Internet Engineering Task Force RATS Architecture Design Team, 18 Aug 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: RATS Architecture Design Team, 2020-08-18

Description

RATS Architecture Design Team, 2020-08-18

A

Okay, so we have three four pull requests from: five pull requests from lawrence um and.

A

um One from hank, so that's based on us adopting a document that is in, has a has a adoption call right now. uh Would anyone like to say what, if they looked at any of these other ones at this point, there's one they would like to start with.

B

C

Any of the top four, my preference would be one of the top three I'm guessing. We might even be able to get through all three of the top three but we'll see. 137 might be the simplest of those then 139 and 138, but I think they're, all ones we can discuss out of the top three.

B

C

I picked this one first, only because it's the shortest one. If I remember right, uh if others haven't, then you should probably just go straight to the files.

C

C

C

I think I remember right this. One is only two sentences changed, but uh maybe three sentences changed well now those two sentences change. I think- and I both had changes to the second sentence, but the uh biggest I mean the the the uh only real technical or only real wording issue is that the second sentence is somewhat redundant with the uh previous sentence that follows it, and so I wanted to take that. I wanted to see that those two sentences got merged rather than anyone added that's redundant.

A

So, okay, oh that's! You want to merge.

C

A

C

If you read the 8, no, no, if you read 817, and then you read it, if you scroll down to the one that is not in green, so between 8, 17 and 8 and 19., uh I claim that 8, 17 and 8 19 are redundant.

C

You see the indicating compliance or non-compliance, that's a phrase that appears in both of them, and so I wanted to see that those two sentences got merged was my suggestion, rather than sounding redundant.

A

Okay, so we really needed different pull requests to merge them.

C

um Not necessarily okay,.

A

So you're happy to do it in two steps.

C

I'm happy to do it. No I'm happy to do it by editing it this one. If uh folks agree.

D

Yeah, so this is henkai. um We could look at the changes, except basically the changes if they are fine to accept and then uh do a second pass, maybe not today, but because of the day with the merge. But we can't merge them with the proposed changes still in them.

C

uh Yeah, I think if I understood what hank said, I agree with his proposal, which is, if you like my wording, changes except mine. If you like hank's wording, changes except his so do those as a first pass then once those are merged, then look at the duplication between those two sentences see if we can word smith on the call otherwise plan to the next call. I think that's what hank just proposed.

D

I think that I tried to say that, yes, thank you.

A

D

A

So 816 is is is um generally liked, then.

C

A

C

Have pointed out on pull requests in the past that we want to use the word a tester rather than device, and so that was the main thing that I used here. The other one is just grammatical, yeah.

A

Okay, so then, let's um same thing,.

C

There device to a texture was my only change in 817 so far and hank made a difference.

A

So we could accept both changes if we needed to.

C

Let me quickly hang.

A

C

I'm not sure I understand.

B

C

Point but I don't object to it.

D

uh Echo from uk first thing.

C

I'm hearing an echo from you.

B

E

A

You're not hearing the echo.

E

D

A

You're, the one producing it, it's bouncing off your wall.

A

Put on a headset.

A

A

D

Think dave thinks is basically easy. I I would agree with both of them and that's fine and I think they've said he does not disagree but doesn't see the point of my.

C

Thing I'm curious: what do you mean by a set or sequence of boolean? What do you mean by that.

D

Yeah yeah that is basically in between, and that is what we talked about with the um claims for pursuit and the trustworthiness vectors that are not necessary of just trustworthiness and all that these are sequence of bools. They are both our boolean, which is option a, and uh they are also richer than just a yes or no, which is option c. uh So I put a option b, but we can also have a middle ground here.

D

That is only boolean, but you have a lot of them and still that is not just a boolean decision, therefore anymore, and that is the only point I'm making here with the added example in the middle of the set of sequence of boolean.

C

So I had interpreted uh lawrence's text as uh that. Your c includes your b. It's just a trivial special case of c and that's why I think lawrence's text was simpler.

E

Yes, that that was my intent. My time was to express my sister right there from one simplest to the most common complaint.

C

So right now I prefer lauren's. I don't think it loses anything it's easier to read. um I don't. I don't yet see the value in separating b from c, given that c includes, b.

D

uh My hank's perceived value is that uh he was working on it and therefore just saw okay. This fits in there. So if nobody really objects, I would like to see it there because it would facilitate uh arguing yeah. This is there is this thing, and then we can point to the architecture that says yeah there.

C

D

Thing, but if you don't want it, it's also fine right.

