Subject: [Teep] Transport Protocol

From: Dave Thaler <[email-masked]>
Date: Thu, 2 Nov 2017 00:52:27 +0000

As promised when I posted my review, I am starting several email threads for discussions on specific technical topics.
This is one of them.

Section 1:
> This specification defines message payloads exchanged between devices

> and a TSM but does not mandate a specific transport.

Section 5:
> The communication method of OTrP Messages between a TSM and TEE in a
> device is left to TSM providers for maximal interoperability.

I disagree, the lack of any spec for a transport results in lack of maximal interoperability.
The TSM and the TEE may be from different vendors as the draft nicely explains earlier.
So bindings to one or more transport protocol (the thing that carries the JSON messages inside it) must be standardized.
Otherwise, in my view there's little value in standardizing the payload formats.

Such a transport protocol binding might be in the same spec or in a different spec, but either way
I think specifying at least one is mandatory.

Dave

From: Dave Thaler
Sent: Saturday, September 23, 2017 12:24 PM
To: [email-masked]' <[email-masked]>
Subject: Review of draft-pei-opentrustprotocol-04

I've finally made it through a detailed review of draft-pei-opentrustprotocol-04 and my marked up copy is at
https://www.microsoft.com/en-us/research/wp-content/uploads/2017/05/draft-pei-opentrustprotocol-04.pdf

I have lots of editorial fixes throughout, and a number of technical comments/questions/issues.

I'll start separate email threads for some of them over the next several days.

Dave

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 6 Nov 2017 19:10:23 +0000

Hi Dave,

This is an interesting question. For the main use case where the a software update in a TEE on a mobile device is provided I believe it is fair to say that the protocol we are talking about here is HTTPS. As you know, there have been other use cases described by Dapeng in https://tools.ietf.org/html/draft-liu-opentrustprotocol-usecase-01, which may require other protocols. If I have standardize and mandate at least one protocol then I would pick HTTPS here.

Ciao
Hannes

From: TEEP [mailto:[email-masked]] On Behalf Of Dave Thaler
Sent: 02 November 2017 01:52
To: [email-masked]
Subject: [Teep] Transport Protocol

Dave

From: Dave Thaler
Sent: Saturday, September 23, 2017 12:24 PM
To: [email-masked]' <[email-masked]<mailto:[email-masked]>>
Subject: Review of draft-pei-opentrustprotocol-04

Dave
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 8 Nov 2017 09:15:37 -0600

I've got a clarifying question (at least, it would be clarifying for me)
for Dave.

On Mon, Nov 6, 2017 at 1:10 PM, Hannes Tschofenig <[email-masked]
> wrote:

> Hi Dave,
>
>
>
> This is an interesting question. For the main use case where the a
> software update in a TEE on a mobile device is provided I believe it is
> fair to say that the protocol we are talking about here is HTTPS. As you
> know, there have been other use cases described by Dapeng in
> https://tools.ietf.org/html/draft-liu-opentrustprotocol-usecase-01, which
> may require other protocols. If I have standardize and mandate at least one
> protocol then I would pick HTTPS here.
>
>
>
> Ciao
> Hannes
>
>
>
> *From:* TEEP [mailto:[email-masked]] *On Behalf Of *Dave Thaler
> *Sent:* 02 November 2017 01:52
> *To:* [email-masked]
> *Subject:* [Teep] Transport Protocol
>
>
>
> As promised when I posted my review, I am starting several email threads
> for discussions on specific technical topics.
>
> This is one of them.
>
>
>
> Section 1:
> I disagree, the lack of any spec for a transport results in *lack* of
> maximal interoperability.
>
> So bindings to one or more transport protocol (the thing that carries the
> JSON messages inside it) must be standardized.
>
> Otherwise, in my view there’s little value in standardizing the payload
> formats.
>
>
>

Dave, did you mean

   - mandatory for the working group to specify at least one, or
   - the working group should specify one that is mandatory to implement, or
   - the working group should specify one that is mandatory to use?

I think I know what you meant, but I should ask, rather than guess.

Thanks,

Spencer

> Dave
>
>
>
> *From:* Dave Thaler
> *Sent:* Saturday, September 23, 2017 12:24 PM
> *To:* [email-masked]' <[email-masked]>
> *Subject:* Review of draft-pei-opentrustprotocol-04
>
>
>
> I’ve finally made it through a detailed review of
> draft-pei-opentrustprotocol-04 and my marked up copy is at
>
> https://www.microsoft.com/en-us/research/wp-content/
> uploads/2017/05/draft-pei-opentrustprotocol-04.pdf
>
>
>
> I’ll start separate email threads for some of them over the next several
> days.
>
>
>
> Dave
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>
> _______________________________________________
> TEEP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/teep
>
>

---

From: Dave Thaler <[email-masked]>
Date: Wed, 8 Nov 2017 20:54:59 +0000

[...]
> Dave, did you mean 
> • mandatory for the working group to specify at least one, or 
> • the working group should specify one that is mandatory to implement, or
> • the working group should specify one that is mandatory to use?

The working group should specify at least one that is Mandatory To Implement.

And for what I mean by "at least one"... there's two roles: the TAM and the Agent.   
Interoperability can be ensured multiple ways, including (maybe other options too):
a) specify one that's MTI for both the TAM and the Agent.
b) specify multiple that are MTI for the TAM, and let the Agent implement any one of that set.

Dave

---

From: Henk Birkholz <[email-masked]>
Date: Fri, 10 Nov 2017 03:01:50 +0100

Hello,

if in doubt, I would recommend CoAP - as the transfer protocol. It 
provides one with the flexibility of using various transport protocols.

Viele Grüße,

Henk