Add linear privilege level measurement value type #354

deeglaze · 2024-12-18T16:46:55Z

As a means of representing a CPL or VMPL, this provides some extra semantic understanding. Leaving condition-matching to a later PR.

yogeshbdeshpande · 2025-01-22T13:28:57Z

@deeglaze Instead of directly making a change request, can we please have an issue, which describes a requirement.

What is a Privilege level of an Environment ?

Why it is needed? What uses cases are relevant when this feature gains relevance ?

draft-ietf-rats-corim.md

yogeshbdeshpande · 2025-01-22T15:46:02Z

Add matching rules to the PR

Add examples to the PR, in CDDL

yogeshbdeshpande

Please continue good work on the PR

draft-ietf-rats-corim.md

yogeshbdeshpande · 2025-01-29T12:48:12Z

@deeglaze I assume, there is still work to be done on this PR, so we would not take this up during CoRIM Meeting on 29th Jan 2025 ?

As a means of representing a CPL or VMPL, this provides some extra semantic understanding. Leaving condition-matching to a later PR.

This adds taggs 564 and 565 (563 proposed by PR ietf-rats-wg#297). The -Infinity is valid diagnostic notation, but our tooling does not recognize it.

nedmsmith

See inline comments

draft-ietf-rats-corim.md

Co-authored-by: Ned Smith <ned.smith@intel.com>

nedmsmith

LGTM

nedmsmith

LGTM

yogeshbdeshpande · 2025-02-05T14:48:20Z

draft-ietf-rats-corim.md

@@ -1118,6 +1118,21 @@ are acceptable states.
 Integrity Registers can be used to model the PCRs in a TPM or vTPM, in which case the identifier is the register index, or other kinds of vendor-specific measured objects.


+##### Linear Privilege Level {#sec-comid-linear-privlevel}
+
+A Linear Privilege Level describes an operating privilege for the target environment.


I would swap the bottom sentence to state that:

Please clarify.

yogeshbdeshpande · 2025-02-05T14:49:34Z

draft-ietf-rats-corim.md

@@ -1118,6 +1118,21 @@ are acceptable states.
 Integrity Registers can be used to model the PCRs in a TPM or vTPM, in which case the identifier is the register index, or other kinds of vendor-specific measured objects.


+##### Linear Privilege Level {#sec-comid-linear-privlevel}
+
+A Linear Privilege Level describes an operating privilege for the target environment.


Suggested change

A Linear Privilege Level describes an operating privilege for the target environment.

A Linear Privilege Level describes an operating privilege for the target environment. The privilege can be expressed in either positive integer ranges or in negative integer ranges.

0 is also legal though.

I added to the example showing that a range can include both negative and positive integers. Maybe just document that the values are integers?

yogeshbdeshpande · 2025-02-05T14:50:29Z

draft-ietf-rats-corim.md

+##### Linear Privilege Level {#sec-comid-linear-privlevel}
+
+A Linear Privilege Level describes an operating privilege for the target environment.
+The convention is that 0 is the highest privilege, and higher numbers correspond to fewer privileges.


Suggested change

The convention is that 0 is the highest privilege, and higher numbers correspond to fewer privileges.

When expressed in positive integer ranges the convention is that 0 is the highest privilege, and higher numbers correspond to fewer privileges. No negative number representation is allowed, in this setting.

What setting? This is convention.

What setting? This is convention.

Yes, I mean that you can replace it with convention or something similar!

I don't understand this comment. Replace what with convention? I'm trying to encode a range comparison that requires an internalized notion of order.

The text related to positive range should follow the cddl section as the rest of the discussion on ranges is following the cddl section.

yogeshbdeshpande · 2025-02-05T14:51:34Z

draft-ietf-rats-corim.md

+
+The ACS entry value stored under `measurement-values-map` codepoint 15 is a linear privilege level, which must have type `linear-privlevel-type-choice`.
+
+If the entry `linear-privlevel-type-choice` is an `int` or an `int` tagged with #6.564, then comparison with the `int` named as PRIV is as follows.


I am not clear when was PRIV introduced and what its context is? Can you please clarify..

PRIV is referenced below when describing the comparison. PRIV here represents an exact privilege level in the ACS that will be compared against a CoRIM. I'm following the same wording form as for SVN.

yogeshbdeshpande · 2025-02-05T14:52:29Z

draft-ietf-rats-corim.md

+
+If the entry `linear-privlevel-type-choice` is an `int` or an `int` tagged with #6.564, then comparison with the `int` named as PRIV is as follows.
+
+*  If the condition ECT value for `measurement-values-map` codepoint 15 is an untagged `int` or an `int` tagged with #6.564 then an equality comparison is performed on the `int` components.