C

I guess one of the things that I don't like about it is, uh I mean uh part of the point of this text to say it's not necessarily boolean. It may be tri-valued, okay and so uh expanding on one axis, like the number of different values. Sorry, the number of different uh claims, or whatever is a separate axis from how many different values each claim can take, whether it's boolean or tri-valued or something else. It seems odd to me to expand on one of the um axes, but not other ones, and so that's why.

C

It just reads odd to me:.

E

Yeah, I'm with dave.

D

I'm not married to this, so I just read it. I was like oh yeah, that that's that's what not with the big context after thought. If you do not want to have it in, I don't reject.

C

Okay, my preference would be to not have it and to keep closer to lawrence's text.

A

So I will resolve that.

E

A

C

So now, if you go back to the files changed view, or hopefully it should be okay, now you can see 8 17 8 19 actually expand it down. So you can see. Oh no nevermind um yeah, it's just the one line, 8 17 and 8 19.. Is there some way to edit that pair of stuff to combine them? So it doesn't read like duplication about indicate compliance or non-compliance.

C

Right is there some way to merge those two sentences? The wicked wordsmith.

C

Okay, because it looks like the main difference, this eight six it with 819, has the with a verifier's appraisal policy. What, if we take that and move it up right before the.

C

B

C

I think that reads: okay, what do you think lawrence.

E

D

E

Yeah, that's fine.

E

C

I'm okay with that.

C

Michael you still, there.

A

A

A

C

And it is 8 17 8 19.

A

This is because we deleted something else.

C

8 18 was uploading.

B

A

You'll have to delete your own branch lawrence.

C

um Yeah lawrence, since the address is issue 54.. I don't know if that had the magic keyword in it to close it. So we have to manually close issue 54.

E

C

I think if you use a magic keyword like fixes or loses, or something like that, it'll automatically do it. If you don't, then you gotta do.

C

Manually the this one I like, where it's going, but it's going to be it's longer than the other ones, and so, if you want to cover it now, it'll take up some time. But uh I think this is uh good stuff right because you can see lawrence adds.

C

uh This is a crude first pass to see what interest there is in this um I'll raise my head, I'm interested, I think it's a good good stuff and it needs to be wordsmith since it was a crude first pass, and so I spent some time trying to do a little bit of wordsmithing on it.

C

But I would like to have this be incorporated.

C

Although we will want to delete that line, but if others like it, then it's worth spending time. In my opinion,.

A

Let's first do hank's change. Okay, we can do the suggestion.

C

Yes, some of these- I didn't do suggestions only because uh you can see some of these. The lines are really long and it's gonna be easy to do. Suggestions in place once the lines are broken into uh multiple pieces, but.

E

So I was doing uh one line sentence because I thought that was easier for but.

A

It is um so that's why I was gonna like what, but.

B

A

C

Here, uh yes, I was trying to expand te acronym, expanding the software acronym and uh capitalize the tester things like.

C

That that one I was expanding the pronoun this and fixing.

C

A

Noting I have an entire document about this subject.

C

That one actually added a meaning change in 1043, which is the part before as well as is new, because it was previously talking about confidentiality of the path and said it's not just the path. It's also the confidentiality of the generator. That's a meeting change.

A

I think that's okay in this.

E

A

Good okay, so I've now learned that it's better to merge these beforehand.

A

um Because otherwise, the second suggestion disappears. One way.

D

A

A key, well, you have to go back to the conversation, is to first generate it.

C

Oh you're, talking about hank's changes here, yeah yeah.

C

A

A

To the device and then then copy the secret key onto the device.

C

uh Do not I deleted secret, please keep it and that's because to uh well unless, unless you guys think I'm wrong, but because.

A

I deleted the word secret.

E

Again, why you delete secret.

C

I didn't think it added anything and you there's public keys, private key, shared keys, but what's a secret key.

A

C

Talk secret, I mean no, but public keys are not necessarily a secret, but I didn't think it was important to talk about whether or not you cop you also copy a public key under the device.

E

Yeah, you might, you might copy the key. I mean I've used the terms, the private part of a uh and a uh um that was where I'm going with that I strongly uh you know. I think I think you can remove if you want to, but that was I was going with it.

C

You want a parenthesis s. um I wanted to match the use of key in the rest of the sentence. We can see one way to provision. A key tells me it's singular, because this is talking about. Maybe each key.

C

I I think what you have on the screen right now is the merge between my changing exchange. I think so.

C

Yeah, as you can see, hank's on the bottom now.

A

Okay, going on for looking, this is a grammar change.

C

um So do you want to resolve things now that it's merged into the previous one? So you don't have the same. One twice see. I don't. I think that one, if you just take resolve conversation on that one or delete either way. Now this now that's combined into the top one.

