07-06-2023 Meeting

[yogeshbdeshpande]

• Discuss allowing domains to be domain members #95 and composition musing
• Iterate over remainder of the issues

[nedmsmith]

Minutes:

• Ned summarized the previous week's discussion points. There was consensus that the schema needs to express grouping semantics that parallels the grouping implied by attestation evidence (e.g., DICE certs that have DiceTcbInfo ext'n or EAT tokens containing signed evidence).
• There was consensus that it is a reasonable assumption that the attester device can be fully attested (that is to say, the algorithm that produces the spanning tree for the device is tractable). That implies, there will be AEs / Attesters / lead Attesters / sub Attesters that jointly know the spanning tree algorithm. The Verifier expects the RIM to be expressive enough to model whatever spanning algorithm is chosen by the developer(s).
• There was discussion regarding grouping nomenclature and mechanism. The RATS Architecture uses terms such as "lead Attester" and "sub Attester" where the entity being attested may apply the Attester role multiple times as a way of grouping evidence claims. The current mechanisms for grouping are domain-dependency and domain-membership triples.
• A deficiency with domain triples is the lack of recursion that would allow a spanning tree to be described. It was suggested that by defining domain-id as an environment-map, the membership triple could be used to assign a domain to another domain.
• Another deficiency is that a target environment could consist of multiple environment-maps. The RATS Arch seems to side step the question of TE composition. However, practical implementations use multiple environment-maps to describe a TE. For example, the DiceTcbInfoSeq associates multiple environment-map (name fields) with the same Evidence block. Domain membership triple appears to address this, but there was some dissonance with the 'domain' terminology as it isn't used in the RATS Arch. An alternative name to "domain" was not suggested.
• There was some concern that changing names for the sake of having a different name may have broader impact as the TCG and IETF are trying to align on schemas.
• Target Environments can be defined in terms of a set of matched evidence values, such as when stateful-environment-record is used. This suggests that domains should be able to include stateful-environment-record as well. It was observed that verifiers need to keep track of intermediate accepted claims in similar fashion to the domain grouping concept, but with stateful outcomes. Hence, the accepted-claims structure may be influenced by this conversation also.
• There was consensus that naming was a discussion that was lower priority to identifying the correct grouping mechanism and semantics.
• The idea that the CoMID tag could be used as the grouping mechanism was discussed. It seems to have beneficial properties that any triple in the tag by default are related. For example, if an identity-triple uses environment-map A, and a reference-triple uses environment-map B, the Verifier should concluded that environment-maps A and B describe the same TE. Hence, a signed Evidence block that contains attributes from A and B would be treated as an 'intended' grouping. However, such semantics are a departure from historical assumptions and implementation. There was disagreement that these differences were significant.
• Next steps:

1. Do a paper exercise that entails extending domain-id to include environment-map and stateful-environment-record. Is it possible to model DICE, EAT, SPDM evidence groupings of claims / measurements effectively?
2. Are there efficiency gains possible if CoMID tags default to be a domain (or is the overhead of explicitly declaring the membership justified)?
3. Does the spanning tree model work, or is a generalized graph required? What are the ways we can test the assumption that AE coverage of the device via spanning tree is justified?