[saag] Re: [nasr] Re: Re: NASR BOF Follow-Up

Michael Richardson <[email protected]> Thu, 10 Apr 2025 11:32:11 -0400

Newsgroups	gmane.ietf.saag
Message-ID	<[email protected]>

Richard Barnes <[email protected]> wrote:
    > Q18 - To be blunt, I feel like folks are using RATS and all its complexity
    > as a smokescreen.  At the end of the day, the RATS Verifier has to see the
    > deep network details, and they have to be someone who is not the network
    > operator.  The fundamental problem is still there.

Yes, the RATS Verifier has to see the details (the Evidence).

The RATS Verifier is, however, not the customer, nor is the customer even
competent to verify any of that evidence.   In many situations the Reference
values for the devices will not even be available to the customer (as the
Relying Party).

That's why RFC9334 separates the Verifier role from the Relying Party.

We envision that there will be, like TEEP, two layers of remote attestation.
One where the ISP validates that it's equipment is trustworthy, and a second
layer where the customer validates the ISP is trusthworthy.  The two layers
of this process need to be interlinked.

The question as to what entity can act as an impartial Verifier for the ISP
*as a whole* is a good question, and in my mind, where much of the
(political) complexity comes from.

--
Michael Richardson <[email protected]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 515 B)