Internet Engineering Task Force RATS Architecture Design Team, 17 Dec 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: RATS Architecture Design Team, 2019-12-17

Description

RATS Architecture Design Team, 2019-12-17

A

Good morning,.

B

Hey there's the same morning.

A

Trying to remember how to edit, oh there's, the edit button are.

C

We gonna same time.

A

So you're going to put the notes at the beginning of the of the.

A

Page or an important beginning.

B

The quality Jemma there's.

A

No yama left in it.

B

A

B

A

Down, there's no mark down; okay.

B

Oh then, if it's just the list of notes, it's the end all right.

B

So, in any case, you're wondering we just do here right now: Micra sent around a link, an email, those two links of them, one of them this vivix, the other one, is the interactive second II which I could share, but effectively everybody I could also just join and heck away. So either we will put things in PRS and issues on github or on to this list that we are maintaining internally. So we will find out the very end up in the end, but we have all of these options so.

A

I think it was quite effective for us to just share the github, yeah and I'm actually I'm enough screen real estate. I can do all three. At the same time,.

A

C

A

A

Fended off a cold the weekend.

D

Does that sound like it's completely off well,.

A

There was, you know, collateral damage.

B

My kids incubate new strains like every second month, so it's perpetual I know something with me. I got used to that. We.

E

Get the flu here I had a flu I.

C

A

The flu shot and it works great- my wife says: oh, it makes her sick every time because she waits she waits until it's flu season to get the flu shot, which point she's actually already got the flu you have to go than that anyway, the.

E

Time that my son needs to get off to school, and so last week my wife was.

E

And didn't even think about this, because I was concentrating or.

A

Yeah I can't tell you how many NomCom calls I did years ago with heads with the headphones standing in the schoolyard yeah.

B

Yeah that's headphones on. My lifesaver also also net is still missing, as anyone heard or read about him not joining. Otherwise, it's five after the hour almost no doesn't seem to be a information about that. Geary was here last time, but I see Lawrence on the call. Lawrence. Are you as an eat, offer representing each I suppose so? I.

F

Guess so yeah I don't know.

A

Also possible that Lawrence and Geary have an inverted wavefunction and can never be in the room. At the same time,.

B

I've seen proof so.

A

Okay, so I would like that.

B

A

Start with, um maybe if I can find the right tack, the right you feel like I'm in the right place here so I like to start with days rebuttal of the work we did without him- and this is kind of it here or I- could put the diagram that the just the diagram itself on. Oh.

B

Go to his comments, which I support properly in this PR. Yes, wait! No I.

A

Think he wrote his own okay.

E

I submitted an updated diagram. Oh you did.

A

E

If you look at the latest commit differences.

B

You can have multiple commit versions. You put that one. There.

E

That's what you see the before and the after in the in the committee yeah I, know, but right now your that's right. Well,.

A

I'm trying to look at files changed what.

E

If you click on commits and just look at the latest commit that's.

A

What I just did oh I, looked at that I looked at the first commit scuse me.

E

A

Is wrong? Yes,.

A

Okay, so you're proposing this so well said a lot. It's too bad Ned's, not here, because Ned said a lot of things about why we wind up writing it. This way.

E

Multiple problems with this, the main problem that I pointed out on the on the email was that it is not correct that the endorsements come in through appraisal policy, endorsements come in and then they go away and then only appraisal policy comes into the verifier that part that incorrect the verifier can get appraisal policy endorsements from two independent sources, neither of which are related to each other.

E

The second problem is that you see the appraisal policy for evidence comes from owner and the appraisal policy for attestation result comes from no place in those things. Well, it should be the same well well. Well, we should mechanism should be the same. It'll come from the same place, but I'm saying one is a line. One is a box, that's not correct about. They should both be lines. Oh I.

A

See well I I I'm, looking.

E

Creditor friendly.

A

Edit, so I don't great.

E

A

E

You can see the green dark yeah you can see. I have changed a policy for attestation results to a line that comes from whoever it is. The configure is to relying party as opposed to the appraisal. Policy for evidence comes from whoever it is that configures, the fire.

A

So I I think I. Think III would certainly accept that as a very friendly edit that we just didn't. We just didn't think that finished thinking that, through in the last three minutes that we we were doing that, but I totally I think I think we're all in in agreement that that's totally reasonable.

A

B

Second, the part this dependent- this depends on something. Even this is okay, if endorsements are on the same level of terms as a pager policies, which we think at the moment are not because appraisal policies as a subset of endorsements.

D

B

This is the problem you're talking about. Yes, thank you are.

E

Things that's why they're defined as separate terms in the terminology. That's my opinion. All.

A

E

Hank, what did you say? I want to.

A

Capture what you said as the converse, our appraisal policy, a subset of evidence is that what you said.

B

We have started with the very old school known good values and reference values, and they were too strict and they didn't encompass all the things that could be appraised assessed by appraiser procedure. So we needed a super term, and that is now appraiser policy, which includes reference values and then we have the endorsements, and that is in global platform. World meaning means meaningfully signed. So an unendorsed table you as an unsigned talking literally and in here we mean something it's a little bit and that might be a problem. I am Not sure.

B

We also have a small problem to determine endorser, it's almost as bad as the term is shorter, but we are sticking with it at the moment, because we cannot address everything. At the same time,.

A

So so, but but.

B

A

Wanted you to clarify what you said was was about subset because you, you refuted my term, but you didn't actually correct me. Yeah I know.

D

A

I know so, but you did say that we are discussing whether or not something was a subpart of the other and and Dave said that wasn't the case and I want to just make sure that I understand what Dave said. Wasn't the case.

B

And odorous a policy, that's all.

A

So the reason why we wound up with the endorsements going to the owner and then the appraisal policy for evidence, was that the owner had to somehow say which had to make use of the endorsements to produce the list of what our actual acceptable agree.

E

No good values right the way that you phrase that, because your phrased, it is how to use the endorsements, the appraisal policy itself does not need to have any endorsements. It just needs to be able to tell the verifier how to use them and which ones the trust and so on.

B

I think we had the owner has to kind of put this into an email, some other thing as a gateway function for all available endorsements and actually maybe concurrent appraisal policies and the hair they have to be by the owner. The condo controls all of this, so it is tight. So it's very policy what smell endorsement for this thing.

E

I object to the use of the word gateway in a discussion about data flow because Gateway brings in protocol yeah. Okay, sorry yeah.

B

And I'm, just using ITF terms, the II's, IES, Jesus and essa gave a function, so so I was using it in this scope, but I'll be with you. I will not use gateway in text just.

E

Perspective I would disagree that the owner is any type of gateway in a data flow perspective. The owner may never ever see endorsements. The owner may be a human, for example. It was typing in her policy in a command line that human will never ever see the investment may see. He may know the format and metadata about it, but maybe not the content and the values in there like no idea what the actual reference values are of those retro user copied out of an endorsement or something else, the the owner is not involved. I think.

B

That is true for both owners. Here two owners is, do you think this is applies to or verify and Onofre line party in the same scope.

E

I would like us to discuss this topic relationship between investments seen by Ana, verifier and attestation. Results is seen by relying party. We can put that on the stack and come back to that before. We need this diagram, so I.

