Internet Engineering Task Force RATS Architecture Design Team, 28 Jan 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: RATS Architecture Design Team, 2020-01-28

Description

RATS Architecture Design Team, 2020-01-28

A

A

Application know that.

B

Work is that a good size.

B

C

C

I was in the middle of looking through gays pull requests from yesterday.

C

C

All got connected, and there was another fellow who was connected on the where, by his name.

C

The rest of you know: Paul Paul, you wanna, introduce yourself I, don't maybe you know everyone else here ah you can't die, you can die dialing. Yeah I can't hear you speaking to us. Paul.

D

I say showing us big.

E

Bulletin Andrew go ahead, we lost them. I.

D

Did I hear my name, you.

C

Andrew and Thomas did you get connected to the WebEx.

F

G

F

Able to connect just like minor technical tip on my part, but the link seems to have cleared trying to connect back in again. I, don't know if you could post that again.

F

C

We see here if I go to.

C

C

How do address books work in the days of spam.

C

So I no longer could add and everything anybody to my address book automatically they're, probably spammer. This is probably spam. Now I have no one's email address anymore: okay, um Dave.

C

Did I Thomas's joined and we had an Andrew Glenn seems to be not yet connected with audio.

D

You are we able to hear Paul this time, I, don't.

C

Know yeah, okay,.

C

Paul and Andrea, if you, if you can shoot me, your email address and chat actually I'd like it anyway, for the notes is who is here then I'll put you on the invite so that you will have the right link.

D

Want them to introduce themselves quickly, I.

C

Also would like them to introduce themselves. That would also be good unless you know they're well known to you and not me, that's but introductions will be great yeah.

H

Sure I'll go ahead. This is Paul roe, so I'm at mitre corporation and working on parade, art related to work. We've been doing ourselves and.

G

H

Kind of interested in getting a sense of where you guys are and if and how we might eventually be able to contribute.

D

Well, welcome Thanks.

C

Okay, so we're using a github. uh We have a document where this is a where we're working on the document and feel free to jump in oh and if you need to github URL, that's it so, let's just jump into anyone else. Have any comments about Dave's editorial pull request on yeah.

D

C

D

Just give an intro that the last time we merged four requests, I, don't know thirteen or whatever it is it's in the description of this, but there was still some outstanding discussion we had during the meeting last week about things we want to change like the people that collectively we didn't like the term verifying environment as being they're. Not we said claims collector was the term that Michael put in that. We were going to suggest.

B

D

We used there was a up, for there was a downward line from a verifier to an a tester that we didn't like, and things like that, and so what I tried to do is I tried to get to do the things that Mike would put in as the notes from last time, at least to the best of my knowledge, I tried to say here's what I think we discussed last week, and so every change in here is stuff.

D

That I think we actually discussed last week, but we didn't say how I was going to do it, and so I just tried to take an action item to try make it attempt to do that.

C

Yeah I thought that way updated this diagram as well. But your updates are fine as well. I, don't see a pull request with his changes, so yeah I didn't see any changes from him. So I just went ahead and did it so yeah? Maybe he had them in his repo, but maybe that's what the answer? Oh, he didn't do it in a pull request. Yet anyway, I think your changes and his chances are almost identical. So I don't think it matter as much. The only.

D

Thing that I didn't because I wasn't sure how we ended on it was whether we needed to define the term composite a tester or not, and so right now I did not do that. One, because I couldn't tell that we actually had consensus to define a new term, and so I tried to leave that one with with Williams original language. Just talks about you know final evidence and they could be clear from the diagram.

D

I thought it was close enough to not define the new term, but I think that's the only dis only thing that we discussed last week that came up that I did not just go ahead and do.

C

Okay and then you have some changes here. That's.

D

Right I said composite: a tester I meant composite evidence is the one I meant be talking about. Okay, so.

C

D

C

A thread on the mailing list about the composite evidence and on item really understand Ned's, not here, unfortunately, but Lawrence's I didn't really understand whether there was objection to the concept that it would be a union of different objects or whether there was a violent agreement and that there was just it wish. Someone wish to express it differently, or the third possibility was that it would be an array of evidence and that one of the types of evidence would be attestation results and that there actually might be a second signature on it. Well,.

D

I didn't speak up on the thread, but I agree with the third one which I think was Eric's point on the thread. Is that what we did talk about last week was you just have a bunch of claim sets that are signed and whether they're actually evidence or attestation results you might not be able to tell without looking at specific claims or even then, since we don't have the specific claims define. What's the difference, if you're just going to look at a claim set, could you tell whether it's evidence or attestation result?

D

We can't tell yet that's why I didn't make any change to the text here, but conceptually I agree with that. I think was Eric's point that says well. Attestation results in this case are just another type of evidence, whether or even distinguishable or not. I can't tell so that's why I didn't make any change for it. Okay,.

C

D

Definitely you want to jump that I.

C

D

E

I said that was the exact point. Yes, yeah.

C

All right, so we seem to be in it: I, don't I'm not attached to the Union concept. I I wrote it down because I thought that's what I wanted to clarify things: I'm very happy with an array of evidence, some of which happens to be attestation. Results and I actually also see the point that it may be meaningless to have an attestation result, which is not also endorsed but may be the wrong word by the ax tester signed, yeah, yeah, countersigned I guess is this in your.

