kme / draft-moriarty-rats-posture-assessment

Internet-Draft Template Repository

Use this repository as a template if you want to start working on IETF documents.

Read the instructions for more information.

Once you have created your own repository, start work by:

1. Set "Workflow permissions" to "Read and write permissions" in the repository settings.

2. Rename the draft-todo-yourname-protocol.md file here.

draft-moriarty-rats-posture-assessment's Issues

Address feedback from MCR review

After we merge #12, review @mcr's feedback and ensure we address all applicable points and make other edits as necessary.

https://mailarchive.ietf.org/arch/msg/rats/JeGfaBd9wdB7AwfVWZcbCwRN3S0/

Add missing references to CIS Benchamrks and DISA STIGs

When reviewing old feedback and my own notes from before the repo transfer, but we need to add that informative references to CIS Benchmarks and STIGs as we refer to them throughout the document.

Address IANA pre-meeting feedback for IETF 120 RATS session

Before the IETF meeting, we check working group agendas for documents with IANA-related issues. We have notes about the current version of this document:

https://datatracker.ietf.org/doc/html/draft-moriarty-rats-posture-assessment-01

1. Table 4 should also include the registry’s “Claim Value Type” field. See https://www.iana.org/assignments/cwt.

2. The JWT and CWT registrations should also name a change controller. (The IETF is now preferred to the IESG as a change controller for registrations made by IETF-stream documents.) This could be mentioned in a sentence instead of in the tables, if that would be easier.

If you have any questions, just let us know. If you'd like to talk in person, you can find us next to the RFC Editor's table from Monday through Thursday. You can also request another review at any time by contacting us at [email protected].

For more information about IANA Considerations section requirements, please see

https://www.iana.org/help/protocol-registration

Make all claim names lower case

Per feedback from @jricher during IETF 120 RATS briefing.

Address feedback from Thomas Fossati

Address @thomas-fossati's feedback on the current draft provided on the mailing list.

https://mailarchive.ietf.org/arch/msg/rats/_ROmUO5Zu-roW9lALQKB1FiuQew/

Address feedback from Adam Montville's review

Address @adammontville's feedback in his review of the current draft on the mailing list.

https://mailarchive.ietf.org/arch/msg/rats/BiAVSEZNkCXwgNrqsPJGWQxp4Z4/

Are TEEs in scope for this document?

Align TPM and inclusion of TEE compatibility with proposed standard as requested by @muhammad-usama-sardar during IETF 120 RATS session.

Address feedback from review by Henk Birkholz

Consider @henkbirkholz's review on the mailing list and possible adjustments we can make to the draft, if applicable.

https://mailarchive.ietf.org/arch/msg/rats/bF7r7XQIuvtLLvG8ERQsAf9J2MA/

Address feedback from Eliot Lear's review

With his permission, I am reproducing @elear's email off-list with a review of the draft as presented at the IETF 120 RATS meeting to consider for

I've scanned the doc. I don't know a whole lot about EAT, so please keep that in mind.

To begin with, your intro largely motivates rats-eat and not the claims that you are defining. Also, I would expect that you focus on the claims themselves, and explain how each one is intended to be used, and in the case of PCR, what is expected to be returned. I am not sure that FMA is needed if that can be derived through the media type, if it is a URI. But LEM being either Log File or URI can lead to parsing confusion.

Are these claims in a separate claim set or combined with other claim sets? I'm also a little surprised that PCR and HSH havn't previously been defined. Do you know why that is? What hash is used for HSH? Is this meant to be a complex object that indicates the hash type?

I think I understand why FMA is needed when LEM is a file, but if it's a URI, then you get a media type. What happens when FMA and the media type conflict? I'm also a little nervous that there could be two formats for LEM.

In terms of the file itself, do we have any initial formats that we would expect? It all seems just a bit abstract. If I understand correctly, the draft is trying to link claims specified by CIS, DISA, and others. I think at least some informational references would be good.

And this brings me to my final point: I'd really like to see an example flow in terms of how this would work.

Again, I'm not an RATS/EAT expert. It may be the case that I am misunderstanding the architecture.