G

Think and I thought during the thread we sort of resolved that an owner could also be an endorser and therefore months, even if even if an endorser, what a more even if a vendor didn't generate any reference measurements that a owner could generate reference measurements and assert them as endorsements. That would be correct, hello, and in so doing the owner would be that the entity that is implementing the owner role is also can also be the same entity that implements the endorser role. I.

E

See endorser and I'm trying to use terms that I think are because this one hey so tell me whether I'm cuz this or not, is and the endorsements are something that is generally signed, and so, for example, an endorsement might say: hey I am a manufacturer and I vouch that this particular a tester device was manufactured by me. That's an example of a claim that that might be signed in an endorsed.

E

The appraisal policy is the rules for how to set claims that come in evidence, and that might be your appraisal. Policy might be if the claim X has the value Y and it's good. The only example is an appraisal policy that, in itself embeds the the a reference value. It might also be if the evidence contains a claim X with a value Y, which is which matches what comes in an endorsement signed by the manufacturer. That would be an appraisal policy that doesn't know the value of Y.

E

It just says: hey, compare the food claim in evidence against the foo expected value in endorsements, and that would be the phrasal policy, and so this is when I think Michael was responding in the comments on the github is saying it could be either. If there's a reference value, it could be an endorsement or it could be an appraisal policy. That's absolutely correct. I agree.

G

I also me: that's.

E

Why seeing whether reference values are in endorsements or appraisal policy? You can only give examples right. You can't say it's in one. You can't say it's in the other. You could say it's typically in one of them, but I think Michael was correct to where he said often appraisal policy, but it could be either and that's why I think our data flow doesn't say reference values, because it could be either right. Multiple ways to thinking I mean that's even in the example we're using reference values, beginning right.

G

And so we use the we sometimes I think we're still unclear in the definition of endorsements. And what are we saying, reference measurements or reference values? I would.

E

Not use the term reference measurements in the data flow. What.

G

Was the what was Hanks term.

B

We have typically typically used terms are in order of appearance reference, value, reference values, non good values and sometimes even nominal values. I, don't know where that comes from, but that is also of use.

G

So so in the flow from endorser to verifier, that was at one point endorsements and one of those terms he just said.

G

We were not clear on whether or not endorsements whether or not the reference a column, reference values, our subset of endorsements or strained definition of endorsement such that it couldn't be a subhead I, don't know it seems it seems to me like, at the end of the day, there's going to be a claim.

G

That represents a claim that that informs a token definition that describes reference values and one that describes properties of of how a tester is is built and both of those could come from a vendor, in which case I would hopefully, you come up with one word that represents the claims that come from a vendor.

G

Right now, I would assert that's endorsements. I wasn't clear, yeah.

B

I think vendor, for example, or supply chain entity, is a typical instance. It could also be a certification entity, something like that. But I think it's most important that to highlight that in the endorsements are the confluence through evidence that the attest I cannot create Speights, it might store them itself, they have trust anywheres outside, and this will give you the some supply chain entity event or whatever.

E

May or may not manufacture these many types of endorsers so.

G

From a a what's being labeled a verifier owner mm-hmm could also play the role of endorser, so the entity that implements the verifier owner role and also implement the indica role and I. Think that address is a use case where there isn't there isn't any supply chain entity or vendor entity or manufacturer entity that produces lames and as but are still relevant and necessary to verify evidence. Therefore, the owner role could produce I'm sorry, the endorser role implemented by the owner entity.

G

Endorsements, in other words, sign endorsements, so that severe make progress and.

E

We have an implementation that for armed where the endorser is the owner. This.

B

Drawls canvas under collapse. Yes,.

E

And we have an implementation for SGX where the endorser is not the owner, but the endorser is the manufacturer, and so the endorser is a generic role that the endorsements could come from either.

F

I'm still very unclear on what the owner is and why there are two owners in this diagram. It seems like there there's the owner is the. Let me feel, let me say a couple more things here, so it seems like to me the the verifier could be implemented inside the relying party. That's one case, the verifier could be implemented by the the device manufacturer or the verifier could be implemented by a an intermediate service of some sort.

F

That's you know not not the relying party or the device manufacturer I mean an aggregator or something like that or you could have a chain of all three. Yes, so the fact that the verifier is outside of the one party box here that that's that sort of implies that the verifier is not the relying party implemented inside the rolling party and then Marya li don't understand what this diagram. What makes no sense than this diagram to me is why there are why it's diagram has policy going into the relying party? I mean it's.

F

Certainly, the ruling party will have policy, but that's like it's risk engine. It's not really anything that we wanted.

A

It would be so so so Lawrence just three things here right. These are roles not devices, and the roles can be implemented in in a variety of different ways. Okay, the second thing is that the things with asterisks around them are not subject to standardization and the things on the arcs are that go down. The policies are probably also not for standardization.

F

Okay, I understand that I still don't want to see why there would be this other appraisal part my world. Why we are listing a relying party owner here and why it.

G

So I think we have to have the conversation they've suggested. The earlier is that what is the definition of attestation results because that's going to define what policies are appropriate for evaluating those results? I.

E

Agree, it's part of that second topic, whether we want to get to that now or whether we want to stick on the endorser verifier or no discussion.

F

We can delay it, but can you give me some really really concrete examples of a verifier owner.

E

E

Will give you one example, but I have to describe to the viewer. Fire is first, but the the short version is in most respects. I would expect a verifier owner to be the verifiers admin, human, whoever the humans or the tools that the humans are using to configure the verifier. That entity is the verifier owner. So, for example, the verifier is say as your attestation service, which is being posted on behalf of them to pick a pennant by your owner.

E

It would be the tenant ad man who configures their their policy for their instance running an edger and the verifier is say the Intel SGX attestation service, I, don't know if that's the correct term, but there is one, and that may be Ned could speak to the verifier owner would be Intel verifier, the verifier is say in the same device as the relying party and it's an embedded one. Then the verifier owner might be the same entity as whoever the admin is for their relying party. Those are three examples, so.

A

I I I couldn't catch all that and I wanted to catch at all. Would you mind going over the second time I gave.

E

Three examples: I, don't know which part your cuz I'm, not looking at I'd.

A

Like you to so, you gave three examples and I think I just had difficulty, knowing when one started so just say the first one first example.

E

Number one is as your attestation service, meaning who the verifier is. Example number one is when verifier is as your attestation service right. Okay,.

A

So, hang on, let me just write that verifier is at as your a cetacean and AAS.

E

As your attestation service yeah, that's very for your for background. As your admins don't run the Asscher attestation service, it's something that a tenant can opt into and then it's the tenants service it's just hosted and Azure, and they said hey make me one of these services and boom. You get your own as your attestation. It's like running your own CA in a cloud or so.

A

So a juror provides the software, but the tenant runs it and and drives all of the big things. Yeah and.

E

So here the verifier owner would be the tenants ad man who's configuring, their service running in a cloud and.

A

So the verifier is the tenant. Well,.

E

The tenant is a corporation right. It's you know it's okay,.

A

E

Coke or Pepsi, or you know, horrid or GM or whatever. It is right and.

G

It is the teeth at the verifier role.