G

C

Other because the example I thought of is I, take chassis and SS tation results from a chassis, sorry from a line card from a different chassis I presented as if it's my own.

D

It's not quite you're not presenting an as if it's because it may have a different identifier of the target environment, yeah.

B

D

As if it's another one of the target environments that you are signing your counter signing, yes.

C

So so that the the the example I think that I gave in the email was the verifier needs to make sure you have the correct number of wheels and you it wants to make sure that you haven't claimed someone else's wheels as your own perfectly valid wheels they're. Just not yours, remember you're allowed to race or whatever fly in space or whatever it is, and.

I

That that would be done with the nonce Ananse.

D

Isn't sufficient.

C

Yeah, there's you need to you need to bind. You need a binding yeah.

I

C

I

But note sufficient, yes, yeah.

C

I need a binding between the two items and so that that's the implication that they need to cross sign, something, possibly that the verifier has actually challenged them with. They need.

A

C

Respond to that nonce right, you can even have multiple.

A

Nonces, if you wanted to for different point students right.

D

So I say a nonce is not sufficient only because it's going to use a Michael's car terminology right, so somebody sends me and nods I sent it over to the other car, get back to notes from his tires and I include that nonce and my results right. That doesn't give you the binding, but it still tells you that that it was signed recently, but it still wasn't signed by. Do you think attached to my car.

C

Tires that also requires the other car to participate in your in your process, whereas it could be that the tires were on your car this morning, yeah just given an example where I pretend.

D

That I'm, a relying party that wants to talk to their car and so I get his signs. Nonce and I include it with mine, and so I'd say you still need something that is the binding yeah.

B

D

I

Sub mods concept in eat I think handles this case. Just fine, okay and and and.

C

I and I don't think the goal that the goal is not of this text is not to say eat or something else is insufficient, but rather to say this mechanism that we put and eat is here and here's the art to solve.

D

That architectural.

C

D

Agreed so so the sub mod or whatever, conceptually. What your to binding that you want in this in this example, is you want the lead, a tester to be able to attest as far as its we call it, the testing environment it needs to be able to assign that this other ID of the target environment is a bound to the lead environment right.

I

So sub mods has this at least of the current pull request for sub months. Has this field called connection type which describes how the sub mod is connected to the surrounding environment.

D

Okay, yeah no I I agree that eat should have or does have the information sufficient to here and here, where you're trying to motivate it generically and then each is the instantiation of the solution. Yeah.

F

I

What what he doesn't have is a way to include claims or verified girlfriend include verified claims and indicate that they were verified.

D

Verified just today, I think it does as long as you say that verified you can confine it includes of time by.

I

I'm, assuming that the, if you're, if you're, including verified, claims, you're, probably stripping signature.

D

Yeah so I think Michael said it right before. Is it signed or is it countersign? In other words, is there one signature? Is there two and it could be either way right, but it haven't having a flexibility to have one or two signatures is good. Well,.

I

If you're embedding a an eight one, eight and another in another and another, then it's countered counter counter sign yeah. That's all that! That's all fine I think that all works, just fine! You you have to you, know, wrap your nonces right, but if what.

E

Your own, you know, if.

I

You're with your what, if what you're trying to do is take a somatization evidence, run it through a verifier, take the output as an attestation result and turn that back into a claim and somehow say that the plaintiff net into a claim, set yeah and and somehow say that yeah these claims, you know, I've stripped the signatures from these claims, but I trust the attest err.

I

And here's the tester I used in the verifier I used to you know, decide I trust these claims. We don't have there's nothing in each to be able to do that at this point. So.

D

I'm surprised, because the the trust mechanisms you described is exactly the same as extrinsic claims, and so like GPS coordinates. It's going to be exactly the same thing you saying, I, get it from this particular source. I trust that source either identify the source right, dote, it's anything it's just. These are just another example of extrinsic. Evidence is just kind of require if.

I

That's fine, you don't want if you don't really need to say any more, give any more details like the you know, details from the signature, verification, if you don't want to give any of that those those kind of details on or who the adjuster was or where the verifier was. Then yeah, then we'll fine. But if you do want to give those details, we probably have to have something to eat which gotcha so I guess.

D

What I'm arguing for is that it should be available and optional in eat, because I would want to use exactly the same things for extra and seven strings. It claims.

D

So as I say, where I got my GPS coordinates from or where I got my time step, my you know, time of day from then I need exactly the same information.

I

I'm not sure I agree with that.

C

Can you provide us with a counter example? Why that's not true well.

I

So if I'm going to say where I got, my GPS coordinates from I'm going to probably say a GPS module made by you, know the XYZ company version 6.3. So.

D

Let's say: I got from the IP address lookup service, where I send my IP address, and it gives me back my GPA I, scored, GPS coordinates sure. Oh.

I

It says you're talking about a remote service, yeah.

D

I

D

An example right I'm going to be: if there's a GPS coordinates to include someplace, that's one of the places that I can get it right.

C

So we're kind of saying is that there's not a lot of difference between a a GPS device connected over I squared C that can provide attestations to its accuracy versus one. That's connected over IP I. Think there's.