When would one use int and when would one use tagged-int. can you please explain as this is the base spec!

yogeshbdeshpande · 2025-02-05T14:54:28Z

cddl/linear-privilege-level.cddl

+linear-privlevel-type-choice /= signed-integer-range-type-choice
+signed-integer-range-type-choice = int-eq / int-range / tagged-int-eq / tagged-int-range
+int-eq = int
+int-range = [min: inf-int, max: inf-int]


This looks like a policy construct which i am little nervous in absorbing here..?

is there a way to express it more clearly using base types?

It's a weak form of comparison for use in conditional endorsements. We have SVN range comparisons. This is just slightly broader.

yogeshbdeshpande

Made some comments!

…ts-corim into pr/354

Added example to test negative and positive ranges.

Added cbor-tags.txt to git ignore list.

nedmsmith · 2025-02-12T18:54:56Z

draft-ietf-rats-corim.md

@@ -1118,6 +1118,21 @@ are acceptable states.
 Integrity Registers can be used to model the PCRs in a TPM or vTPM, in which case the identifier is the register index, or other kinds of vendor-specific measured objects.


+##### Linear Privilege Level {#sec-comid-linear-privlevel}
+
+A Linear Privilege Level describes an operating privilege for the target environment.


I added to the example showing that a range can include both negative and positive integers. Maybe just document that the values are integers?

nedmsmith · 2025-02-12T19:06:33Z

draft-ietf-rats-corim.md

+##### Linear Privilege Level {#sec-comid-linear-privlevel}
+
+A Linear Privilege Level describes an operating privilege for the target environment.
+The convention is that 0 is the highest privilege, and higher numbers correspond to fewer privileges.


The text related to positive range should follow the cddl section as the rest of the discussion on ranges is following the cddl section.

nedmsmith · 2025-02-12T19:17:06Z

draft-ietf-rats-corim.md

+*  If the condition ECT value for `measurement-values-map` codepoint 15 is an `int-range` tagged with #6.564 then a range inclusion comparison is performed.
+The comparison MUST return true if the value of PRIV is greater than or equal to the `min` value in the condition ECT AND the value of PRIV is less than or equal to than the `max` value in the condition ECT
+
+If the entry `linear-privilege-type-choice` is an `int-range` or `int-range` tagged with #6.564, then comparison with the pair of `inf-int` values MINPRIV and MAXPRIV is as follows.


inf-int doesn't appear to be defined anywhere.

nedmsmith · 2025-02-12T19:25:35Z

General feedback: The value of an integer measurement type that is strictly used for privilege levels doesn't allow the flexibility to be used for other measurement types (as in the type mechanism isn't extensible) means it isn't as generally useful. I thought we were going to give it semantics that were similar to raw-value where the mkey tag can be used to distginguish semantic richness while the appraisal comparison doesn't care as it's simple checking whether a singleton value falls within the range of integers.

Reevaluating the direction

deeglaze · 2025-02-13T01:34:27Z

General feedback: The value of an integer measurement type that is strictly used for privilege levels doesn't allow the flexibility to be used for other measurement types (as in the type mechanism isn't extensible) means it isn't as generally useful.

Agreed, which is why the tagged value is a tagged-int-range, and not a tagged-linear-privilege-range. The added semantic context of linear privilege comes from codepoint 15. An mkey can add further context that it's for a specific notion of privilege like CPL or VMPL.

I thought we were going to give it semantics that were similar to raw-value where the mkey tag can be used to distginguish semantic richness while the appraisal comparison doesn't care as it's simple checking whether a singleton value falls within the range of integers.

The comparison only cares so much as it provides the semantics of range inclusion.

deeglaze requested review from henkbirkholz, thomas-fossati, yogeshbdeshpande and nedmsmith as code owners December 18, 2024 16:46

deeglaze force-pushed the privlevel branch from fd68fb9 to 595848e Compare December 18, 2024 16:52

Add linear privilege level measurement value type

879c4b2

As a means of representing a CPL or VMPL, this provides some extra semantic understanding. Leaving condition-matching to a later PR.

deeglaze force-pushed the privlevel branch from 595848e to 879c4b2 Compare December 18, 2024 16:58

nedmsmith reviewed Jan 22, 2025

View reviewed changes

draft-ietf-rats-corim.md Show resolved Hide resolved

deeglaze commented Jan 22, 2025

View reviewed changes

draft-ietf-rats-corim.md Show resolved Hide resolved

yogeshbdeshpande requested changes Jan 22, 2025

View reviewed changes

deeglaze commented Jan 22, 2025

View reviewed changes

draft-ietf-rats-corim.md Show resolved Hide resolved

deeglaze added 3 commits January 29, 2025 15:23

Add linear privilege level measurement value type

e75ab5a

As a means of representing a CPL or VMPL, this provides some extra semantic understanding. Leaving condition-matching to a later PR.