E

Lieutenant is the entity that runs the verify well, but that manages it's technically running inside of a data center. It's in an azure data center, yet verifier owner would be. You know the coke head man, pepsi admin, the 4g order.

A

Gma I I'm I find it strange that you're distinguishing the person from the corporation that owns it, but but since they act on the same but but nevertheless you have a reason for that. So continue. Okay, so that was the was that the first example the.

E

First example: okay, the second one is Intel's gxs station service, one that's their own. It works via Intel's works between an SGX, a tester and an SGX relying party that both use Intel's service for attestation.

E

A

And so in the Intel SGX adaptation service is the verifier. There.

E

Is an Intel, it runs an attestation service cloud, their own servers that any SGX a tester airline party can use for remote data station as long as both interest. Yes, and so here the verifier owner would be Intel or an Intel, ed bean or whatever we're.

F

Talking about the class, it's where the manufacturer of the ax tester and the device is doing the verification.

G

If Alice to use the Intel verifier Alice would get a certificate issued by an Intel CA and essentially becoming a an entity under the umbrella of the Intel's OCA hierarchy. Alice.

A

Is a relying party I was know.

G

Alice's, the next s, the.

A

G

That wants their policy applied by the verifier. This.

E

Is a case case to hear that the Intel gestation server is meant for a testers that are SGX enclaves, not other devices, not specifically SGX enclaves, a tester, that's case to.

G

The record SGX supports the other use case as well.

E

And the relying party is epically also an SGX entity, although I leave, it might work with relying parties that are not as checks on claims I'm, not the expert on that bird yeah.

G

There's no there's nothing the verifier, that's it.

E

Has to use the Intel SGX SDK so that it can talk to the Intel verifier I, don't think it has to have an S Jets Enclave inside your way. It's been the attacker.

B

Yeah and just as a side note- and this is very super- nitty I- think all the two terms here- the Asia inter station service and the STX as a station service, so in general I think this service is a remote as a station service. That's what all this is about. If the thing could do it itself, it would not be a remote it's a remote at a station service, and that was the mystery box on the top right.

B

I think in the Tata architecture will be anticipated that this is the thing that typically everyone once goes to and has different owners. It's something at the end. Yes, that's correct, although.

G

We have had conversations on the list about scenarios where the a tester and their fire work combined into the same entity.

E

Certainly that.

A

Let's not muddy that right now later later, third example, the.

E

Third example was what some people in the past I've called a verifying relying party where the verifier and they're lying party are in the same device, and here the verifier owner and the relying party owner. It may also be the same, say: the device ad Manfred's.

E

There's no separate server or service. This is a case where the verifier is just embedded into the same device. It's relying party and so whoever configures your LAN party, also configures the verifier by configures I'm. Just talking about the appraisal policy, that's.

B

Correct and also same device does not mean no isolation, necessarily because tes could give all these domains separation, but there, as as Laurens highlighted a few times, you can also combine them into the same execution, environment being rich or trusted IRL. So it could be also come without isolation, but it is a design choice in the solution.

A

So the point is that there may actually be protocol between the enclaves, but because they have the same owner, they have identical. They have identical policies effectively. The attestation result can effectively be a boolean.

E

Limitation choice: you could convey both appraisal policies into the device the same way but they're still conceptually separate things. I.

A

Agree: I agree.

E

What I'm saying in the.

A

Degenerate case, where you just make it all, the policies are the same. The attestation results effectively abilene because the verifier applies the same policy as the relying party and therefore all of lying party needs to know is that the correct the correct appraisal was made.

B

Are you okay with that, because Lawrence is always an advocate of non-binary ever talking boolean here now, and so I would like to give Laura's response to those are just two examples: they're both valid. It sounds okay, okay,.

E

B

E

Treating it as a boolean, one example is where you have a lot more granularity and you pay attention to the claims in the attestation results.

H

F

I mean I, don't know, I find this notion of an owner that enlightening basically saying an owner is a guy that configures the verifier figures the wrong party and to me they would sort of be implied that that's already here, but okay, the.

A

Reason Lawrence we put it. There was not because it wasn't obvious, but because we needed to distinguish the different owners and their different their different views for it, such that we know when we'll be confused about where this stuff was coming from and I think we all agree that it's it's may be obvious, but sometimes you have to peek people over the head with stuff, that's obvious, or they don't get it.

F

The other thing that seems weird here is that there's an appraisal policy so I mean I can understand that we have a definition of a verifier that takes in evidence, endorsements and policy and produces results. So that's kind of part of the definition of what a verifier does.

F

In this diagram, the verifier is shown independent of the relying party, so I mean.

F

Relying party evaluates the attestation results, which could be a boolean, which could be a bunch of different values, um seems like that's the relying parties thing and it's not really part of the definition of a verifier. How was.

A

It, how was it ever, the definition of the verifier.

F

At the point of the diagram here is to say that a verifier takes in three has three inputs and one output and isn't the definition of the policy. I know sort of part of the definition of the verifier, the appraisal, policies and the definition of the verifier kind of part of the definition of the appraisal. Policy.

E

I understand what you mean.

A

You jump to relying party, you start talking about relying party and then you start talking about the verifier. So that's why we're confused by what you're you? You said they're in the same they're in different boxes, but then you said they have each have separate policy, which is exactly the point I think.

A

Maybe I don't understand what you said so.

F

The appraisal policy for evidence is clearly in the domain of what we're defining as part of rats.

G

F

We could even define some data formats and protocols there if we wanted to they're, not.

A

Sure that I agree with that statement that I'm not sure I agree that the appraisal policy for evidence is a subject of standardization, I'm.

F

Not saying we will I'm just saying you could, like you could say you you could you could define some it's part of some process, part of the definition of verifying locations or verifying software measurements. You could say here: here's the format for evidence for these kinds of measurements. I can.

D

Add to that I mean the idea that you have evidence you have to have a at least some common objects named for the appraisal policy for evidence to be able to apply to it. So if we want to, if we want to identify the evidence, you have to unbel to be able to talk from the verifier owner in the same language.

E

The evidence will be completely vendor specific across four different vendors, and so the verify needs to understand that and if it's I think you can't standardize it, which is why I believe that the way that Michael phrase did I completely agree with, which is I, don't think you might be able to do a particular one. So if evidence is in each or something like that, but in general no, you can't so.

G

We said I think we said the group at least said early on was out of scope to define endorsements an endorser beautifully at the time have the notion of an owner. So we didn't have the notion appraisal policy for the audence or raise a policy for attestation results, but some as Lawrence's guests believe that it was.

G

It was something that was already part of the verifier and/or relying party, so I think it's an ambiguous at this point as to whether or not the working group believes that it's within the scope to define the owner role and messages that flow out of them.

D

Especially the verifiers and the relying party like I know that some of us are interested in the ability to define that appraisal policy would be important.

G

Yes, I think you can't implement a verifier or relying party, without definition for all those arrows flowing into it and out of it exactly.

F

So to me in this diagram the attestation results we might defined out some format for that or we might not. It could just be the relying party talks to the verifier via TLS and gets a single boolean value or the relying party gets the the output of the verifier in some other format or.