I

A lot of difference right now, the the connection type for an eight is all about hardware, and you know: high proximity, I.

D

Think that's not sufficient, because you're not getting your time of day from a hardware device, unless you actually have a an atomic clock on board right, usually of getting it from something like secure NTP and you have to be able to say what's your time source is it secare? Is it not secure did I get it from not so I'm, just a regular NTP, not secure NTP, then I. Don't really trust it.

D

As you know, if you're all bets are off, but here's what I think it is, and even if you say it got it from GPS.

C

Right, that's still not an atomic clock, it's still a remote service right. You know a couple thousand hundred kilometers in the air, but it's still a remote service right group.

D

C

Or may have some.

D

Security threat from that satellite or whatever other sharks well can.

C

We know it, you know, has there's various sources and that you know yep someone may do is something to you, but so.

I

Let's go back to the GPS example for a minute, so I mean I, believe eat um is only capable just a second. It.

D

Make it clear that this discussion is separate from the discussion of the text on the text that we're reviewing we're kind of doing a related side, discussion right now, yeah.

C

So, let's, let's, let's let's come back to the text, I think is it is anyone else get a chance to review it at this point you want me to put it back on the screen. Go back here.

C

No files changed I.

C

Think only the big thing to read is the simplest. You shorten the text the bottom here. It looks to be correct. It's it's seems. I was a little bit like well as their words missing or concepts missing and when it gone there.

D

C

D

To polish in meetings where it said the same thing in multiple sentences, when I was rewriting them, I didn't see a reason to you, a duplicate stuff after or he rewritten so yeah.

C

I gathered that I was like well, there was a there's, a lot less sentences. Is there something missing and I couldn't see anything missing, so I just said: okay, alright, are we happy with this well I like to move on to the the discussion that we're just having and I'm.

I

Oops I'm not reviewing too much in detail here, but um one one thing I'd like to see is that the something like a complicated thing like.

I

Composite evidence be kind of in a subsection, something that someone would read later on, not.

C

I

Don't a intro I.

C

Don't think we defined compiz composite evidence and I. Think right is that right, Dave because you said I didn't sure it wasn't sure if you wanted. We wanted to put that in.

D

Correct so right now, Williams original text was something like lower case final evidence, because it's all in the context of the composite, a tester and so he's using the layman's term lower case final evidence as perfectly like a line coming out. The top so I just kept it as what he had before. Okay.

I

Whatever your, let's keep: what I'm early afters keep the simple use case simple and make sure that there is a simple, simple diagram in the that the reader will encounter first digest. First, and then you know three months later, when they have to think harder about it, then they can go back and read the section. That's later on about all those opposite stuff that.

D

Is the current case when the wind did is Plurk west? However, the two sections that were discussing are actually adjacent instead of you know, three months later in the document, and so prior to this section is the simple diagram that has nothing to do with the composite a tester and it's immediately followed by the section and composite tester is working started and so I didn't change that part with merge. Last week, I have.

E

No problem moving the this section back I do think that there's a reason to have composited evidence in the in the document, because we have to be able to identify different parts of evidence coming different parts for from different parts of the tester, because we can't make that Association. We can't make any conclusions on the relying party so.

D

I will say that I'm not going to have an opinion on that point yet until after we have the disk have texture review about the Laird attestation, because that will inform my opinion on whether composite evidence actually applies. To that case, your wot and so personally, I would want to defer any discussion of of whether we use the term composite evidence until after we have text or weird events. Ok,.

E

D

I

Got the original action.

E

Item one of the original action names I got was: can I define layered evidence and I had a definition inside Cisco that I was using, but it didn't match up to the one from TCG, which is why I started moving and talking more about composite evidence.

E

So the typical understanding of layering is something I'm not as interested in as composite and I. Don't see them as necessarily being tightly coupled I.

D

Mean if you'd like to give up the action item and give it back to somebody else me or whoever else, then let us know I.

E

Would love to give away layered I'd love to not give away composite because I don't think they have to be bound together when.

C

You layering in the ECG.

E

Model: what's up what.

C

Do you mean by.

E

Given but not have the owner not have the assigned action item.

C

E

Happy to have someone.

C

Else do it is what you mean.

E

Yes, oh yeah, because because my definition was different when I, what I said I think I could do layering now, I think I'd be much better and I put at least a proposal and for composite evidence. But I do think that that the two have to be decoupled.

D

Right so I will eat the layered item, but if somebody else wants, if their will welcome to it, is there anybody else? It's like Dumbo for writing text about the layering. That's along the TCG lives.

G

This is Hank. I would like to take the item if I'm audible, which I don't know yes,.

D

G

You at that, because I'm using a weird setup to join this call at the moment so I'm sorry.

A

G

Yeah I can take a stab at it, but with the, but they can only deliver not next week, but the week after.

D

I could probably get to it next week. If you don't care either way. If you really really want it that I guess we could wait two weeks, but it's you know waiting two weeks so I know.

G

Okay, let me think about this, but let me let me come to this back in now. I see it now.

G

Yeah I can do next week. Okay,.

C

G

C

Is it? Is it layered attestation or did I miss.

G

Here their decisions, because it's a very associate to the type of two environments thing, because the environments rolled Susie change and concatenated, so I.