C

um Let's see, there's typo, there's no spelling. You can see personal change to.

C

Personnel I'm saying I already fixed the okay.

B

B

B

C

E

C

Secret keys, which I don't follow there, let's come back to this, then yeah: okay, okay, okay,.

A

C

Quotes yeah undoing smart quotes, which don't necessarily show up well in the text copies.

A

What a terrible invention.

C

Okay, no to your question: hank.

C

You said: does anybody else know what a midnight run is no ah okay.

D

Yeah, if you sneak into the factory and start the production cycle at midnight without nobody noticing, that's.

C

A bad run, I see.

D

Which are typically a supply chain attack exactly yeah yeah.

E

I mean maybe what you're doing is putting station keys into the device that behavior.

A

Yeah so so, there's the midnight run where you produce extra devices, which may have some other properties, but but then there's the mid. There's the attack where you just go and change something. That's sitting on the halfway through the uh inventory or something I I would think is a totally different. I wouldn't call that a midnight run.

E

Yeah yeah yeah yeah that that could just.

A

E

Yeah, it could be adjusted yes and merge.

A

Okay, so let's come back to that part.

A

Okay, so hank suggested change.

C

I had to read this sentence three times too, to figure out what these was, but my conclusion is different from hanks, okay, my conclusion was that these referred to two things. I mean the combination of two things right. That's why it's thorough. The first thing was the isolation protection of the tester, and the second thing was the factory processes for provisioning of the attestation material.

C

And hence change refers to the second only which is itself plural, but it excludes the isolation protection of the tester, which is how I had read. It.

C

Either way, I think it is useful to reword the sentence to clarify, but uh since obviously both of us had a hard time reading it and we came up with different conclusions.

D

Yeah exactly lawrence.

E

I was uh referring to actually.

C

Only the factory processors, not the isolation, protection of the tester.

E

um I mean they're both important uh just whatever structure the sentence of that.

C

This is talking about when the attack station and here insert hank comment about- don't use word attestation without remote or whatever, um but uh becomes worthless, because the attacker can forage attestations. I'd rather just saying oh well, you're trying to point out that if you defeat the isolation protection of the attester, then the remote attestation becomes worthless, which I think is fine to say it's not just the factory processes.

E

C

And uh the head comma, the word attestations appeared twice: michael, you changed the second one, but not the first one.

D

Also, the last one I would forge evidence. Evidence is the thing you can forge. I think.

E

uh You're right.

D

Yeah, and I think my comment also says that um yep yep you're.

C

D

Exactly this looks better.

C

um Except for I still win, uh maybe when either of these to make it clear that we're talking about either of two.

C

It's the simplest fix I can think of. I don't know if that makes it super clear, but that's better.

C

And maybe add a comma after a tester where you have the red squiggly.

C

um No, don't I changed my mind.

C

uh uh uh I think my comment before you can see the red squiggly on implementors is because it's misspelled. It's ers.

C

There we go, I don't know why it doesn't like that. But I don't know why there's a red squiggly now, but that's the great spelling.

D

It also did not, like other words, are used so.

D

They're, probably just misspelled.

C

I mean, I imagine it doesn't like the red squiggly on a tester, because it doesn't know that it's supposed to be capitalized, probably complaining that it's capitalized, but I think that one's fine yeah and which is why I'm surprised it doesn't complain about evidence being capitalized.

C

Okay. I I think that text is now okay,.

A

Okay, so here we need to change this to a suggestion.

C

um So here first change: hank wants remote inserted at the very beginning of the sentence.

D

Yeah, whatever fits best remote is the easiest fix. If that is correct, that is fine. If there's a broader goal here intended than I would like to see the goal uh elaborated on.

C

Okay, I I I agree that, and you can lower case the a in attestation. Now, I believe, is how we've done the altering the document.

A

I was just about to ask that.

C

Yeah, um let's see next trivial fix change hw to hardware. That was my bullet three and then uh we're into the second line, where it's devices move the apostrophe. After the s, wait.

A

Sorry, you already.

C

Did no nevermind, you already got it yeah.

A

And that's your point. Number two yeah a lot of constrained devices do have real operating systems. You know um that are one.

C

Of them don't yeah.

A

Yeah, some of them just don't, but I mean they don't have protection for their operating system. They just but.

C

Yeah, so I'm wondering if.

A

We're in freetown, r toss and blah blah blah definitely have lots of appearances of being a thing.

C

But if they don't have an operating system, is there some more generic word that we could use there? That would be from our firmware.