E

For our implementations, the only line in this whole diagram that we care about standardizing is that one, the attestation results lead is the only line in this entire diagram that makes sense to us to standardize for our implementations. This.

B

Means since Microsoft or another entity, I'm not aware of.

G

When we say that the result is boolean, it actually is a boolean. That's describing how a policy was applied to evidence and who and who were the owner and the who who was the owner of that evidence, so there's more to it than just a boolean. Even if.

A

It's a statement, it's a statement, not just true, but a statement that Ned said based upon the policy that he was given insert policy that it is true right, so I wrote in the ether hack MD in order for the appraisal policy to be expressed, the naming of the evidence needs to be standardized, but the appraisal policy itself does not need to be standardized. I.

E

Disagree with that, okay, Davis.

B

Coming from the remediation point of view, so if you have 12:1 to have the complete remediation work flow, that is pitched and teep, there has to happen some standardization but I think that the chances are good, that we can reuse the each format, be it a CW TV or be another. The CW t I, think that is up to discussion guests again. I think we can reuse that one. But it is important, of course, through the scope of the use case, so.

A

Actually, I disagree.

E

One word, and that word is the word standardized and the evidence needs to be standardized I, don't think the logic follows in order for the appraisal policy to be expressed, and naming of the evidence needs to be known: the appraisal, policy, author and verifier. That does not need naming that needs to be standardized. Okay, sorry, actually, let me vendor specific evidence. I realize a crime folk.

A

Dave, okay and what I intended to say, I, don't mean to say the names of the evidence, I mean to say that the the syntax of the how you express the evidence needs to be clear. I.

E

Understand that I had the same understanding as you're, not correcting my understanding, I'm saying the syntax of the evidence does not need to be standardized in a standard sense. The evidence may be existing vendor-specific. So, for example, it may be intel's SGX evidence that has a shift right now. It could be somebody else's evidence. That's already shipped right before rats has done anything.

E

There's evidence, that's already out there deployed in the world and you can have a verifier and as long as the verifier can get appraisal policy that can do with the existing shift evidence, then it can work and it could even produce standardized attestation results.

F

It seems like the appraisal. Policy for evidence is gonna have a very direct relationship to the evidence from the a tester format.

E

And having knowledge of the syntax there's my and.

F

It's not too much much past that evidence. The appraisal policy for attestation results could be this boolean output from the graph err consider the the source of the transaction, the cash credit history and the moon.

F

It could be a whole bunch of stuff outside of what we're really defining in Wrath, which is why yeah that thing confuses me.

E

E

Results is more than just a boolean, often the attestation results may copy in claims and a standardized values out of the evidence out of endorsements or out of out of put in there phrasal policy. Maybe it's a process claim that's a summary of a bunch of information, so an example might be the attestation results might have to use the phrasing if they Michael had, which was the anticipation. Result, said hey. It was good and here's a claim, that's the version number or hash or whatever it is of the appraisal. Policy.

E

I used to produce the results, so there's different things that go in the attestation results that are various claims. The attestation policy for a test, the appraisal policy for attestation results tells the relying party how it should use the claims that come in in the attestation results.

B

That might be still out of scope for today. F1 important addition to this, and it is getting to Dave's initial two examples which are the past part and the background model, I'll, check scenario and I think the passport version is really relying on some of those evidence. If the passport is not standardized, no arbitrary passport checker, we understand it. So in that model, where you just hand it off in good hope that this is makes sense to people, it has to have some standardization, there are the alternatives of the already existing stuff.

B

So not every scenarios have to incorporate some I, don't know content type thingy. This is like whatever is Jake's evidence, for example, but there has to have been some, especially for the I think our comp use case. There has been some very, very defined evidence for the passport scenario. I would disagree with that. I.

D

Would agree with it? We certainly want to pass passports effectively between routers, and that is definitely a use case. We're thinking of yeah.

E

The only part that I disagree with is that you had that the evidence has to be standardized in order to use the passport model. I have counter examples: I, don't.

A

Think that Hank said that did he I.

B

Didn't hear I the framing of the evidence that might end at the point of content types and to speak has to be standardized in order to be a passport yeah. Okay, and that's if that is solved with another wipe, should.

E

Have all that's required is that the verifier understand the evidence, format of the ax tester and that evidence, if that evidence format is vendor-specific, you can have a verifier that understands. You know three different evidence formats and work perfectly fine in the in the passport model. The passport model just requires that the attestation results are standardized in the sense of whatever you get back. You need to be able to pastor a relying party.

E

Now, maybe you can use a non-standard version there I don't know that's probably more interesting case, but I'm saying you can have verifiers that understand multiple evidence formats and that may support vendor specific ones. I.

D

Wouldn't say vendor specific there I'd say that there are youth cases where you don't need to format this, and there are use cases where you do so I'm, not saying that we should refuse to standardize any variant of that where it's required, but I can see where their use cases where you wouldn't want to do. That.

C

G

Say it has to be.

D

Vendor-Specific.

H

G

Multiple formats emitting from it of attestation results agree.

E

With whoever said that it that there are cases- and my point is that the the part that I disagreed with was that something required standardization, in my opinion, they're still, both cases are interesting, standard evidence and vendor specific evidence, and the passport model can be used in either case and I agree that there are cases for both okay.

D

B

Ultimately required it could be very useful if you want to converge. Yes, it.

G

Just means the verifier that relying party has to be more work.

E

The prevailing party doesn't see any evidence. The.

G

Yeah attestation result format, there could be multiple and if the verifier wants to be able to talk to universally multiple formats, that's the implication of the other diagram that we had.

G

B

Activity, if you want to select an arbitrary remote, a decision service by hints wherever they come from, that's a clue that also, if you don't have summarized education result, this will not work as plug-and-play. You will always have to take care to understand the specific proprietary attestation result, so there is use to do sanitization. Here is the next step at some point, but I think it is not necessarily required and the necessary g2 gave some framing and some some minimal standardization for evidence is very much more important at this point of time.

B

But that's all I'm saying.

A

So um we have about 10 or 12 minutes, left I, wonder yeah! Sorry.

B

Sorry, actually, actually we have one and a half hour and by scheduled tense. Mr. wemmick says 90 minutes. Maybe that's an error. I.

A

Don't know no it's because I set the WebEx for 90 minutes on the book so that we don't get kicked off by mistake. Okay I see so so that doesn't doesn't imply that everyone committed an hour I, don't mind continuing myself, but it was just a time check. So let me ask if you wanna, if everyone is interested or able to continue the first question and do we want to continue I wanted to and I just pasted in the hawk and II want to get to the definitions that were in this branch.

A

Sorry and I also wanted to know whether or not we had a requirement that we wanted to state about the background check. This is line 80 and 82 of the of the document, whether that was an important thing to say.

G

A

Is if you're looking in the HACC MD, if you have that on your screen, I could put on the screen. If you prefer.

A

Sorry, you have it or you want me to put it on the screen about.

G

Hacking D up I, don't know what you're referring to I, don't see anything that I mean I, see a bunt, a bulleted list underneath the heading background Jack. Oh sorry,.

A

That was supposed to be dot continue to typing. So so I wrote that the passport model requires that the passport is standardized, as the attestation result.