D

Think this is going to be another diagram yeah. This.

A

D

Each typically each target environment is Anna. Testing is also in a testing environment for another target environments. You have this chain of things. Okay,.

G

Exactly okay, so these two types and the layer attestation, basically Co, align I, wrote the first text. So I would like to write the Concours, but in text yeah.

E

Yep and Hank I'm happy to chat with you about that. The thing that reason I'm, not so good as I, haven't done as much as some of you guys on TCG and one of the attesting one of the things I need is verifier component to evidence, because in the use case, I showed, with the with the multiple components being sent. I had a layer where we had a chip in there, a TPM as one set of evidence. We had the time dimension and the last dimension was the verifier also signings thing.

E

So I think that getting the two combined is good, but I certainly see that it can be orthogonal if the, if you're getting something input from an external source. This.

B

Is Matt I can help.

G

Okay, thanks to both of you, I think this is it a lot to behave as I will do the pitch and and send some internal copy out and then being into a public fest and then talk about it next week. So.

C

I have a question: I, don't quite understand what what you guys are discussing at this point, but I'm happy to suspend my disbelief until I see the text. Explain it. So that's okay, but um I want to know is, is should we have a stronger connection between the combination here in 55.3 and the composite a tester? Is there some relationship here because they feel similar in earth? Is.

B

It a composite tester, anything more than a router.

D

Yeah, it could be that to Michael's point. My opinion is no so.

B

Thus, the nice things the different.

E

I would I can give an example of where it does do something, and that was where you combine local measurements with verifier measurements.

E

Verifier signed a results, I should say so: yes, it can do more, and that was the example I sent out in the email, yeah.

B

So the question is: if, if you're signing, if one a tester is signing another testers output, what is that well.

E

The verifier is signing the verifier evaluation and returning it to the attest er as part of the as part of the passport mod already. So we already have verifier returned results and then do you append anything to that? That's the question and I'm saying that if you're signing something in the verifier and you're adding something new, there is a task to assemble stuff and pass it to the ruling party. So.

D

Michael the reason that I said no is because, if you look at the figure on your screen right now, every attestation or result is exactly the same claim set in this diagram. There's no nesting or conversion of attestation result of evidence, and so that's.

C

Like, though this is the same as this, and it's the same as this, it's just.

D

Having relayed.

C

D

Right this grandma sure that's.

C

Not a supplication.

D

It's not an instance of the same thing right. The composite evidence is a different relationship, and so that's what I was trying to say, but.

B

I, don't see that it's different, it's just a router in all of those cases. It's just that's just a routing function and then the other diagram. It looks to be just a read function as well.

D

The other diagram.

B

D

Distinction that says, there's evidence of a testers that may or may not become an attestation result, and then it gets included in a different set of evidence of compositive tester, where it may be an element of that. That's a more complex set of relationships.

D

B

What are those relationships? Is it trying to say that a and B are part of the monitor and that bolita tester attest to that? Yes, there's another claim here: that's not explicitly pulled called out out and to do that it has to sign something yep. So during though I don't know if the text is saying it.

D

Doesn't yet that was somebody's point about binding that we were discussing earlier on this call that didn't come up last week, and so that's why I didn't make any changes I'm at because we in talked about it before, but yes, I, agree that you need some type of a binding claim. If.

I

It's if it's not signing something, it's not on a tester.

B

Or all the sisters don't submit a claims. Collector is the thing right that doesn't make sense. ah If it's, if the claims collector isn't an a tester, then it's a predator and there.

D

Go get an adapter right now. If you look at the bigger boxes, labeled lead a tester a, but the whole thing is the ax tester. The claims collector in this picture is a piece of an ax tester, and so it is the whole thing, isn't a tester, and so yes, the evidence of compositive tester is signed by Lita tester, a right.

C

Whereas in the in the the compass in the combination that that's not the case, the evidence is not is not a host countersign. You know claims.

G

In point might be that the arrow starts at claims collector and not at it'll eat it. History. That's.

E

G

To start at claims collector, otherwise you don't know what the chain where the tin is ending. So there is some a little bit of a lack of I. Don't know, there's something missing here, I, probably, and that the arrow that is evidence of composited history simply starts at the wrong point issue right.

D

I think two possibilities either. It starts at the wrong point, but and I have to start at something that does the signing, or you say that the claims collector box is the thing that actually does the signing of the on the evidence of compositor tester. So.

C

D

C

Arrow here start outside this box is what you're saying it.

G

This to be decided and I think they have both versions here. If all the tests are a to whatever Z are just concatenated evidence in some unified structure, then the claim collector does not sign or is just again the tester a adding its own evidence.

I

G

All the evidence of the assesses, b2z and signs all that of it, then it's not the claim collector, that's emitting it. So there butoh scenarios here and depending on that I think the arrow is different. I.

I

Would get rid of claims collector entirely.

B

Yeah me too, plus one okay.

D

I don't understand, then what do you test Rafi arrows, pointing to you at they pointing into nothing.

B

I think did he pointing to a verifier which.

D

B

D

Beano connecting to a the discussion we had last week was, we said it is not a verifying environment because we said that may or may not exist and we didn't want it in the diagram. I guess repeating what I want the yaks I know from last week was let.