Add linear privilege level comparison rules

4778105

This adds taggs 564 and 565 (563 proposed by PR ietf-rats-wg#297). The -Infinity is valid diagnostic notation, but our tooling does not recognize it.

Add privlevel example.

af7248b

deeglaze force-pushed the privlevel branch from 8fd8408 to af7248b Compare January 29, 2025 15:26

nedmsmith approved these changes Jan 29, 2025

View reviewed changes

draft-ietf-rats-corim.md Outdated Show resolved Hide resolved

deeglaze and others added 2 commits January 29, 2025 21:34

Update draft-ietf-rats-corim.md

40c8500

Co-authored-by: Ned Smith <ned.smith@intel.com>

Remove errant change marker.

3d7e2e7

nedmsmith approved these changes Jan 30, 2025

View reviewed changes

nedmsmith previously approved these changes Jan 30, 2025

View reviewed changes

yogeshbdeshpande reviewed Feb 5, 2025

View reviewed changes

deeglaze and others added 5 commits February 5, 2025 15:48

Change infinity to null and drop int-eq tag.

87a4abb

Clean up tag wording in comparison text.

52d11db

Merge branch 'privlevel' of https://github.com/deeglaze/draft-ietf-ra…

261674d

…ts-corim into pr/354

Update comid-7.diag

6bd61c3

Added example to test negative and positive ranges.

Update .gitignore

7d670fd

Added cbor-tags.txt to git ignore list.

nedmsmith reviewed Feb 12, 2025

View reviewed changes

deeglaze added 3 commits February 13, 2025 01:37

Fix stale use of inf-int.

e7a1cc8

Move positive range text below cddl

2b4bb62

Note that a privilege level is a signed integer.

afd4320

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add linear privilege level measurement value type #354

Add linear privilege level measurement value type #354

deeglaze commented Dec 18, 2024

yogeshbdeshpande commented Jan 22, 2025

yogeshbdeshpande commented Jan 22, 2025

yogeshbdeshpande left a comment

yogeshbdeshpande commented Jan 29, 2025

nedmsmith left a comment

nedmsmith left a comment

nedmsmith left a comment

yogeshbdeshpande Feb 5, 2025

deeglaze Feb 12, 2025

yogeshbdeshpande Feb 5, 2025

deeglaze Feb 5, 2025

nedmsmith Feb 12, 2025

yogeshbdeshpande Feb 5, 2025

deeglaze Feb 5, 2025

yogeshbdeshpande Feb 5, 2025

deeglaze Feb 12, 2025

nedmsmith Feb 12, 2025

yogeshbdeshpande Feb 5, 2025

deeglaze Feb 12, 2025

yogeshbdeshpande Feb 5, 2025 •

edited

Loading

deeglaze Feb 12, 2025

yogeshbdeshpande Feb 5, 2025

deeglaze Feb 13, 2025

yogeshbdeshpande left a comment

nedmsmith Feb 12, 2025

nedmsmith Feb 12, 2025

nedmsmith Feb 12, 2025

deeglaze Feb 13, 2025

nedmsmith commented Feb 12, 2025

deeglaze commented Feb 13, 2025

	A Linear Privilege Level describes an operating privilege for the target environment.
	A Linear Privilege Level describes an operating privilege for the target environment. The privilege can be expressed in either positive integer ranges or in negative integer ranges.

	The convention is that 0 is the highest privilege, and higher numbers correspond to fewer privileges.
	When expressed in positive integer ranges the convention is that 0 is the highest privilege, and higher numbers correspond to fewer privileges. No negative number representation is allowed, in this setting.


		The ACS entry value stored under `measurement-values-map` codepoint 15 is a linear privilege level, which must have type `linear-privlevel-type-choice`.

		If the entry `linear-privlevel-type-choice` is an `int` or an `int` tagged with #6.564, then comparison with the `int` named as PRIV is as follows.


		If the entry `linear-privlevel-type-choice` is an `int` or an `int` tagged with #6.564, then comparison with the `int` named as PRIV is as follows.

		* If the condition ECT value for `measurement-values-map` codepoint 15 is an untagged `int` or an `int` tagged with #6.564 then an equality comparison is performed on the `int` components.

Add linear privilege level measurement value type #354

Are you sure you want to change the base?

Add linear privilege level measurement value type #354

Conversation

deeglaze commented Dec 18, 2024

yogeshbdeshpande commented Jan 22, 2025

yogeshbdeshpande commented Jan 22, 2025

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

yogeshbdeshpande commented Jan 29, 2025

nedmsmith left a comment

Choose a reason for hiding this comment

nedmsmith left a comment

Choose a reason for hiding this comment

nedmsmith left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yogeshbdeshpande Feb 5, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yogeshbdeshpande left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nedmsmith commented Feb 12, 2025

deeglaze commented Feb 13, 2025

yogeshbdeshpande Feb 5, 2025 •

edited

Loading