E

A

So we said something to that effect when we were, we were discussing that yet that we needed to have and that a standardized a tries attestation result that dot, because that's the passport well.

G

We said that we said that the architecture could support both standardized and non-standardized. You could still call it the passport model even for the attestation result.

A

E

That's what Laurence or Ned was saying about that and they were saying about the bowtie picture. That's said at IETF, and so I agree with that. Now, there's cases that I'm interested in standardizing and there's that other people are interested in standardizing and there's multiple possibilities. Part.

G

Of the architecture is that it supports compact word: compatibility with non-standard proprietary or alternative standard implementations of the model yeah.

A

Okay, so we will have passport models where the passport is a legacy object and we will have them where the passport is. Is a standardized object? Yes,.

G

The anticipation.

D

Result so it's not just standardizing just the attestation result.

A

A

That's what I'm trying to get at is that what did the passport model imply, that we have to standardize? Something and I'm hearing is that's not the case. I.

G

G

You all talked at once, I think that that we should standardize something in the hopes that eventually there'll be some convergence, because the maybe.

A

I could write this passport model standardizes. The attestation result in the hope that this will lead to convergence of systems in the future.

E

Some a wordsmith a bit, but that's pretty close. Okay.

A

E

Standardizes, the anti station result.

C

D

Into the convergence.

A

D

The attestation result, because I think we have to think about standardizing for, inter outer more elements than just the attestation result. That's.

G

The evidence and answer station so.

A

I I, don't think any sentence is exclusive. The point is to say why we're doing this, that that motivates this, so I mean I, don't mind the word at least, but I don't find it useful, because I think we always can say have other requirements that this will lead to convergence of passport check like systems or passport check model systems in the future. Yes,.

E

I agree with that phrase and I would also agree with if you inserted at least in front of passport check, but I do not ask for that, because I didn't ask for it in front of attestation or so cuz I think it's applied, I think the same statement is true: perfect.

B

E

Well, but I don't disagree with the way that you phrased it. If.

B

There's no heard sorry for deleting this. If there's no hurt and having- and at least that would be my feeling- it's a gut feeling, Hanks feeling is that at least as useful yeah, but.

E

Md not at the actual document right.

A

I'm in the Rock MD, so so the the question proposing.

E

A

In the document are you I I am proposing a statement that we might want to use in the document, but I don't know where it would go or how would you stay say it is point okay, the the I want to ask. The question is: does the background check model create a similar or equivalent set of requirements, different Senate requirements standard? We.

D

Jump off that, can we undelete at least I- think that there's a lot of value in in this, because passports do not just not just a paper to sign. Whoever has this is good. You have to often have some matching to other sources of evidence, so I think that a lot of people will get something from at least here I.

D

E

Know whether we agree, but so.

G

But background check also uses the same roles and ended in information flows. So.

E

The reason Michael I said I would be okay, sticking at least in front of the word passport check above was because I believe that exact same statement is also true for background check, which is the question you were asking.

A

The background check, you think, requires standardization of attestation results because.

E

You use the word required that you rephrase that, above to not use the word required, which I like.

B

E

Background check I could standardize that test Asia result in the hope that this will lead to convergence of background check model systems in the future. I believe that that statement would be true.

G

Kind of cut and paste and replace passport I, don't.

E

Know others agree but I'm just saying that's why I said that at least would because I think that same statement to be true, if your place passport check was with background check, it shouldn't say background check. Is that passport check? As you say, past yeah.

A

You're right: okay: yeah! Do you mind if I 8 this, because I think we've created a noun there.

A

May not be right, but it's.

E

My assertion, whether others agree with that I, don't know, but that is my so.

A

Does is, is it all we need I thought I was under the impression that we need we needed to be able to standardize evidence to standardize the background check. I.

E

Strongly disagree with that and would give you counter examples. I would.

B

Also say the background check does not really rely on it again. Convergence is nice, but in the background check model it is very much less required than anapest poor check. Well, it's not a passport model. I know, I, wasn't saying that's what sorry so.

A

I also thought that was true, that that the attestation results did not need to be standardized as as clearly in the background check model, but that the evidence needed to be standardized. That's why I was my understanding. One of the clear distinctions between the two processes is that we can quite easily live with a proprietary attestation result because the verifier is well-known to the relying party, whereas the tester is not in the background check model. So.

G

None of these models changes the bowtie diagram, I.

E

Don't disagree with the way that you phrased it Michael and certainly in the case where it's, the verifier and relying party or collapsing of the same entity. The net gestation result ins kind of know out, because it's not a message per se, but the way that you phrased it is you know, the well-known worse is not well known. I agree that in a stronger I still think that there's cases but I don't disagree or the way that you phrased it so.

A

So what I'm trying to get at it by by stating this is that if the utility of these two model, the utility of these two models, was I, thought that it it it. It Shawn light on the different parts of the and it took me a while to realize what the bowtie diagram is now I. Remember what it is that it's Shawn light on different parts of that diagram is saying. This is the part that's transmitting over the network and therefore we have to standardize among different vendors different verticals to get some.

A

You traction now network.

E

In the case where all three entities are not, in the same, where you have three separate physical devices that have the three roles on them as opposed to either collapsed, then you always have one the message both evidence in what works. Well,.

A

It's about standardized thing, that's not a thing! It's about it's about different entities. If, if they're all SGS enclaves, then we agreed there was no standardization necessary Intel can do it all right. It's when one of those entities now is no longer within that space that we need to have a standardized statement. Okay, and so, while I understand that we have solutions that work in all things that are our verticals that work in a particular space.

A

You know, that's I, think not the point. The point is that we have the use cases where we need to cross those boundaries and the two models describe the two places where we cross them by.

G

Calling it out as a role we're saying that one one role could be implemented by one one vendor and another room by a different vendor. Yes,.

D

Well, we'll head well said: Michael.

A

All right so, but I'm still not getting any any any.

A

Mileage here, out of knowing what the background check model needs to have standardized, where the the the the evidence has to flow between I, don't know what to call it anymore.

D

Unless you know it's coming in to be checked.

B

Yeah and also you can use the same standard. You use sorry the standardization output from the ITF. Sorry that your passport in background.

E

I think that this whole discussion here is way far away from the PR that we were looking at.

A

E

A

Requests III do drink, I do agree with you. The point I wanted to get on to and I'm. Sorry, maybe I'll just delete this. This I don't know what I'll do with this, but keep.

B

A

I'm just gonna, so what I wanted to get on to was the terminology itself? Okay, so we've, given that we, we have created a bunch of boxes and the document has there. This poll request: has this terminology and I just want to know? If, if we, if this is okay, do we even get them all doors and we.

E

Do not have them all on here, I think.

C

E

I personally, like all the ones that are in here, I, don't know if other people pick on them, but the ones that are not on here, because I saw that you removed attestation and we do not have the owner on the list. And so if people wanted to merge the ones that we have consensus on and keep working on any additional ones and a separate per request. That's okay with me, but I'd like to start merging the things that we do is even if we separate them out of this BR. Okay,.

G

Given that we in the previous diagram have two types of appraisal policy, does that warrant two entries in the terminology, possibly.

E

That would be fine.