B

Me I think I think it's the case that there is something that severe that second, that a is connected to B a a is added to C and then the testing environment is making. That claim. Assertion is asserting that claim or as part of its signature, yeah.

G

D

And I agree that the current diagram can actually say that within text. So, for example, you have an environment inside the WETA tester right that collects claims from the target. Acquirement. Okay, I'm just going to point to the tet2 the picture here right. So if one of the claims is collected from the target environment inside the Leda tester is a claim that says: I am bound that target environment in Leda tester a is bound to a tester B and here's the idea of a test. Repeat: that's one of the claims that comes back.

D

This picture is already accurate.

B

It's describing the claims collector as a target environment. Now.

D

The claims collector is the thing that combines the pieces of evidence in different places and puts them in the verifier, but the binding in this exam in my example, is one of the claims collected from the target environment on the left side. Well,.

I

All on the tester does is collect claims and sign them. So if you say that, then what is the attesting environment even do the.

D

Testing environment certainly signs any of the claims from the target environment. Absolutely when a testing environment sign eight is from a test or B or C or there's a different signer. That's inside the claims. Collector are two ways to implement.

B

Yes, the way we've written it is the attesting environment, collects and signs.

C

Confused by this collecting claims arrow that.

D

Was there last week, yeah.

C

Is that me that was right, but testing environments, collecting claims into the target environment, yeah.

D

C

That was a collector.

D

Claims was what formerly a couple of weeks ago was something about measuring with a testing environment measure at the target environment, and we decided that we didn't, like the term measuring and we were going to use the term collecting claims. Instead,.

C

Yeah so thats collecting claims on the target environment. The attesting environment is collecting claims on the target environment, providing evidence of the lead, a tester into the claims collector, and maybe it needs to be a claims. Concentrator I, don't know what the right right where it is, but I.

I

Would I would reverse the arrows? The the the claims go from the target environment to the attesting environment, the tester be beads into a testing environment. The tester C feeds into the testing environment and the output of the intesting environment goes to the verifier, so the claims collector is gone. I.

D

Would be ok with that and the collecting claims 0 I thought about reversing the direction of that, but left it the same way as William had it since we didn't talk about it, but that what you described would would be acceptable to me. Does.

I

The job of the in testing environment is to collect the claims and knowing and knowing where they've come from, is they've come from a reasonable place, a trustworthy place, some sort and then to sign them using attestation evidence what.

D

You're describing trends up treating a test or B as if it was another target environment in that picture. Okay, with that yeah.

B

Yeah I agree with that.

D

And if we do that, you can probably read the term claims collector as well. We.

B

Can get rid of claims collector, so he says as a.

D

Term here, yeah.

B

And it's pretty close to layering at that point,.

D

Yeah, you see one of the diagram simplifications that I did is on the left side. I have the parentheses s in there, where William had multiple boxes. Just like a tester, be a test received on the right had the same thing on the left and I. That's not the main point of this. The main point of this is the right side, and so I collapse, those in the parentheses s just to simplify the diagram and put the viewers attention on the right side of the diagram.

D

Nobody seemed to have a problem at, but but that's other, but you want to assign that to me I'm happy to do what we just talked about. I didn't hear anybody arguing against it. So.

B

Let me go with my math.

C

D

Now, just what we're talking about is that reverse the direction of the arrow, which is what my post, showing on the screen right now and then a replacing claims collector would be a tester, C and B lines coming into the attesting environment. Then the blind.

B

D

Environment, yes,.

B

D

The way out right and then updating the text and not use the term coin, selector, okay, so so just.

C

To be clear here, come on yes,.

D

What you're, showing on the screen matches what it does.

C

Yes, so, but you want the the box, let me just see if I can get this on the screen here. I could show you my editor. If you prefer um might actually be better.

D

C

D

To real-time yeah.

C

D

C

Just trying to get this to my editor, but there we go okay,.

G

C

Well, let me just show the editor, because I don't know where that got something here has goats right place.

C

My video now I don't want to turn my video on I want to.

C

You at work, you see it a nice orange on block yeah.

H

C

Old amber monitor okay, so where does this arrow here? Go a.

B

Little bit Claire, it's.

D

The same line as the evidence of compositive test your line that comes out the top. It's the same line; okay, because you no longer have evidence of Leda tester that has a line that label goes away because it's only evidence of compositive tester that comes out for this diagram anyway,.

C

So, like this I think.

D

That was a suggestion.

I

D

You can delete the label on the bottom, where it says evidence of Lita Fester.

C

D

C

Lost something by removing the claims collector here, you're.

D

Not done yet because those arrows that come leftward out of a tester, BC and DA need to go to a testing environment. Well, they need to go to this box now. Yes, yes, they do not yet, and so the testing environment is claims collector. All we did was we merge those two boxes. Oh I,.

C

See, okay, so alright.

D

I see so I'd moved them to the outer box. Yeah, that's why it needs a bunch more ASCII art, because you had a move but move of a testing environment around to make them fit and so on, yeah. So.

A

You tell me that part.

B

I

B

C

D

That's gonna require move it just like I had to move a bunch of boxes around to make them fit and be intelligible. There would be some more moving around to make all the lines and labels and stuff that tears, but.

C

Emacs has has a mode which lets you type in other directions: uh-huh.