E

Well, it's saying uh process elevation and it's only getting an example of a regulation, so I don't think it's critical that that distinction. I think you know the low security is only the process um and that's one example. So I don't I don't. I don't change that. I don't think you should change that.

A

Okay, also, it's referring to process isolation and these constrained devices don't have that, but so they don't apply doesn't apply to them.

C

E

Yes, which would be, or of.

C

No, not that one four words later change the up to or yeah there we go.

C

um All right and then the let's. This question is on the bottom line, where it talks about being able to trust the device and I'm looking for a word other than device.

C

um And I was wondering if the word a tester would be sufficient. There.

C

Especially since, if you look at the end of the first sentence there, it uses the attester, and so I think that is consistent. When you talk about being able to modify or inspect the tester and be able to trust the tester so that matches.

E

So if an android app is using and station to prove his, you know, bank of america uh is, uh is the america.

C

Part of the attester, um I would say I don't know the implementation, but it might be absolutely if it's layered attestation and that's the top layer. Yes,.

C

If you think of it would be the hot, it would be the. uh What do we call the attested environment and a tester consists of two types of environments, the testing environment and the target environment, and it's the target environment, and that is included in part of the tester. As our definitions.

E

Okay: okay, great.

A

Sorry was there something to edit there wasn't. I no.

C

I don't think so.

A

C

A

C

Gonna hit myself here.

D

But we haven't seen.

A

It together um now.

D

So, okay, sorry.

C

Yeah, I think hank has a good point too.

C

C

So I think uh the core question being asked: I mean out of hank's points, the main one is: um why do you care about modifying the tester? Why is that relevant to this text, whether it's true or not? Why is it relevant? I think, is the question.

D

Exactly just a statement at the moment, which we assume has a.

D

C

Why is it relevant whether a owner a user can modify or in particular, inspect the tester? So in other words, why do you care whether the user can install a banking application on your android phone or not because, right now it says in some cases you must not be able to install such an application? Why is that point relevant.

E

Okay, so I think it's like a sentence already, if you're a router owner and you're gonna figure out that router closet is doing, okay, that's one, um but uh if in the independent half world, you really don't want the end users to be mucking around with the actor um or.

D

E

That um a bank or a airline or a stock trading app, they take responsibility to secure the system to end and the system is incredibly complicated. The user can't be around with it. Just like you want. You know, you know the the fbi user, mocking with your ambulance brakes I mean you, don't want to go in there and mess up with this stuff, because you know you've got to avoid the warranty because of the end users and allowed to do those kinds of things.

C

Right, so that's a few things that this the second point: it's mostly the policy decision that says, if you have modified it or whatever, then it will fail at the state, remote attestation as the process that you're using to check that. Would you agree with that.

C

There's nothing physically that prevents you perfectly it's just you're using attestation as the way to verify that that has not been done.

E

Well, I mean you, don't want that the answer to be being asked out of this either, because that means that you can download an app and I have to connect the tester that will copy the keys and be able to afford attestations.

E

So you have to keep the end user away from the keys and the testers.

C

Do you mean effectively the testing environment of the attacher, and I think his answer is yes, that he means the testing environment does not mean the tester. I think you're right, because he keeps talking about lawrence- is talking about the phytoauthenticator, not the tester as a whole, which may include the application.

E

Yeah yeah all right: okay,.

D

Also, I think that the uh I think so that the uh fido authenticator is a part of the testing environment.

E

D

Is communicating.

C

D

Interesting environment, it's not also not the completed testing environment, apparently.

C

I agree it well that I don't know, but you're probably right. I don't know enough to say that that's right, but that makes sense to me.

E

C

um And lawrence, why do you care whether they inspect it.

E

So they don't copy the attestation keys and uh well so they don't inadvertently download an app the.

E

C

You could inspect phytoauthenticator code, just fine, there's no issue in that right and you're.

D

Yeah, I'm sure.

C

You have to protect your key store, but that's different from protecting it from inspection. The attesting environments uh say code pages.

E

Yeah sure I'm sure there's somebody with different kittens that are bad pillows and use obscure that really, yes,.

A

My bank won't, let me do banking cert, certain banking things. If I have debugging enabled on my phone period, I'm I'm I'm I've, never quite well. I don't find anyone has a clue. I think it's cluelessness, but um but but but uh a suspicion I have is that they believe that I would be able to debug through their code and do something uh which they don't like, which tells me it's probably insecure to begin with, but.

C

That I think I do know why, but go on.

A

Well, okay, um so, but the so the the thing I think is the problem is that the word inspect here is a little bit uh involved um and, as the word you used, you know, people should be able to review the code audit. The code sure um I I think.

