Subject: Re: [Rats] I-D Action: draft-ietf-rats-architecture-15.txt

From: Michael Richardson <[email-masked]>
Date: Wed, 02 Mar 2022 17:52:13 -0500

Kathleen Moriarty <[email-masked]> wrote:
    > I suggest just removing the word trustworthy in the following sentence:
    > Typically, a trustworthy solution starts with a specific component

We just added the word trustworthy here, but I'll make a PR without that
word, and see how people feel.
https://github.com/ietf-rats-wg/architecture/pull/402

    > Page 9, Section 3:
    > The change to add a description on entity/device also aligns with the usage
    > in NIST SP 800-193, so that should be fine as well.

I'm unclear if there is an action to respond to here.

    > The role text that was added and follows this definition is not as clear as
    > the prior text, IMO.

    > * This is substantial enough that others should weigh in on whether or not
    > this set of text changes should remain and that can happen in last call. I
    > prefer they be removed.

Also not sure what "this" refers to here.

    > The change on page 26/27, #3 introduces language that is not as clear. We
    > know what a root of trust is, even if it can be instantiated in many ways.
    > A 'trusted environment' is less tangible . I think this text should be
    > reverted as well and should be reviewed by the working group as it will
    > likely be caught in IESG review as well.
    > https://www.ietf.org/rfcdiff?url2=draft-ietf-rats-architecture-15

The change was:
OLD: The root of trust protects both the conveyance channel key
     material and the Attesting Environment
     with equivalent strength protections.

NEW: A trusted environment protects the conveyance channel's key
     material which may depend on other Attesting Environments
     with equivalent strength protections

We changed this because, frankly, we really don't know what a root of trust is.
Many people think they do, and then they talk to another person, who also is
sure that they know what it is, but it turns out they are talking about
entirely different things.
This has happened more than twice.

    > The other changes are all fine and should not require additional review. I
    > am happy to progress this and. will watch for discussion and resolution on
    > these two points during IETF last call.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 8 Mar 2022 09:03:24 -0500

Hi Michael,

Sorry again for my delay. Responses in line.

> https://github.com/ietf-rats-wg/architecture/pull/402

Thank you.

> I'm unclear if there is an action to respond to here.
No action there, thanks.

> Also not sure what "this" refers to here.

The addition of the roles text, I'm not in favor of this addition and think
it is more than editorial and think it doesn't add anything to help the
document.

> This has happened more than twice.

Then we need to define it more precisely rather than use other terms that
rely on a root of trust - something to put your trust in. It might be a
lack of understanding on PKI that leads to the differences, not sure. A
trusted environment relies on a root of trust - usually a key and
certificate pair who's path validation provides a trusted root. If
something happens to that root of trust, it is no longer trusted, then
anything that signed it is no longer trustworthy. If something happens to
the individual key used, then that key is no longer trustworthy and is
revoked.

Trustworthiness relies on something that can enable you to assess the level
of trust and decide if you agree that it is trustworthy.

Thank you,
Kathleen

-- 

Best regards,
Kathleen