B

It does not hurt I, think, and one of the things I am always a big advocate of is that we should avoid using the term attestation as a standalone term, with the only exception, maybe being the terminology where we infer the extra term remote attestation, which we are focusing on the other moment so say.

D

B

They stating in a draft whatever draft ever that we are creating an attestation for something I, don't think that should happen anymore. That is, that is my conviction, actually, because it's very confusing, so we will also always prefix or postfix that, with some context to better convey the the intent of what we're doing here. That is that it was my main. The last discuss my main comment on the standard law and definition of attestation and I think there was some content for the definition itself comments also, but I actually don't remember them from superfluous Hank.

E

Would you be okay if we just always use the term remote attestation.

B

Hank talking to Ramona, that's a moot mirrors, yeah I think it's very fine to you. Call it remote dissertation. Yes, and still we have to revisit the texts. I, don't think that we will be able to do this today, but then, let's, let's look how the result will be when all this is now like in this structure yeah with remote at the station and then look at the definitions if they all suit us in the next.

B

E

You have any problem with the term attestation and result, or do you think that has to be remote attestation result before you'd accept it? No.

B

I think that's at the station resort actually is fine. There's something that locally at the station later on it's otoscope, but then that can be reused. Yeah all.

E

Right, I am fine with you, so.

G

I think I don't know it seems like it would be useful to have a definition of the words that we're using and so I'm uncomfortable with the idea that we just assume that everybody understands what the word attestation means. We just define it or reference somebody else that defines it and some some acceptable way, but also saying that it also opens the door for a whole conversation around the different flavors of attestation, whether it's remote or local or implicit or explicit, or you know, there's lots of you could like spend a lot of time.

G

You know argue about those fees, so I'm not really sure what to do at this point. Really we want try and define it or not, but it just doesn't seem right that we would assume that everyone just understands what the combination of the words a of the letters, a TT es, ta, TI home and mean yes,.

A

My proposal is that my proposal is that we don't, as Hank, suggested we don't ever use the term ourselves that we need to. We need to have the term defined, but that we shouldn't bother defining it. We should instead say there are these nine definitions and we avoid the term because we don't wish to pick between them.

A

But of course you need to know what it, what other people think it means.

E

Proposal, okay, I think we should define the term were about attestation and I think we should have a definition that we agree on and I would start from the definition that I had the original per request. Unless people have issues with that, I also paste it into the our comments. This morning. The Wikipedia definition which I'm also okay with well I, think it should be to take Hanks point that we don't define the word attestation. We only define the term cata station and that's the term that we use I'm.

A

Completely consistent with what you just said: okay, okay III, because you turn you you wanted to find the word remote attestation and I'm and that's consistent with. We should use a term which has a qualification of the word: that's not station always, but that somewhere is. We need to say, there's all these other definitions and we didn't. We didn't. You can go, read them, but but we're not we're not gonna we're, not gonna touch them, we'll define our own term thanks. I do.

E

Not think that we need a station, but in the terminology section to do that, I'm sure whether we should do that, but I don't think we should have an attestation part of Hanks point that I agree with. It led me to believe that we should not define attestation the terminology. We should only define remote attestation if we want to have a sentence simply saying there are other definitions of attestation and we're just going to use remote a test station I would not object to that. I. Just don't think it's necessary.

E

I'm hoping that we can come up with a definition of remote attestation that we could agree on for purpose of using it in the architecture doctor. So.

A

I just wanted to pull my in just I'm just trying to grab your text here right now,.

E

Definitions, one was the definition that I had in the original per request it was removed and the other one is the one that wikipedia has right now: I'm, okay, with either of those or some combination or variation.

B

Multi-Vitamin has some some really deep insight also into this, but he's not here and I. Think the motivation topic might not be myself this year. I don't know because next week's is extra, speak and so and so.

A

Sorry so I'm I'm, just I, thought you said it wasn't in the document anymore and it was now in a comment so I'm looking at the.

E

Wasn't a comment at the bottom of the comment stuff and the other one was the one that you guys removed last week: okay,.

C

B

If I remember what was but what was a real issue with the terming as a dimension of the words that would help but I I think.

E

A

Didn't open it, we didn't open a ticket which was nine about the word about this about exactly this point and that's why we opened the ticket and I'm sorry I'm, trying to find your text in the comment. I'm not really happy with github conversations and comments you just have to be so on top of it or you just lose everything.

E

A

E

First, I'll try to type in the one that used to be in the documents. This is I.

E

A

Paste special yeah.

E

Apparently, oh.

A

E

So won't have the URL associated.

A

Okay, so that was your right you're, pointing at the place where we removed it so.

E

That was definition number one.

E

The one from github.

A

E

A

Knew what you meant.

A

When will Wikipedia, let us edit entries with git.

B

As soon as a semantic web interface exists with github they're, mostly kind of very bad joke when.

A

The irony is that it does exist for SVN.

A

That's vienna's all WebDAV paste right or what, if it is.

E

A

You would like to have these as our definitions for remote attestation. I'm.

E

Saying this is what we should use as a starting point: either number one or number two and wordsmith appropriately like if we need to add to where we wrote in there or something like that. That would be fine. Those are the two that were definitions of the term attestation and the either of which I think are fine, and if we want to now define a term promote, attend station I think we should start from walk or the other or combine them or whatever. And then the word remote in there somewhere and reading.

B

This I remember one thing that actually hangs says.

B

The Charter is like obsessing on in the video ball of it's not of a trust trustworthiness, so evidence somehow is about trustworthiness and so remote at the station about establishing a and have nobody liked that sentence ever so I'm fine with removing it, but from a semantically, remote Association about establish trust in the trustworthiness of a remote peer you're. Talking to.

E

Right, so that's why, in definition of a war- and it talks about assesses its trustworthiness, so you can see it just a finite word yeah. The word remote in here as a wing ample to say how we might define. So if we had the word remote right in here then- and we uncapitalized it right, then definition number one would be the remote station.

G

Using the word remote invites the conversation of what is the endpoint is sort of implied, and so we have to talk about some use cases where something isn't remote and so I'll throw out there. The use case of a a peripheral device.

B

Non-Variable and we were creating the time based unidirectional stuff. We realized this wound up always did standardization with IP based protocols for TF, so we introduced the meta to interconnect which could be IP and ever protocols or a GL pin or a socket or whatever it just conveyed. Somehow via the interconnect. Interconnect was a as a term, that's used by bluetooth and USB a lot, and that was our best effort attempted to say there is some secure channel, but I don't know if we I did the ITF here.

B

Maybe we are focusing on IP based stuff. Only I am not 100, but the focus, of course is there.

A

So I'm I'm happy I'm, happy Dave, actually with the text that you just created, I'm, actually quite happy to put the Wikipedia's definition in there as well and I would be quite happy with that. I. Don't know why I leave the Wikipedia's definition I think just for a variety. Maybe.

F

So I'd like to talk about the the trustworthiness thing a bit. um The problem with this sentence is the trustworthiness is kind of set in an absolute sense and I that swear. It always goes wrong for me is when you try to make trust absolute or you know the same for two different, relying parties. So it's fine for a relying party to decide whether it trusts something or not, but another relying party may come to a different conclusion.

