Subject: [sacm] Spencer Dawkins' Yes on charter-ietf-sacm-02-02: (with COMMENT)

From: Spencer Dawkins <[email-masked]>
Date: Wed, 29 Nov 2017 08:08:44 -0800

Spencer Dawkins has entered the following ballot position for
charter-ietf-sacm-02-02: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-sacm/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I'm glad to see work in this space going forward (so, "Yes" ballot position),
but do have some questions that might be worth considering before the charter
is approved.

Disclaimer - SACM is far from being something I understand well, and people
with more clue may have obvious answers, but since I had questions, I'm asking.

I wasn't sure what would actually be extended in the reference to NEA
[https://ietf.org/wg/concluded/nea.html]. Can you point to an NEA RFC that this
work is starting from?

I realize that SACM and SUIT are now on the same telechat agenda, but is there
any relationship between "information about firmware, operating systems, and
software installed on an endpoint" and what you're visualizing for SUIT? ("and
for TEEP" is another question, and maybe premature)

I guess I should ask the same thing about "- Define a method of expressing
software metadata that is suitable for use by constrained devices including a
CBOR-based format derived from the ISO/IEC 19770-2 Software Identification
(SWID) tag standard", later in the charter.

For the evaluation criteria language - is there a candidate starting point for
this work (or even a potential candidate starting point)?

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 29 Nov 2017 11:26:47 -0500

Hi Spencer,

> https://datatracker.ietf.org/doc/charter-ietf-sacm/

Yes, we'll add a reference, thank you.  If the chairs could respond,
I'll take care of the edit.

> (SWID) tag standard", later in the charter.

Excellent question, thanks for raising it.  I guess we'll have to see
what SUIT and TEEP finalize on and then there should be reuse where
possible as it only makes sense to do this once.  If the chairs and
participants could chime in, that would be most helpful.  Luckily a
couple of participants are chairs for SUIT and TEEP.

> this work (or even a potential candidate starting point)?

I'm guessing this is the OVAL work that is deployed by over 50 vendors
and was contributed to the IETF, but the chairs confirming would be
helpful.

-- 

Best regards,
Kathleen

---

From: Chris Inacio <[email-masked]>
Date: Thu, 30 Nov 2017 03:47:46 +0000

Responses inline, speaking as chair as I sense the group.

From: Kathleen Moriarty <[email-masked]><mailto:[email-masked]>
Date: November 29, 2017 at 11:27:36 AM
To: Spencer Dawkins <[email-masked]><mailto:[email-masked]>
Cc: The IESG <[email-masked]><mailto:[email-masked]>, <[email-masked]><mailto:[email-masked]>, [email-masked] <[email-masked]><mailto:[email-masked]>
Subject:  Re: Spencer Dawkins' Yes on charter-ietf-sacm-02-02: (with COMMENT)

Hi Spencer,

In particular the work from NEA that we are extending would be effectively how to take the posture assessment done and use it beyond the time to do initial network provisioning.  Certainly under discussion is PT-TLS (RFC 6876) to transport posture information into a SACM evaluation.

I believe OVAL is a possibility, but not a sure thing.  It solves a particular slice of the problem and we can learn a lot from both its strengths and weaknesses - to which Danny did a good write up.  I do not believe there is consensus on exactly where to start.

--

Best regards,
Kathleen

Regards,
--
Chris Inacio
[email-masked]<mailto:[email-masked]>

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 29 Nov 2017 22:10:34 -0600

Just to call attention to something I did inadvertently ... and to provide
a point of feedback to Chris ...

On Wed, Nov 29, 2017 at 9:47 PM, Chris Inacio <[email-masked]> wrote:

> From: Kathleen Moriarty <[email-masked]>
> <[email-masked]>
> To: Spencer Dawkins <[email-masked]>
> <[email-masked]>
> Cc: The IESG <[email-masked]> <[email-masked]>, <[email-masked]>
> <[email-masked]>, [email-masked] <[email-masked]> <[email-masked]>
> Kathleen, I just noticed that I'm the only YES on this ballot. I support
the work and roughly the current charter enough to ballot YES,  but as far
as I know, I'm not the responsible AD, who should probably be a YES before
the charter is approved :-)

> In particular the work from NEA that we are extending would be effectively
> how to take the posture assessment done and use it beyond the time to do
> initial network provisioning.  Certainly under discussion is PT-TLS (RFC
> 6876) to transport posture information into a SACM evaluation.
>
> >
> I believe OVAL is a possibility, but not a sure thing.  It solves a
> particular slice of the problem and we can learn a lot from both its
> strengths and weaknesses - to which Danny did a good write up.  I do not
> believe there is consensus on exactly where to start.
>
Kathleen is the responsible AD, so do the right thing, but I wonder if
pointing to a possible starting point might be useful for people who might
not have participated in SACM previously - sort of "the working group might
use OVAL as a starting point, so reading it is probably a good place to
start".

If that confuses things for people who HAVE participated in SACM
previously, my suggestion probably isn't helpful!

Thanks,

Spencer

> [email-masked]

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 29 Nov 2017 23:21:32 -0500

Hi Spencer,

On Wed, Nov 29, 2017 at 11:10 PM, Spencer Dawkins at IETF
<[email-masked]> wrote:
> Just to call attention to something I did inadvertently ... and to provide a
> point of feedback to Chris ...
>
>> Cc: The IESG <[email-masked]>, <[email-masked]>, [email-masked]
>> <[email-masked]>
> Kathleen, I just noticed that I'm the only YES on this ballot. I support the
> work and roughly the current charter enough to ballot YES,  but as far as I
> know, I'm not the responsible AD, who should probably be a YES before the
> charter is approved :-)

Thanks, I'll get to that shortly.  This was put into a ballot through
the help of the secretariat, so I missed that step being it was done
through a different process.

> If that confuses things for people who HAVE participated in SACM previously,
> my suggestion probably isn't helpful!

Having something makes sense, but I'd like the chairs to weigh in on
the text prior to making any updates.  If they have multiple examples,
that might be better as not to show preference since one has not been
selected.

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 29 Nov 2017 22:39:25 -0600

Hi, Kathleen,

On Wed, Nov 29, 2017 at 10:21 PM, Kathleen Moriarty <
[email-masked]> wrote:

> the

Sure. I've seen this happen on a couple of other documents, usually when a
responsible AD pulls back from a Yes based on discussion during IESG
evaluation, so there are multiple paths to get here. Amy has been quite
good at not only noticing the right number of Yes, No Objections, and
Discusses, but also noticing who the Yeses are from, and I wanted to save
her from having to notice something I'd already noticed :-) ...

> >> > with more clue may have obvious answers, but since I had questions,
> I'm
> >> > asking.
> >> >
> >> > I realize that SACM and SUIT are now on the same telechat agenda, but
> is
> >> > there
> >> > any relationship between "information about firmware, operating
> systems,
> >> > and
> >> > software installed on an endpoint" and what you're visualizing for
> SUIT?
> >> > ("and

Sure, and you and the chairs will do the right thing.

Spencer