Draft: draft-ietf-rats-architecture

Commentary: The remaining nit is one I disagree with . Signed - off - by :   
 From Five separate trivial updates requested Section 2 : Reference Value Provider Currently : ... Reference Values help Verifiers appraise the authenticity of Evidence Proposed : ... Reference Values help Verifiers appraise Evidence to determine if only known and acceptable claims have been recorded by the Attester Section 3.6 : Currently : One significant problem is malware that holds a device hostage and does not allow it to reboot to prevent updates from being applied . This is a significant problem , Proposed : There is a class of malware that holds a device hostage and does not allow it to reboot to prevent updates from being applied . This can be a significant problem , Section 4 : Currently : pppraisal policy Proposed : appraisal policy Section 11 : Currently : as well as any users the device is associated with . Proposed : as well as potentially any users of the device . Section 12.1 Currently : Key Material Proposed : key material 
 I disagree with the first nit : if only known and acceptable claims have been recorded by    I disagree : 1 ) Evidence might be considered trustworthy even if additional ( not " known " to the Verifier ) claims are inserted . E.g. there may be vendor - specific claims whereas the Verifier might only care about standard claims . 2 ) The appraisal process is not just about claims and the proposed text narrows it to only be about claims . The rest of the process includes checks like whether the signature is valid , whether the signer chains to something in the Verifier 's trust anchor store , etc . These are not claims . As such , the current text is more correct . 
 The issue I have with the current text is that it intertwines authenticity and   . Evidence can still be authentic even if   are not what is passed .
Mailing list commentary: As part of WGLC , I have reviewed draft - ietf - rats - architecture-07 , and believe it an excellent document . Below are three minor comments and five nits which I believe are worth addressing . Major Comments
Paragraph (version A):
One significant problem is malware that holds a device hostage and
does not allow it to reboot to prevent updates from being applied.
This is a significant problem, because it allows a fleet of devices
to be held hostage for ransom.
Paragraph (version B):
There is a class of malware that holds a device hostage and does not
allow it to reboot to prevent updates from being applied.  This can
be a significant problem, because it allows a fleet of devices to be
held hostage for ransom.
Paragraph (version A):
The conveyance of Evidence and the resulting Attestation Results
reveal a great deal of information about the internal state of a
device as well as any users the device is associated with.  In many
cases, the whole point of the Attestation process is to provide
reliable information about the type of the device and the firmware/
software that the device is running.  This information might be
particularly interesting to many attackers.  For example, knowing
that a device is running a weak version of firmware provides a way to
aim attacks better.
Paragraph (version B):
The conveyance of Evidence and the resulting Attestation Results
reveal a great deal of information about the internal state of a
device as well as potentially any users of the device.  In many
cases, the whole point of the Attestation process is to provide
reliable information about the type of the device and the firmware/
software that the device is running.  This information might be
particularly interesting to many attackers.  For example, knowing
that a device is running a weak version of firmware provides a way to
aim attacks better.