G

C

This much easier to do because you can you, can you know, as you type it goes to the direction you want. So so you want this gone as well. Then.

C

And then this arrow has to go yep like that again.

C

And how does this arrow connect just down around bottom yep? Sure.

D

Yeah now some whatting.

E

D

E

This is worth the price of admission for the call today.

D

E

A

D

Here I will point out one thing that might be getting lost here, which I am okay with okay, and that is in order to make the picture now make sense.

D

The it still make sense, as is what this is showing now, is different from what William had originally, and that is, if you look at the left side, it says: target environments, potentially plural yeah,.

A

D

Is showing a picture where there is one a testing environment singular measuring are collecting claims from multiple target environments; plural. What he had before was multiple attesting environments, each collecting from a single target environment, and so what was losing is the fact that we're saying in this example, because it what you're, showing an example here, I just like a tester, BC and dadada- is an example right. There's only one, a testing environment and a bunch of targets, that's different from what William originally had.

D

We could have multiple testing environments, but I like the picture as it is I think it's simple in it, because the point is to express relation is part of your point that this hat should have a plural. No, what I'm saying is that once you have plural, but a claims collector was just one of the attesting environments, we're saying no, you wanted to combine those, and so that's the difference between the change that we just made, because we're saying, albeit Esther, BC and DA, are- are done by the same thing.

D

That does the signature over the composite evidence, which might include individual things that are individually signed by their things, and so here, if you only have one a testing environment, then you don't have sort of nested signatures per se. You just have one flat signature over a bunch of target environments. So it's a different picture. I. Don't that may be sense.

I

I mean nesting, we do show a nesting here. So that's okay, because you have a tester, B and C feeding into the into a okay.

D

Fair enough, that's fair enough! You don't have nesting on the left side, but your career right. You do have it on the right side. Yeah. Let's.

I

Get out of my application, where a tester B could be an instance of a tester, a you know, kind of about that detail like I, am fine.

D

With this, because I think it illustrates, the main point is illustrate the right side. Yeah.

I

um What I, Oh I'm just curious I mean. Is there some reason you would have multiple, a testing environments for the same target? That seems like not crazy and wild, and you know we're redundant space. Shuttle shuttle testers or something now.

D

What William had before was inside the leta tester. He had multiple targets and multiple testing environments with a one-to-one between them. Okay,.

I

D

Was his original picture yeah.

I

Last truth understand in.

D

The printers is because I didn't think that was the main point of the diagram that we're trying to explore. So just like we're not showing the blow-up inside a test or be either right. There right.

I

Right, yeah, no.

D

I

Done I'm not saying that that we should go do all that I'm just was I was just trying to understand what the motivation might have been for that we don't have to draw the architecture diagram for every possible configuration. I mean that exactly.

D

Yeah I am fine with a diagram as you have it Michael. The text needs to be updated to match with. As far as the diagram I agree to. This is what we were just saying. Yeah me too,.

C

Okay, I'm just concerned that we're going to change your mind again next week.

D

You mean when we answer the call yeah.

G

I was also saying the same thing: I'm not super sure if I'm, okay, with ending it at the environ box, but I have to think about this until next week. So, yes, maybe I will have another opinion exit.

B

Is it still evidence of composite a tester, a thing or the just inhibits.

D

um I think it's still correct, as is because the big box on the bottom is still labeled composite a tester.

B

So what we're we're to look if we're trying imagine what the evidence looks like is there's a there's, a set of claims that are for the target environment, there's a say, multiple sets of signed claims from the tester, BC and etc.

B

There is an additional claim that says that that the testing environment is as assembling become the site claims from these other environments into a composite evidence structure, but there's there's a there's, an additional claim. That's added to the claim, set that says: I'm doing the assembling, that everybody's agreement, everybody's understanding, that's.

D

An example of how it could be done. Yes, more.

E

Than us one we're Hollywood, but yeah.

D

It's more than one wait and I agree. That way would be a way to do it. Okay,.

B

So, let's go over all of that information. There's one signature over all of that information into us structure which is I, guess a sub sub mod structure or something like that.

D

For example, yes,.

D

D

Michael you're, muted.

C

Yeah I'm just typing to try to fix the text.

C

Is there another topic that someone would like to jump on to.

D

What's the next step, on the other one, the ads drama and text about freshness, poor request that we just last time, I did a minor change and I didn't know if we want an emerges want to assign somebody else, an action item for the next step, the feedback that we talked about last time other than gosh. It would be nice to add. You know the following topic or whatever it was. We wanted the title change back to freshness which I did and we wanted the security considerations.

D

Section talk about replay protection and all I did was I added. A one sentence that mention replay protection can be done using freshness as discussion for their section, and so those are only changes that I did I, wasn't sure what to do in response to all the other things and so I'm wondering if somebody else wants to take the next action item and if we I would propose that we merge unless there's any new objections to the text, that's in here and then do any changes as another pull request.

B

um I could be okay with that I want to take I. Have the conversation about how a precious nonce is handled in in a composite the tester scenario, or do we want to wait until we get layering as well to have I.