C

I think the meaning that lawrence means is, if you were to replace inspect with exfiltrate keys from yes, it would have concluded that he has.

A

Yeah, so that's what I I understand him to have the meaning. I just don't think the word inspect here is quite getting at it. So.

C

Replace it with exfiltrate keys from uh okay, if at least that retains his meaning, we could make some changes yeah. But I think that.

E

Yeah, that's fine.

A

Is there any other content from hank that we need to get here before I hit.

C

um Yeah the second sentence, the point of the attestation insert remote, was hank's third.

C

Point optionally insert procedure after that. I don't think it's necessary, but technically suggested procedure, but I like it either way. This is the way that you have. It is fine with me.

D

Yeah and maybe remove the v. I now realize the point of remote organization. I think that is just.

C

Yeah and now you can delete procedure yeah.

A

C

A

We're gonna then put first.

C

Group name now: um are we capitalizing relying party as a defined term.

B

C

Okay, let's capitalize that.

C

um And then, in the first sentence, where it ends in from the attester, I think.

C

I I guess it depends on where this appears in the document. If this appears after we define after the two types of environments that I think hank your point was. This is not talking about the tester, it's talking about the a testing environment of the tester, and I don't know, I think so. Yes,.

D

The topic is as it's security considerations that would be uh after.

C

That at the end, okay, then, yes, I think it would be good to change that.

C

Sorry to change what, at the end of the first line, where it says a tester right before that, right before the word of tester, insert a testing environment of the.

A

C

I think so, I think, is that what you wanted? Okay,.

A

A

Okay, don't know what the problem is.

C

A

Is exactly my point.

D

C

I don't know either so uh if we delete those two, I don't know if there's lots of.

C

Information, I guess it's partly a question for uh lauren to say is: there's something important here to capture. If so, can you explain it because neither hank nor I understood it.

A

So I I don't think that there's any difference between this, the the state of a router in a wiring closet, far away, is any different than the state of the of a phone which is also in a consumer far away. um So so I'm not I'm not saying anything higher about the uh the phone. What I'm saying is that the router is not in any way lower in a different lower state.

A

C

This is just another case that the point is the same as what we've covered up above and so deleting this wouldn't be loss of information, every other possible use case either yeah.

C

Sorry, what was that eric? I was agreeing uh with michael's assertion: okay,.

E

So I mean the owner owner or router.

D

E

You know the isp or the telco or anything like.

E

And even software that is not from the uh vendor of that router. I would think that I want to look at the attached keys to the sound, be the ones to install the keys. It just seems like uh you.

A

Know they really don't know.

E

A

Your distinction lawrence is that when I own my phone, I don't get to change the attestation keys, but when I own a router, I do well. I have news for you when I own the router, I don't.

E

A

Okay um and there's many problems with both states states of affairs, but um at this point, if you are installing additional software on the router, then it's coming either through something like yes and literally an app store or uh it's through the vendor. Who does something.

E

Okay, okay, then the sentence, fine and I I I thought that they you get.

C

Think part of it yeah, I think it's okay to delete. um I think part of what lawrence is pointing out. I have a comment on later on, maybe not in the context of a router, but um I have a suggestion later on that will um cover, I think, part of what lawrence is yeah.

E

That's true true, maybe it's better! Maybe it's the sense of your typical cancer power plant.

C

Yeah I'll get to that when we get to that. But yes right what lauren.

A

Said so can't pass grammar in perhaps restricting in here.

C

Some of the measures for low security include number one processor application: isolation by a high level operating system number two, perhaps restricting access route. I don't know what it means by restricting access route.

E

It should be access to route. Okay,.

C

All right, grabber fixed, um although since include there, needs to be an and somewhere, maybe and perhaps or or either an android or because this is a list and we have to terminate the list with an appropriate preposition grammatically after the comma, either an end or an or may include, uh okay, sure, yep.

C

uh Like a sound bar jumped out at me is odd, but.

A

C

um In the bottom line there I it's not horrible. It just read oddly to me to somehow call out a sound bar as an example. um Do we need an example? Otherwise you could have a generic example like a sensor or something like that. I don't know why. I don't know if, just if.

A

Nothing else, if nothing else, I would prefer to say I think you mean bluetooth speaker, but.

E

C

Okay, try to pick something.

E

As an obvious, slow security.

C

Is capitalized.

B

A

Here we go, this is the t2 as well.

C

um I don't think so. I'm going to check I'll I'm going to check the bluetooth sig's website. I mean.