F

So as long as the wording is relativistic to the relying party, you can use the word, trust and trustworthiness if you try to say in an absolute sense, this is trustworthy by all known relying parties in the known universe. Then that's where this this all goes wrong. I think you're, right, they're, saying that I don't.

E

Think I think that the text here is keeping what you said in mind: I think the text is fine, I, don't think it applies anything other than what that you worry about.

F

On the edge to me, because it doesn't qualify, trustworthiness, it's using the other.

E

Remote entity, so it's up to that particular road entity. It has doesn't say anything about more remote entities as a single one, says trustworthiness and it can come to whatever conclusion it wants. It's silent on any of the things that you're worried about yeah, there's two integers that you could read it.

G

G

It's provides that the first entity and the second remote entity, and that's that is context that qualifies it away from something that's sort of universally accepted by all entities.

G

Relative to the Wikipedia definition, I think using the word. Integrity is more constraining than what we really meant, because trustworthiness attributes can be more than just integrity unless we have I, don't want to go to integrity. So if you change that.

F

Sentence to which then assessed s-- assesses, whether it trusts it I would be okay, but in this case the rule identity. You can read that read it as the remote entity, value weighting, trustworthiness for all of time and space.

B

hmm That's a far stretch I see my I see you worried I'm, not as worried as you about this, but I can see a point or what you mean and and Trust is something and proving that as trustworthy are different things. That is something I would be worried about. So I would really keep trustworthiness and set of trust.

B

G

You have to state, you can make the same assertion about use of the term integrity in the other definition and say well, it's not called integrity is not qualified across space, and time is only a subset of trustworthiness.

F

That's not that's. The trustworthiness is about a whole bunch of things that are whether you trust an attestation is about a whole bunch of things beyond integrate.

G

That's I get that the point is someone reading. The other definition could read into it the same way that someone reads into the definition of the word trustworthiness, but because it's the word integrity, people have are less likely to read into it, because it's used in different context and in spoken language, so I, don't I, don't see that I. Don't see that there's the concern you have is really one that is going to be universally felt.

G

F

You I'd like to change this text, to which then decides whether it trusts it or some some version of that.

B

Again I would stand would like to recommend strongly not to use of a trust in this context. Here then, I'm.

E

Gonna look at line 95, which has our charter text, which has very similar wording, a level of confidence in the trustworthiness ever wrote, system, components, I. Think right now. Line 90 is at least consistent with line 95 in the Charter. With respect to the use of the word trustworthiness, I would.

F

Have been more clear when, when we were doing the Charter on my thinking, I would have objected. Then.

F

That doesn't fair.

E

Enough, there's probably things in the Charter text that disagree with you, but yeah: okay, fair enough part.

G

Of the goal was to get enough census to be able to start the working group so that we could have this conversation yeah. That's fine, yeah, I,.

F

Just really like to see every time we use the word, trust or trustworthiness, it's always as decided by the relying party, and it's never concerned that you can't ever construe it as absolute.

G

In this case, its theory, one entity, is the one that's assessing trustworthiness, yeah.

F

But but this this you can read the sentence either way you can read it as whether the remote entity is trusting it or not, or whether the remote entity is evaluating it. So everybody can trust.

G

Would it help to use the word of praise instead of assess no.

F

You have to make it relevant. You have to make it relative to the remote entry entity. You have to be very clear that it's relevant to the remote.

G

Entity isn't that what the sentence is saying you can read it either way. Well, there's this: it's the remote entity comma, which then assesses its trustworthiness, the references there I could I I can I can.

F

So I could I. Could you could say which then assesses its remote? You know which then assesses its trustworthiness before we're all of time and space or I could add for its own use in either way the either verification or you know, adding each else to it makes sense. So you can read it either way.

B

I'm fine for its own use, because we are talking about a singer. Relying party I think it's it's relatively clear that we mean that. But if it's sapping I'm not strongly objecting I mean one of the reasons I'm going down. This path is.

F

Because, just so much of the language and so much of the discussion around this has been, it feels like it's an absolute sense to me: I, just the the TCG work and that really around an.

G

Absolute sense, mm-hmm, well, I, think you're reading into it you're trying if you're projecting terminology, that's in the TCG I.

G

A

The TCG people know what they're saying but I, don't think the people that are outside the TCG looking into this ECG understand. That is the subtlety, so I understand Lawrence's view that of relativism. I would also ask whether the word the its trustworthiness, the its is perhaps somewhat ambiguous to some people. I, would rather say the testers trustworthiness, but that's an ear. That's you.

B

Know, that's that's good, stunned, our textile. Actually so yeah never say it's repeater turns that's always better.

E

The same problem right yeah.

B

A

A

First of for the one entity which provides evidence but its identity to another remote entity, which then assesses the testers threat for I, don't know how the name for the other entity.

E

Well, either like you can see which one entertain you have, in parentheses, the ax tester after.

G

E

Identity, we could have parentheses the relying party.

E

And you can say for the relying parties own use in the.

E

Now question: if we keep this text, do you guys prefer use or you would you prefer purposes.

B

This is bigger, I think because the implies those processes and ecosystems.

E

Use it or do something else with it like log, eight or whatever so yeah.

B

E

Says I think is a little bit more. Generic are.

A

You having it Florence yeah.

A

There are objections to this. Anyone can't live with this text.

E

Capitalized, relying party just for consistency with the rest of the document, otherwise I like you're right yeah,.

A

I get that really type so fast man.

E

A

Definition, that's okay, because the verifier is a is a is a way as a means to an end.

B

E

We hear clear success in the sentence and move on. Let's.

A

Let's, let's move on and if that's all we did today, that's a pretty it's a good result, all right, so I, I copy and paste an appraisal policy and I added for evidence and for attestation result did I get it right.

E

G

Why would we say another entity versus bear fire.

A

I, don't know, that's the question. Mr. ruhle isn't a verifier evidence.

D

E

A

E

I first did the original definitions. It was trying to do so without using the term using the role term before it was actually defined in alphabetical order. Sure.

D

E

Into account, however, security policy was defined in 49 49, so it's trying to be similar, so I think it's either way and so I don't object either way, whether we want to define it in layman's terms or in terms the capital letter terms, I, don't care either way. Yeah.

B

Now that we're differentiating them, we can take into account where the arrow goes, and so entities are more clear now also I think we can talk about the tester and the audience if.

E

You want to use the capital letter terms. That's fine of me so.

A

In the second case, a set of rules to direct how a relying party and all of capital always thought evaluates the validity of information about an ax tester.

E

It's not information from the attest sure, but it's information about the attest. This is correct. Yeah.

B

And if you are very, it struck me and that's: okay with attestation results in verifier is, of course a verifier. Okay, I don't know: do we want to use the term appraisal and the definition of appraisal policy? Probably not? Oh, no.

A

E

Only question you could ask I'm, okay with it as phrased right now, Michael, because now that we've used in the capital letter terms, when you talk about the validity of information about an ax tester, it would be equivalent to saying the validity of attestation results. I like it the way that's phrased. But if somebody else cared, then you could say it's equivalent to saying the validity of attestation results again.

