Re: [Nea] IETF67 NEA WG Meeting summary

[Keith Moore <moore at cs.utk.edu>]

-------- Original Message --------

> > regarding NEA: what I might be okay with is giving authorized
> > third-parties yes or no assurance that the host meets or does not meet
> > their policies, without giving them fine-grained detail about what is
> > installed on the host.  so the owner of a host could get details about
> > why a host did or did not fit within a particular network's policy, but
> > the network (if owned by another party than the owner of the host) could
> > only get yes or no information.   I would like to see this option
> > examined further.
>
> Nothing is gained here regarding privacy. A validation server could
> glean what is installed by asking a series of questions and inferring
> the response.

I already pointed out that the protocol would have to prevent this somehow.

> I think a reasonable solution is one that Steve offered in the other
> thread where (to summarize), the endpoint, including the user, and the
> network agree on what will be shared during an assessment and then the
> network bases an access control decision on that assessment.
> Therefore, people with privacy concerns don't expose information and
> the network operator enforces local policy.

unacceptable, for reasons already given.

Keith



_______________________________________________
Nea mailing list
Nea at ietf.org
https://www1.ietf.org/mailman/listinfo/nea