A

C

Is bt is abbreviated to bt? It is not capitalized. The bluetooth.com website uh only capitalizes the b you're right, it's capitalized in the acronym bt, but when spelled out is lowercase.

A

A

I don't know what to do with hank's comment here.

D

No either but suddenly medium, then high, so it implies everything before was about low. Is that correct.

A

C

uh 10 32 does.

D

So there it is all right: okay, yeah, then this, regardless.

C

Hold on your point, go up down below it's always medium level: security, high level security. Here it is low security, certain level.

D

Yeah, that is also consistent. Yes, but it doesn't start with it and I was confused, but actually I misread it. So my actual point was not the level, but the missing yeah.

C

Now, we've level set.

A

Up all right resolve that.

D

Yeah implement confidentiality. Just rub me the wrong way. So I reworded this and.

C

um I didn't like the answer: hank yeah, I didn't like the your your edition of the word secret yeah.

D

Yeah, I saw them coming so yeah yeah.

C

uh Okay and hank, I have to ask to the attention before as being needing remote attestation. Here it's at that station keys. Do you need that to have the word remote before anticipation, keys or attestation keys by itself was okay.

D

The station keys by itself is okay, it I think they are very established. Okay, but the station safe is sometimes the process. Sometimes it's the message in this case. It's the keys, that's very, very uh okay,.

C

That's fine! Okay, since this was your request, just letting.

D

Yeah, I thank you for paying attention here. That is very appreciated.

E

Yes, I agree with your comment. um We could text around that.

C

Yeah, since this one is not a simple uh change, this is, uh I I'm wondering michael, do you want to merge the ones that you've already captured right now, which are all wordsmithing and see how many comments we have left.

C

And laurence, that was the comment I was referring to, that. Some of your points that we were asking about. Routers um is the same as what I'm thinking about on that one. So.

C

Okay, so uh so let's go ahead and do that one and delete 10, 18 and 19, and then you can resolve my comment here because so far it's I'm gathering on the call that nobody is objecting to editing the stuff. I think it's good stuff, so, okay, so let's hit uh michael, can you uh open up a edit uh and delete ten eight or ten, the 10 18 and one of the two blank lines.

B

C

And two blank lines, but no big deal yeah all right. So then my comment is the only one left: okay, um yeah.

C

So just to summarize what I'm saying here right now, the text has written at least some of the text that talks about manufacturer and factory is talking about the case where the attestation keys are provisioned by the or at the time of manufacture, right, there's other cases and technically there's two other cases, because there's the case where you have a counter signing where you have say the owner has to counter sign, and so you only pass verification if the, if there's endorsements from both the manufacturer and the owner right and there's another case where you have some process by which, when you take ownership of a device, you generate the equivalent of a counter signing at that time and say this is now my device and that process includes testing that the manufacturer's endorsement is good.

C

And then, after that point in time, you use only the owner's key, because that is implicitly included. You wouldn't have signed if it didn't attest from the manufacturer to begin with, and so after that point in time the verifier only cares about whether it is endorsed by the owner, and so I just wanted to say that a lot of this text is works in all three of those cases, an example.

C

The counter signing does come up in suit, where we have the suit manifest that we talked about in suit that you can have things be counter signed and so on, and so the same thing applies in at that station owner things, because one of the security issues is just because a device is manufacturer. Valid doesn't mean that I want to trust it. I only want to trust the ones that are on my premises. For example, if it's a uh if it's a camera, let's say I only care about the cameras that I own.

C

I don't care about somebody else with their own camera that comes from the same manufacturer, that's just as valid, but they own it. It's on their premises. I don't care about that, and so this notion of counter signing with an attestation key. That is specific to the owner is actually important, and this is what overlaps I said with what uh lawrence was trying to get at with routers right. The same thing can occur with any type of sensor, so.

A

Counter signing is counter. Signing is one way to implement this just listing the serial.

D

A

You trust is another yep um yeah. um The point is so how.

C

Do we get thomas, you have anytime that you have a provisioning of keys used for attestation, it's not just the manufacturer, and so there's.

D

C

Times in this tech in this pr that talks about the manufacturer, but that's not the only case where the provisioning can happen, and so I'm wondering if we can generalize it beyond just the manufacturer in a couple of senses,.

C

And so it comes up if you just search for the word manufacturer, there's a couple sentences that I'm and I didn't have a wording suggestion because I didn't think through exactly how I might do that, but uh because the uh yeah factory, key provisioning process assumes that it's only in a factory, but it does say in 1042 or elsewhere right um when it calls it the factory key provisioning process. I wonder if it's just the uh what if we change in the name of the process, the word provisioning.

