search

ietf-rats-wg / architecture

RATS Architecture
Other
16 stars 10 forks source link

please clarify "security" around handles^Wepoch identifiers #295

Closed mcr closed 3 years ago

mcr commented 3 years ago
  1. I don't think that they need to be confidential, and I'm pretty sure we can't do the group key management to make this work.
  2. I can see how it would be nice if they came with origin authentication, which might imply integrity as well. (Usually hard to split this up). I think that without a better handle (pun intended) on the target use case audience, it's hard to know if one can really make this work. Clearly an epoch identity distributor (which would be... a historian?) could sign with an asymmetric key, and for some use cases the authenticator (public key) could be widely distributed, or baked into firmware.

To me, the primary security for the identifiers is availability. I think that the epoch identifier is key to doing the TUDA: if one wants one way attestations coming out only of a nuclear power plant, then the freshness has to get in via some broadcast system, I think.

dthaler commented 3 years ago

I'm not sure what the gap is here. https://ietf-rats-wg.github.io/architecture/draft-ietf-rats-architecture.html#epochids-sec contains security considerations, is this already addressed?

henkbirkholz commented 3 years ago

Commenting on 2.) while authenticity proofs of course improve origin authentication and integrity requirements, I am not entirely sure, if we have to spell that out everywhere.