Subject: [Rats] Alissa Cooper's Block on charter-ietf-rats-00-00: (with BLOCK and COMMENT)

From: Alissa Cooper <[email-masked]>
Date: Thu, 07 Feb 2019 06:36:54 -0800

Alissa Cooper has entered the following ballot position for
charter-ietf-rats-00-00: Block

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-rats/

----------------------------------------------------------------------
BLOCK:
----------------------------------------------------------------------

Given that the data to be exchanged for remote attestation purposes could be
security-sensitive or could be used to fingerprint a device or identify a user,
I think the charter needs to explicitly state what the WG's goals are for
taking the protection of this data into account.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Given that TCG and FIDO Alliance work are both mentioned, I wonder if it is
worth explicitly saying that the WG will coordinate with them as necessary.

I would suggest being explicit about whether the use cases are expected to be
documented in a stand-alone document, and if so whether the WG intends for that
document to be published as an RFC.

"While a relying party may use reference values to assess the assertions/claims
the procedures for this activity are out of scope for this WG." --> It's not
immediately obvious to me what "reference values" means in this context. Might
be my ignorance but figured I would note it.

---

From: Michael Richardson <[email-masked]>
Date: Thu, 07 Feb 2019 15:25:48 -0500

Alissa Cooper <[email-masked]> wrote:
    > Given that the data to be exchanged for remote attestation purposes
    > could be security-sensitive or could be used to fingerprint a device or
    > identify a user, I think the charter needs to explicitly state what the
    > WG's goals are for taking the protection of this data into account.

There are two choices to protect this data:

1) transport encryption.  I thought that we had ruled transport out
of scope, but I guess it's still there as 4.
   "4. Standardize interoperable protocols to securely convey
   assertions/claims."
   I guess I'm thinking about SUIT.

2) object encryption.  This would be cryptographically better, but
   I think that this would fail for all the same reasons that email
   encryption is not ubiquitous.

(There are many other tradeoffs between each, but that's not for the charter)

Given that point (4) is there, what else could we say in the charter
about protecting the data?

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Laurence Lundblade <[email-masked]>
Date: Thu, 7 Feb 2019 16:06:34 -0600

Encryption solves some privacy issues, but not for use cases where the recipient of the token is at issue for privacy. Also some recipients (relying parties) just don’t want privacy-violating data in the first place, often to meet regulatory requirements. 

In that case the device can:
A) not send privacy-violating claims
B) some how make the data not privacy-violating, but this only works for some claims

The other issue is that per-device signing keys are inherently privacy-violating because the recipient / relying party has to have the public key to verify the signature.  A solution is cryptography like ECDAA. The main work here would be to define how to use EDAA with COSE. I think it ends up largely orthogonal to the claim definition data. ECDAA uses with COSE might have use outside of device attestation so it should probably a separate document.

LL

> On Feb 7, 2019, at 2:25 PM, Michael Richardson <[email-masked]> wrote:
> 
> _______________________________________________
> RATS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rats