C

If we change factory key provisioning to just be attestation key provisioning- and it still says, is the process that occurs in the factory or elsewhere. If we change 1040 and 1042.

C

Both 1040 and 1042, from factory key provisioning to attestation key provisioning.

E

Yeah, that seems, okay, that's good, actually um a little under this counter counter saying, um uh but uh I I guess I think about that about that um I mean I mean I mean I have been kind of trying to get by the strongest deposition between the devastation and manufacturing that you know that the station is all about implementation and.

C

I'm saying in cases that I'm familiar with it's not right endorsements are not specific to the fact there are manufactures, but there are also endorsements that come from entities other than the manufacturer, and how do you provision the keys used for that and this this process here that you're talking about is the same.

E

I'm thinking about this.

E

And I'm not sure that's out of situations.

C

Assert the trustworthiness of advice and it comes into whether you trust it or not. Ownership is absolutely an element of uh whether you're trusted advice.

E

All right, I hear what you're saying I'm not I'm going to think about it.

C

Just because it may not be used in the use cases you're familiar with doesn't mean that it's not common in other people's use cases.

E

C

E

Will do it just wonder, I would call that data station.

C

So 1046 um I'm wondering if we changed the word factory to be provisioning environment.

C

Let's remember 1042 says factory or elsewhere, and here it just says, factory uh a word after your cursor physical factory security and if we change factory to provisioning environment, no physical provisioning, environment, well, okay, yeah either way is fine.

E

Yeah physician.

C

E

I think physical is important right.

C

But whether it's physical provisioning, environment, security or provisioning environment, physical security, I don't know which one is better and I saw michael thinking the other one and I don't care which, whichever one you think is right, michael uh and then enter the factory. Actually provisioning environment is environment. The right word there.

C

I don't think if I can think of a better word, because we use the true environment it'll, be like a testing environment, environment, different meaning, I'm also not.

A

Happy with environment.

C

Security, how about facility? I think you use the word facility somewhere lawrence.

E

C

And then I can enter the uh enter the facility you can see at the end of the second.

C

Sentence and then middle. The third sentence, special area of the.

B

Factory: okay, good.

C

um Okay, I don't know if there's any place else, but I think that text is now fine. um I don't know if there's any place else to use the term manufacturer or factory. Besides the text we just looked at, uh but that was the parts that jumped out at me. Oh there, it is 1054.

C

C

Say the attestation key provisioning process or just key provisioning process.

C

And then go ahead, hank.

D

Yeah my confusion.

C

D

There was a comment about midnight run here. That was not addressed and also a suggestion which has sneaked in again, but this is somehow gone. I don't know why.

A

C

A

Let's go back to the other part, just.

C

Don't leave one yet don't leave that one yet because there's a factory beginning of the third line.

C

C

The provisioning facility- okay, yeah, that's fine too just facility sure, but I would say provisioning facility there, because it's I don't care. We.

A

uh Well, I know what midnight production run is.

A

Is this something we should explain or reference.

A

C

We should expand it in.

E

C

um I guess I would question because part of the reason I don't think it's obvious, is it's not obvious why a midnight run generates counterfeit devices as opposed to just more uh uh authentic devices.

E

Yeah, I I think.

C

Yeah, I don't really need to have a midnight run of counterfeit devices. I know what it means to have a midnight run, which is extra devices, but that doesn't make them counterfeit. In my mind,.

A

uh They're stolen it's more of what they are than they are uh yeah, but they're, not counterfeit yeah, yeah they're, not counterfeit yeah,.

C

And right because, though, still a test is valid, all the the the attack is just. They didn't get the uh the the money that from somebody purchasing them right. The devices are still just as good as.

A

The other questions, whether or not they have whether they have duplicate serial numbers in some cases, you well.

C

That would be the incorrectly configured part right because the after the or is the incorrectly configured right. I I don't have any complaints about the incorrectly configured part, I'm asking about the part before the or.

A

But when I do something.

C

Like serial number.

A

I actually screw up the original the the the correctly configured device as well right.

E

A

E

Because I make.

A

I may create a uh an evidence trail that doesn't relate to it.

C

Right yeah you've broken my non-reputability of the correct one.

A

Yes, so so I still think this needs to be. I my preference would be to have a reference here that uh that that it would be reference some other paper explanation, and that would be it. We don't have to go into it. um Can we at least delete.

C

Counterfeit or and just call them incorrectly configured devices.

E

If I like that, I think it's a really important term.

C

If they come from available with valid keys, they're, not counterfeit right.

