANG based network element (I
don't remember if that came out).  Generalizing more from there, Network
Operators have diverse set embedded management systems which include
discovery, addressability, inventory, etc. of the network devices they
manage.

Moving back to YANG, these network management systems don't include all YANG
info about a device.  So once you have found that a device exists, the
device capabilities it supports can be acquired via a variety of mechanisms
like: 
 - NETCONF RFC 6241, Section 7 (and RFC6470)
 - YANG Library RFC 8525

> Well I looked in draft-
> ietf-rats-yang-tpm-charra-02 and it does not contain any mention of the
> subject.  I think one or the other of the two drafts needs to address this
> issue.  

This topic has not been within the scope of the many other YANG drafts/RFC
which exist.   This is reasonable as there is a huge breadth of topology
discovery protocols available and in-use for routers and switches.

Eric

> My preference is that it be in draft-birkholz-rats-network-device-
> subscription since that's the draft that talks about limitations like
> Which certainly still applies, it's just another case... you didn't know
to
> subscribe to it until after the evidence was generated when it booted.
> 
> Dave
> 
> This draft defines how to subscribe to a stream of attestation related
> Evidence on TPM-based network devices.  When subscribed, a Telemetry
> stream of verifiably fresh YANG notifications (which are generated when
> TPM PCRs are
> To: Eric Voit (evoit) <[email-masked]>; Wei Pan
> <[email-masked]>; Henk Birkholz
> <[email-masked]>
> A new version of I-D,
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> ietf.org%2Finternet-drafts%2Fdraft-birkholz-rats-network-device-
> subscription-
> 00.txt&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2a37834
> 49230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7
> C637286137029115135&amp;sdata=MnEJ5ZwAh4BlTNs09fk0Vr1H39j5N%2BJd
> yBQHNJp7BdY%3D&amp;reserved=0
> Status:
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatat
> racker.ietf.org%2Fdoc%2Fdraft-birkholz-rats-network-device-
> subscription%2F&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C2582
> 5e2a3783449230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7
> C1%7C0%7C637286137029115135&amp;sdata=qukLQaq17P4ts20nW1L%2B2d
> B9zIM9XB9SRcscFWcOeLw%3D&amp;reserved=0
> Htmlized:
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.
> ietf.org%2Fhtml%2Fdraft-birkholz-rats-network-device-subscription-
> 00&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2a37834492
> 30a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63
> 7286137029125095&amp;sdata=Q0TfFjrfHZU%2FKFOT3li4JG0QoBa3Vo%2FkH
> Tp00T6GbZY%3D&amp;reserved=0
> Htmlized:
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatat
> racker.ietf.org%2Fdoc%2Fhtml%2Fdraft-birkholz-rats-network-device-
> subscription&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C25825e2a
> 3783449230a708d8185d77f6%7C72f988bf86f141af91ab2d7cd011db47%7C1%
> 7C0%7C637286137029125095&amp;sdata=RLSvdRTcWX4Gew50X2DL7t2pE7N
> %2FA%2BKWrAVz0NhsbiA%3D&amp;reserved=0
> 
> 
> Abstract:
> Please note that it may take a couple of minutes from the time of
> submission until the htmlized version and diff are available at
tools.ietf.org.