G

Think it's more important to capture what we think is right for the moment, and you can have this deep discussion on layer next time and then revisit this if it doesn't match. But I would agree with days that we can pull this in for now, because it's an improvement in any wow in any case and sorry I'm driving, and so this is I. Think good idea and we have stable environment of the text is visible, but everybody's. Looking at any branch, every branch.

B

Okay with the text.

D

Want me to pull to merge this. That is my proposal, since I did the things that people had problems with and other things were just oh, we should cover X or I to and I didn't do the cover, X or Y to you. I didn't know what to say there, but as far as the things that people had problems with that fix, those I would propose you go ahead and Marg it now and anything else. People are welcome to submit new requests for.

G

A

G

For emerging, so I would like have is like a like: a remote verax, pretty review, and yes, I. Thank.

D

C

C

I think I have so.

I

I have another comfort on the diagram going back.

C

C

You want me to put the diagram up yeah.

I

If it was there a second ago, the composite diagram, um the parenthetical via internal links or network connections, yeah I- don't think the network connections belongs there.

I

This may be a longer discussion than we have for for today, but it's the discussion. We were starting with the GPS and the time thing, but I, don't think network connection belongs there. How.

B

Do we tell them.

I

E

It's important to show either of them I.

B

Think we have to ask how how the testing environment can tell the difference.

D

um I guess the labels now isn't vigilance. Is it internal parenthesis, links or network connections or is it internal links or network connections.

D

Well, via a link in a network connection are basically synonyms and, if they're both internal then just dropping, it would have no change in meaning right. So if.

I

It depends on how the hardware characteristic of the connection, so this is this- is in a sub mod. This is connection type seems to me. There are you kind of falls into two categories there. There is a connection.

I

That's really based on hardware like these guys are on the same bus or they are running on the same processor and they're, just different processes, or something like that, and in a situation where the attesting environment can know something about the the source um and it can know it from either it's the hardware or the system, software that it's running um and those the only things that the testing environment can know about.

I

Let me finish: if, if it's coming from a network, then it gets or even a USB connection or or an RF connection or Ethernet, or anything like that. It's going to have to go to some process or some entity on the local machine, which is going to be the thing that actually talks to the tester.

E

B

That the even, if, even if it something even if the evidence arrives over, say a local bus, the USB it doesn't there's nothing, there's nothing to prevent the the testing, the other, a tester from being network connected and obtaining evidence over that network connection, and so it's actually misleading to the verifier.

B

If, if we, if the architecture assumes two-month much about how that evidence was put together, and so it's almost sure what value is being at the end of the day, what value does this bring to the verifier, knowing that it arrived over a bus if it can't conclude that it didn't come over a network, but it couldn't, it can't conclude that actually so what's the value. So if you.

I

Would give an examination example of a boss in this case I have.

B

I

A

B

Nic connected to it be: stick it in her USB port, and we still don't know if that evidence didn't come over a network from it, but the rift the originating environment wasn't actually that we're connected. We don't know that.

I

Yester, the ax tester can talk to the USB driver and, if it trusts the USB driver in a then it consists some things about the you know what is coming over USB but the ax testing environment only. It only can trust the USB driver and when I talk about bus I'm, not talking about pluggable bus I'm, talking about a bus, it's like internal to a CPU or internal to a circuit board card, or something like that.

I

That's not pluggable, and that that's why this connection type is really kind of important, because you need to understand the characteristics of that connection. You know how easy is it to attack that connection or spoof that connection, so USB is kind of easy to spoof. Ip connections are very easy to spoof. You don't know what you're what's on the other end, unless you've got some sort of signing cryptographically signed system. So what you really have to be doing is thinking about talking to things that the interesting testing environment can really understand and know something about.

I

So there there got to be processes on the same CPU or hardware. That's that is connected in a way that the end-user can't manipulate the hardware. So USB is level into the IP connection. Yes,.

G

So this is saying: I think this is an oversimplification. Maybe it might be dangerous to assume that we can infer somehow the level of assurance of interconnects yeah, so I'm not sure if we wanted to have that assumption, you call that wise evidence you live without. It isn't.

C

H

C

From the attest errs, B and C's is signed yeah. So why do I care? That's.

E

Really investor- you can also worry about. What's coming where it's coming from like self-driving cars, you might have evidence coming in from their internal network, which might have certain assumptions about it that better be coming in from that particular bus. So I think that the assertion that that there's something implicit about the attest errs connection, even if it's signed or not signed, does matter to the attesting environment and it isn't being generated by the ax tester. It's relevant to the connection different connection types can have different trust profiles with them. The.

B

Point is: is that the evidence from B and C could could come from a remote node, but all that's being assertive is that that that evidence arrived over a local connection, but but it doesn't really know yeah evidence arrived locally, so the term of local and remote is confusing.

B

E

G

I would plus one the benefit.

E

Say this is one of the things that hit the layering. This is one of the reasons I kind of jumped back from layering, because this is exactly a layering question.

G

Exactly thank you Eric for putting the words out of my mouth Oh. Most of us I, don't know.

B

B

The layering is sort of looking at this from a completely other perspective, which is starting with the like, via tester B as the starting point and going the other direction, then compositing.

B

Positive sort of drilled out and layering his drill up.

E

Of the inner integration and that's why I kind of step back and hopefully we can take another attack at it. With this view, yeah.