A

C

E

A

In air here dave because the the marketing department considers them counterfeit right yeah, um it's just not that just not engineering uh uh group right there. We agree that with you, they're.

E

They're counterfeiters that they behave correctly.

C

But the point is in the example: in pokemon they behave perfectly correctly. The only difference is they were stolen.

E

I don't think we care about it still in the device, though,.

A

The point of the midnight run is that you pop in when no one's there from from you know uh uh for the third shift and you do a run of of devices which look completely correct, but you leave with them and sell them yourself right.

E

Yeah, okay, okay! So then okay, then that was really the wrong turn, not what I was after um it's it's about the devices that have the application key, so many uses.

A

Of all physical security at the.

A

Facility would that work.

C

At the typo manufactured with a d.

E

I think um so repetitious production runs better than.

C

I mean, if you terminate you, do not rest. The text is that what you're asking michael.

A

Yeah, I'm saying just delete the rest of this.

C

I I'm fine with that. I don't know if that this is anything that learns one. That's reads fine to me.

A

You can come back if with a reference- and you know and say this, and I would love that.

E

Yeah, I'm going to find a wrong reference. No.

E

E

Yeah, that's right.

C

uh I, like that wording as you have it now,.

A

uh And that's american right authorized.

A

A

Okay, it's 11 past 11.. uh If you're happy with this, then let's commit it.

C

um I was just going to see: is there any other place that manufacturer factory appears I'm just doing a search on my own screen here.

D

Still does not show my suggestion for the last paragraph, but.

B

A

Well, it's going to be in the in the discussion. Still hank, we'll come back to there. Okay factory with a facility.

C

um It's not yet showing me that you've pushed the changes that you've committed to the changes. You've just staged.

C

uh Okay, refresh.

A

So maybe you just did hold on no, I didn't get it right.

C

Because, like when we changed the factory key provisioning to attestation, keep producing that still shows as being a suggested change not committed. Yet.

A

Yeah, just a second.

A

Okay, now I'm just gonna.

B

Check that now.

C

uh The only hit that I got is line 1053.

A

Here you go hank.

E

A

C

Yeah yeah, so let's uh do some wordsmithing of this one. Is this uh you'd my check? 1053 was the only line that I found that still used the word uh manufacturer um without saying manufacturer or elsewhere.

A

Okay, so, but hank has suggested a change here anyway, yep generated by the key provisioning facility.

C

I would delete that is generated by the manufacturer and just say the only key material or attestation. Key material is probably even better.

C

Let's ensure that only attestation key material and I'll delete that is generated by the uh oh well hold on that is generated by.

C

I think it's okay to leave as it is generated by um the is endorser. The right word here, generated by an endor, a valid endorser I say is a question. Is the manufacturer is an example of an endorser, but uh only attestation key material is generated by a valid endorser.

E

um I mean I've been mixed thoughts about the endorser, so I haven't I've been using it to fill out that. So what we're going to say about that so so we'll be a definition of sure to be.

D

A secret to hardware in your phone, for example, and then you can do the relationship functions, it creates corresponding endorsements. So dorset does.

D

Conveyance to the verifier and the test circle by the provisional procedures that are not in scope yet.

C

Michael is still using the factory.

A

uh Yeah so, but but we've already edited this as well with the midnight thing, so I think I'm we're going to screw this up. So I just want to go back and to the make sure we get this right. So I was going to cancel. I just copied the first sentence out.

E

A

And then- and I'm just going to do this so so.

A

This one involves physical decision to make sure that attacker doesn't do a midnight run, but we we we changed that.

C

But have you committed it yet.

A

Well, I thought so here where.

C

A

C

Yeah, it has been committed so.

C

Okay, so bring up the new line: 1053., okay, okay! So let's re-edit that one we.

A

C

This part um right and so here change manufacturer to endorser.

A

Well, this is what we just figured out. So in all cases, the facility process.

A

A

C

um I actually like the attestation key provisioning process better than the facility.

A

Process right because we actually already replaced that was manu factory there we already replaced it.

C

C

Okay, now I like.

C

E

Yeah, I'm I'm not a little about this, but because it loses some of the best. You know it's not specific. I think it's just for me. The concept of indoor service is still.

E

I don't know out there.

A

Well, I have to go to another meeting, I'm sorry yeah! Okay, um do you want me to merge this.

C

I think it's okay.

E

Yeah I mean we can it's not this right.

C

You can always, I don't think anything is broken in this, so where'd you get so thanks for writing this up lawrence. This is good.

E

Stuff all right uh so my room here, but I need to go to talk to you next.

D

D