Requested Components

[hannestschofenig]

• Requested Components: A list of zero or more components (TAs or
  other dependencies needed by a TEE) that are requested by some
  depending app, but which are not currently installed in the TEE.

How does this information carried inside the attestation payload relate to the info conveyed in the TEEP protocol?

[dthaler]

As written, it implies that the list of components needed (but not already installed) are conveyed in the TEEP protocol inside claims. If we move them outside of claims then this bullet can be removed. We just need to pick one way.

[mingpeiwk]

This is a quite generic statement, and vague.

1. What other components beyond TAs will it contain and how will they be interpreted?
2. What the word "app" means by "depending app"? It can be Untrusted App or TA.
3. "needed by a TEE" - this isn't dependency of manifest file for dependent TAs by a TA in WG discussion. So this list of "components" needed by a TEE should have some examples to illustrate if they are not TAs needed by a requestTA call in the doc.

For device attestation, the device and TEE identifying information look to be right. This can be out of the list, or optional at most.

Question here: how about list of current TAs that have been installed in the TEE? I think it is meaningful in architecture doc to say what kind of information to present. Protocol doc has the actual way to carry them.

[dthaler]

Moved this issue to ietf-teep/teep-protocol#2 since it is on the teep-protocol doc and not the architecture doc.