A

Yeah I prefer to say a tester, because I think the rest of it is a means to an end and- and we also have other models that that we have these different model- the information flows in slightly different ways. So, let's not blur that information.

A

Okay, okay, so.

F

When does the information that's not about the ax tester get evaluated.

A

The information- that's not about the ax tester example I.

F

Guess I'm thinking of the ax tester as a sort of abounded thing. Let's say the ax tester is running in a te e and the adjuster takes in information outside of the TE say about Android, and the relying party cares about that information.

F

So they wanted evaluated when so the attendant.

A

Makes a measurement of the Android system around it and and puts that down as evidence? Yes,.

E

Information about Ana tester, the.

A

Tester is something about its world.

E

Information about the attacker, it's the context in which it's running it's still in the context of injury.

B

E

B

E

B

Problem that it is both as a testing component and an attested component I know that's horrible terminology, I I capitalized, the suffixes yeah, okay,.

B

A

The last two terms that we added were verifying verifier owner and relying party owner I.

E

Should ask, do people really prefer the term owner over administrator.

B

Much for admin I prefer.

E

Admin but I'm okay, either way so I'm asking the question: did you guys said the owner is the only right term, but was that just a straw man that was thrown out last time.

B

Last time I think owner is fine. Administrator is arbitrarily restriction because it is a role of a person and owner can be the role of an entity. So I think owner is a little bit bigger. I.

E

F

Have been much more happy with admin, I would have been much more clear to me with admin same.

E

For me, but I can live with it either way. Maybe maybe.

A

In the definition we would introduce the word we would reference the administrator down here.

E

Is it an entity? Is it an administrator or what would we start running better that the words after Michaels cursor you.

G

Just at some point you get into a space where you have scenarios where someone has outsourced. There is minute there are their admin duties and they still retain ownership, but it's it's. You know, outsourced admin, and so now it's confusing whether.

F

I'm, just the fact that it's a separate box has already got me that confused so that doesn't matter. For me, the.

G

Most relevant thing is that it's another entity, that's money.

H

G

Other entities that are confusing to me that it's another entity yeah just have to wrap it. I would.

E

Rather put down something, that's wrong and get you guys to fix it so I typed in something now please fix it. Thank.

B

A

B

Your problem, MV I, don't.

A

Have a good solution, but as you type in probably you've seen this when I'm typing, but the letters actually appear out to the right of your cursor and then the cursor moves over on my screen. It's kind of ghostly yeah and then he authorised to configure appraisal policy for evidence in a verifier. It's very introspective but I'm I'm. Happy I can't disagree with the definition I'm trying to think how to put the word administrator in an entity such as an administrator. Maybe.

A

Yeah I'm good with that to me.

A

Now I the relying party owner I.

A

Feel that that they are in some ways a little more whips abstract but distant from the policy.

A

In the sense that if I can use the.

A

A

The media company is not going to let turnover the decryption key to the attest er unless they're sure of certain very high-level concepts and it's up to the verifier to provide attestation results that convince them and I.

A

Think of that as very high level kind of.

F

Let's say: I'm running some sort of media service as a relying party I'm distributing content, well, I'm, the parent company that owns a subsidiary that subsidiary sub contracts to these guys here that do the administration, those guys that run the web service and those guys over there that upload the content, yeah and and then there's another subcontract involved, and then the the actual software written by to do it is comes from party C and the web service is like I, don't know redundant, made redundant or replicated by Akamai I mean Oh crazy corporate structure, which could be arbitrarily complex, all is inside the relying party box, and we just need to treat it as one box.

F

That's the whole thing about administrator and owner seem.

A

To me, you know so so what what I'm trying to say is that that it seems a little more abstract that that the the appraisal policy is actually given to the administrator of the relying party box. What.

E

Do you mean an example of appraisal policy for attestation? Even if it's just boolean right, the appraisal policy is so which verifier or verifiers? Do you trust yep? It has to be signed with the following keys, who can configure those set of who consider those trends, bankers party order, yeah.

A

Sorry, it's who can configure you're saying who can configure where, as I, think of it as who puts writes them down on the list.

E

A

These are the ones that my lawyers have vetted relying party administrator make sure that's the only list- and you know maybe there's some other audit trail and another layer of attestation. That proves it really happened right, but that's a separate. It's a recursive application.

F

Figure those things so the the the parent company decides. It doesn't trust this other parent company and it tells its subsidiary to not trust those guys anymore and to trust these guys. They tell the subcontractor and they tell the other sub subcontractor so who actually tells the guy the poor guy in the basement that actually has to type in the you know and an x.509 certificate. I mean I, don't see how you just seems like he it's very confused and when you try and talk about all that, so it's why I'm I'm.

A

Not trying to talk about that I'm trying to say that that I feel that, unlike in the case of the appraisal policy for evidence, which I think is quite detailed, okay, I'm saying the appraisal policy for attestation results may be quite high level and I. Think I'm agreeing with you Lawrence I'm, just saying that I feel that there's a qualitative difference in the level of detail and if you were to tell me that these uh protocols have ever standardized looked entirely different I would be not surprised.

G

But I think that the relevant point in terms of why we have two different owners is because and different a different entity, and it you know we can. We can. We can talk about an entity, can delegate to another entity, can delegate to another entity and so forth, but it's still it's still within that that same delegation chain. But the point here is that that we're trying to draw out is there's two delegation chains in and we don't want them to get inflate it into one. Just because the name because we say oh, that.

F

It's sort of understood, but I would be you think, relying party and they're from there you to me you apply all of that. So I I'm, more in favor of just removing those two things and maybe having some notion some some notes about what a relying party in a verifier are. I can live with it. However, you want, but this year I just.

B

Yeah I think they have a too essential for the whole picture for the architecture, not for the solution in the end necessarily but I think there are my current today. Opinion is and I was at the keep it simple, never very, very early, but I think this is important.

G

We have to at some point you can't define everything, but we have to define enough. People have some context.

A

Let me ask a different question totally different question here: do we want to put the remote attestation, despite alphabetization at the top.

E

The entire terminology section should be in alphabetical order, or it should be in the order that it makes sense to the reader, but we shouldn't mix, there's.

B

One compromise is a gray zone in between that a single term is defined in a chapter very early on and the rest is defined in the terminology, because this is rats and it's the remote attestation yada yada. So having that term, somehow separate from all the other terms, I think is okay. It is a little bit inconsistent. Even from my point of view, it would not pass I Triple E, but in the IDF it might be. Okay, I, don't know.

E

Thanks proposal as well.

E

Which means if it was defined in a paragraph and production.

B

Because we want to invite the reader- and we want to make them identify with this document as early as possible and.

G

C

E

C

E

:, it would just be rotation, is process or something like that in a pro.

A

Just document defines the term remote attestation as follows: okay and I wrote that in my editor, which I'm about to push into the honey, because I copied the things into the updated terminology or what is today the night 17th.

C

A

And so I think we should finish here.

G

I'm gonna have to drop.

B

Thanks thanks everyone so.

A

I read that we're gonna hit the we're gonna commit we're gonna merge this yeah, okay where's. The button I would.

A

Wear the merge button is than it here there we go, merge, pull request.

A

All right, thank you, so our next meeting would be on January 7th.