Draft: draft-ietf-rats-architecture

Commentary: Ok but I 'd prefer one word changed
Paragraph (version A):
The Verifier appraises Evidence via appraisal policies and creates
the Attestation Results to support Relying Parties in their decision
process.  This documents defines a flexible architecture consisting
of attestation roles and their interactions via conceptual messages.
Paragraph (version B):
The Verifier appraises Evidence via appraisal policies and creates
the Attestation Results to support Relying Parties in their decision
process.  This document defines a flexible architecture consisting of
attestation roles and their interactions via conceptual messages.
Paragraph (version A):
Amongst other things, this document is about trust and
trustworthiness.  Trust is a choice one makes about another system.
Trustworthiness is a quality about the other system that can be used
in making one's decision to trust it or not.  This is subtle
difference and being familiar with the difference is crucial for
using this document.  Additionally, the concepts of freshness and
trust relationships with respect to RATS are elaborated on to enable
implementers in order to choose appropriate solutions to compose
their Remote Attestation Procedures.
Paragraph (version B):
Amongst other things, this document is about trust and
trustworthiness.  Trust is a choice one makes about another system.
Trustworthiness is a quality about the other system that can be used
in making one's decision to trust it or not.  This is subtle
difference and being familiar with the difference is crucial for
using this document.  Additionally, the concepts of freshness and
trust relationships with respect to RATS are elaborated on to enable
implementers to choose appropriate solutions to compose their Remote
Attestation Procedures.
Paragraph (version A):
Each use case includes a description followed by a summary of the
Attester and a Relying Party roles.
Paragraph (version B):
Each use case includes a description followed by a summary of the
Attester and Relying Party roles.
Paragraph (version A):
Network operators want a trustworthy report that includes identity
and version of information of the hardware and software on the
machines attached to their network, for purposes such as inventory,
audit, anomaly detection, record maintenance and/or trending reports
(logging).  The network operator may also want a policy by which full
access is only granted to devices that meet some definition of
hygiene, and so wants to get claims about such information and verify
their validity.  Remote attestation is desired to prevent vulnerable
or compromised devices from getting access to the network and
potentially harming others.
Paragraph (version B):
Network operators want a trustworthy report that includes identity
and version of information of the hardware and software on the
machines attached to their network, for purposes such as inventory,
audit, anomaly detection, record maintenance and/or trending reports
(logging).  The network operator may also want a policy by which full
access is only granted to devices that meet some definition of
hygiene, and so wants to get claims about such information and verify
its validity.  Remote attestation is desired to prevent vulnerable or
compromised devices from getting access to the network and
potentially harming others.
Paragraph (version A):
In this use case, potentially dangerous physical equipment (e.g.,
power grid, traffic control, hazardous chemical processing, etc.) is
connected to a network.  The organization managing such
infrastructure needs to ensure that only authorized code and users
can control such processes, and they are protected from malware or
other adversaries.  When a protocol operation can affect some
critical system, the device attached to the critical equipment thus
wants some assurance that the requester has not been compromised.  As
such, remote attestation can be used to only accept commands from
requesters that are within policy.
Paragraph (version B):
In this use case, potentially dangerous physical equipment (e.g.,
power grid, traffic control, hazardous chemical processing, etc.) is
connected to a network.  The organization managing such
infrastructure needs to ensure that only authorized code and users
can control such processes, and they are protected from malware or
other threats.  When a protocol operation can affect some critical
system, the device attached to the critical equipment thus wants some
assurance that the requester has not been compromised.  As such,
remote attestation can be used to only accept commands from
requesters that are within policy.
Paragraph (version A):
The Relying Party uses Attestation Results by applying its own
pppraisal policy to make application-specific decisions such as
authorization decisions.  The Appraisal Policy for Attestation
Results is configured in the Relying Party by the Relying Party
Owner, and/or is programmed into the Relying Party.
Paragraph (version B):
The Relying Party uses Attestation Results by applying its own
appraisal policy to make application-specific decisions such as
authorization decisions.  The Appraisal Policy for Attestation
Results is configured in the Relying Party by the Relying Party
Owner, and/or is programmed into the Relying Party.
Paragraph (version A):
The background-check model is so named because of the resemblance of
how employers and volunteer organizations perform background checks.
When a prospective employee provides claims about education or
previous experience, the employer will contact the respective
institutions or former employers to validate the claim.  Volunteer
organizations often perform police background checks on volunteers in
order to determine the volunteer's trustworthiness.  Thus, in this
analogy, a prospective volunteer is an Attester, the organization is
the Relying Party, and a former employer or government agency that
issues a report is a Verifier.
Paragraph (version B):
The background-check model is so named because of the resemblance of
how employers and volunteer organizations perform background checks.
When a prospective employee provides claims about education or
previous experience, the employer will contact the respective
institutions or former employers to validate the claim.  Volunteer
organizations often perform police background checks on volunteers in
order to determine the volunteer's trustworthiness.  Thus, in this
analogy, a prospective volunteer is an Attester, the organization is
the Relying Party, and the organization that issues a report is a
Verifier.