Draft: draft-ietf-rats-architecture

Commentary: This attempts to address the remaining feedback on PR on issues that were not fixed before it was merged . Signed - off - by :   
 The simple word choice / grammar changes seem OK . I still do n't understand the difference between a " claims collector " and a " verifier " ( in the case where   , C , ... are signing evidence ) and a " target environment " ( in the case where   , C , ... are not signing evidence ) . It seems this term is n't actually necessary . The case where   is relying Evidence from " sub " attesters , the composite attester ( aka claims collector ) is relying Evidence not " collecting claims " in the sense that an attester " collects claims about a target environment " . I think it is confusing to overload this terminology to also mean " rely Evidence " .
Paragraph (version A):
A Composite Attester is an entity composed of multiple sub-entities
such that its trustworthiness has to be determined by evaluating all
these sub-entities.  Each sub-entity has at least one Attesting
Environment collecting the claims from at least one Target
Environment, then this sub-entity generates Evidence about its
trustworthiness.  Therefore each sub-entity can be called an
Attester.  Among these Attesters, there may be only some, which can
be called Lead Attesters, that have the communication functionality
with the Verifier.  Other Attesters don't have this ability, but they
are connected to the Lead Attesters via internal links or network
connections, and they are evaluated via the Lead Attester's help.
Paragraph (version A):
For example, a carrier-grade router is a composite device consisting
of a chassis and multiple slots.  The trustworthiness of the router
depends on all its slots' trustworthiness.  Each slot has an
Attesting Environment such as a TPM or TEE collecting the claims of
its boot process, then it generates Evidence from the claims to prove
its trustworthiness.  Among these slots, only a main slot can
communicate with the Verifier while other slots cannot.  But other
slots can communicate with the main slot by the links between them
inside the router.  So the main slot collects the Evidence of other
slots, produces the final Evidence of the whole router and conveys
the final Evidence to the Verifier.  Therefore the router is a
Composite Attester, each slot is an Attester and the main slot is the
Lead Attester.
Paragraph (version A):
Another example is a multi-chassis router which is composed of
multiple single carrier-grade routers.  The multi-chassis router
provides higher throughput by interconnecting multiple routers and
simpler management by being logically treated as one router.  Among
these routers, there is only one main router that connects to the
Verifier.  Other routers are only connected to the main router by the
network cables, and therefore they are managed and verified via this
main router.  So, in this case, the multi-chassis router is the
Composite Attester, each router is an Attester and the main router is
the Lead Attester.
Paragraph (version A):
composite depicts the data that flows between the Composite Attester
and Verifier for the remote attestation.
Paragraph (version A):
In the Composite Attester, each Attester generates its own Evidence
by its Attesting Environments collecting the claims from its Target
Environments.  The Lead Attester collects the Evidence of all other
Attesters and then generates the Evidence of the whole Composite
Attester.
Paragraph (version A):
Inside the Lead Attester, there may be an optional Verifying
Environment.  The Verifying Environment can verify the collected
Evidence of other Attesters to evaluate their trustworthiness.
Therefore, there are two situations when the Lead Attester generates
the final Evidence.
Paragraph (version A):
One situation is that the Lead Attester has no Verifying Environment.
In this situation, the Lead Attester just collects the Evidence of
other Attesters but doesn't verify them.  It may just string all
these Evidence into a whole one, or it may reorganize these Evidence
with a new structure and sign this final Evidence.  Then it conveys
the final Evidence to the Verifier and the Verifier evaluates the
Composite Attester's, including the Lead Attester's and other
Attesters', trustworthiness.
Paragraph (version A):
The other situation is that the Lead Attester has a Verifying
Environment.  After collecting the Evidence of other Attesters, the
Lead Attester verifies these Evidence by using the Endorsements and
Appraisal Policies, which are got from the Verifier or some reliable
parties, for evaluating these Attesters' trustworthiness.  Then the
Lead Attester makes the verification results as claims which are the
input to the final Evidence of the whole Composite Attester.  Then
the Lead Attester conveys the final Attestation Evidence to the
Verifier on behalf of the Composite Attester.  Before receiving the
Endorsements and Appraisal Policies for other Attesters, to increase
the security, the Lead Attester may first generate Evidence about its
trustworthiness and convey this Evidence to the Verifier for
evaluating.
Paragraph (version B):
A Composite Attester is an entity composed of multiple sub-entities
such that its trustworthiness has to be determined by evaluating all
these sub-entities.  Each sub-entity has at least one Attesting
Environment collecting the claims from at least one Target
Environment, then this sub-entity generates Evidence about its
trustworthiness.  Therefore each sub-entity can be called an
Attester.  Among these Attesters, there may be only some, which can
be called Lead Attesters, that have the ability to communicate with
the Verifier.  Other Attesters don't have this ability, but they are
connected to the Lead Attesters via internal links or network
connections, and they are evaluated via the Lead Attester's help.
Paragraph (version B):
For example, a carrier-grade router is a composite device consisting
of a chassis and multiple slots.  The trustworthiness of the router
depends on all its slots' trustworthiness.  Each slot has an
Attesting Environment such as a TPM or TEE collecting the claims of
its boot process, after which it generates Evidence from the claims.
Among these slots, only a main slot can communicate with the Verifier
while other slots cannot.  But other slots can communicate with the
main slot by the links between them inside the router.  So the main
slot collects the Evidence of other slots, produces the final
Evidence of the whole router and conveys the final Evidence to the
Verifier.  Therefore the router is a Composite Attester, each slot is
an Attester, and the main slot is the Lead Attester.
Paragraph (version B):
Another example is a multi-chassis router composed of multiple single
carrier-grade routers.  The multi-chassis router provides higher
throughput by interconnecting multiple routers and simpler management
by being logically treated as one router.  Among these routers, there
is only one main router that connects to the Verifier.  Other routers
are only connected to the main router by the network cables, and
therefore they are managed and verified via this main router.  So, in
this case, the multi-chassis router is the Composite Attester, each
router is an Attester and the main router is the Lead Attester.
Paragraph (version B):
composite depicts the conceptual data flow for a Composite Attester.
Paragraph (version B):
In the Composite Attester, each Attester generates its own Evidence
by its Attesting Environment(s) collecting the claims from its Target
Environment(s).  The Lead Attester collects the Evidence of all other
Attesters and then generates the Evidence of the whole Composite
Attester.
Paragraph (version B):
The Lead Attester's Claims Collector may or may not include its own
Verifier.  One situation is that the Claims Collector has no internal
Verifier.  In this situation, the Claims Collecctor simply combines
the various Evidences into the final Evidence that is sent off to the
remote Verifier, which evaluates the Composite Attester's, including
the Lead Attester's and other Attesters', trustworthiness.
Paragraph (version B):
The other situation is that the Lead Attester's Claims Collector has
an internal Verifier.  After collecting the Evidence of other
Attesters, the Claims Collector verifies them using Endorsements and
Appraisal Policies (obtained the same way as any other Verifier), for
evaluating these Attesters' trustworthiness.  Then the Claims
Collector combines the Attestation Results into the final Evidence of
the whole Composite Attester which is sent off to the remote
Verifier, which might treat the claims obtained from the local
Attestation Results as if they were Evidence.