B

But yeah I'm for using different terminology and different diagram for layering, then we're compositing and not trying to combine them. If.

E

G

Makes a make sense to me also again, they did I was inspired by this conundrum by the arrows that are now ending at the testing environment box in the composite a cessation device.

G

So that was confusing to me and and and now you can see why? Because this is the, you cannot see the origin anymore. So it's just clear and it depends how you how you track it and what assertion you can make about the interconnects I'm, not sure of this, the.

I

Attesting environment, I'm not I, don't understand what you start my layering yet, but the I think the in testing environment has to be able to evaluate how its evidence is coming in. That's to understand something about how its evidence is coming in and including at a stations from added station evidence or output of other a testers. So it has to understand that that's just part of what an ESD have to do. It.

B

Certainly, there's a set of claims can be asserted about out the connectivity of the different but thurid evidence so how it arrives, but it can't project onto that evidence too much unless it becomes.

A

Yeah or higher.

I

B

I

Are we going all do we have an hour and a half's today or an hour.

D

The invite is only an hour: okay.

D

We're already past the time of he invited yeah.

G

I think I have to jump to another call I should at least but this is typically more important and sorry for being so unprepared. This week, I was literally all the time bound by a stupid, off-loaded project that I have to do it so next week. That's why I was not a little bit careful I'm, promising extra, but I. Think I can do the layout thing with help. This is the case and thank you for the time. On my side at least thank you. I.

C

Emerged, Dave just had a fix for something for a small thing: I open an issue, as you saw on this internal links, question which we just discussed and I didn't hear a clear resolution to it. So I think when I picked it.

G

C

I I fixed some whitespace, trailing whitespace issues and I fixed the text here so I appreciate. If someone could go through this text here and say whether I got the right word in particular, I think the word eyeline.

D

C

Still has the term claims collector in line two of to the nice pics? Okay, there you go, I'll fix that, but I termite I think maybe controversial is the lead, a testing environment. Maybe I agree that that Navy, controversial, cuz I, don't know. One would agree with that. But we'll see oh I don't know, but that's that one is that's where I would like to know. He said it'll be on the call next week, so they're back on Friday. um So let's leave this for next week.

C

Unless you have some strong opinions right now, please put them in and talk to you next week, I'm.

C

Proposing that so let me see so next week ah next week we have our meeting at the nort regular time and then we have a rats virtual interim committee of the whole the following day. At the same time, I'm not mistaken, and it's going to the Lawrence Show.

I

C

True am I completely back.

I

C

I

I think well as far as I understand it at this point. Yes, you.

C

Got all the agenda items, it's you're sure I.

I

Mean I just asked for some time and they gave it to me.

B

That was private without those flies to talk about use cases yeah.

I

Okay, all right I probably won't attend next week for this meeting, because it's conflicting with Ryder house all right what the rats.

D

C

Wanted to ask if we could pencil it, that's what I wanted to ask actually I'm.

D

Looking for Hyundai.

C

D

Was going to ask if the rats virtual interim on the Wednesday is there anything that we want to say about the architecture documents? Other words: do we need a slide to give the status or something or not, probably so,.

C

I would propose that we post a version after next week's.

D

Call because, if somebody, if we do huntin, does have a slide about the status or something then we may still want to meet next to, we can just talk about that slide.

G

D

Is my angry with anyone.

G

Apparently so, but I don't do it really exactly so typically, the best thing to do is to submit before and then talk about it as I. Read it and then talk about it, so we have a slide and then want to submit afterwards. So I don't use it again. What do we gain by that.

C

Submitting or having a slide yai.

G

Submitting directly after we talked about it like three minutes with a single slide, I mean you could submit it, I think after Tuesday's meeting and then people who might have a look at it just beforehand and and that it more productive, I think than submitting afterwards. That's.

C

What I suggested I wanted to submit on Tuesday before the the virtual interim as a result.

G

Of the recent we.

C

Consent we, whatever consensus we get next week, we'll submit it as a as a miles as a point in time have a slide to summarize what we talking about and there, and maybe it will agree to to close this pull request, and maybe we'll have decided on this. This issue 24.

B

Is there or the.

G

Meeting to be the Red Sox meeting, then the interim sorry I didn't I didn't trick at that. Back then, is.

B

There value in doing that, if there's no discussion at the virtual interim.

G

Typically, it is, everything is basically GDP. Ceo tomorrow is the rest meeting and seven people might read the architecture before him just because this.

B

Is an agenda item to talk about architecture, so nobody.

G

B

The current and it.

G

Would be a side would have to be too bashed in because we are late.

B

D

Why I wasn't assuming more than one slide, but often you know the chairs, or somebody will have a document or milestone review if you just submit one slide off and I'll, stick that in.

B

A guy you wanted yeah about.

F

B

Minutes first, five minutes at the beginning and five minutes at the end. Basically, but the end, then five minutes is looking on the use cases dis positioning. The five minutes at the beginning potentially could be used to update the status of the part of the architecture craft you.

B

So it's weak, it's possible to squeeze it in okay,.

D

B

Yeah I appreciate it.

D

D

Okay, so shall we end now and resume next week, yep yep.

A

D

That's great thanks, guys all right.

C

I think her all welcome to all the new people. Okay,.

E

H