QueryResponse without QueryRequest

[dthaler]

In Hannes's review of the teep-over-http draft, he said:

FWIW the note that the TEEP Agent can start with a QueryResponse if it has the TAM public key is IMHO incorrect

This came from previous OTrP text where OTrP allowed such an optimization in order to minimize RTTs and bandwidth for constrained devices. Shouldn't we add this optimization into the TEEP protocol?

[hannestschofenig]

I think we should look at this item once we have the other issues resolved to see how much benefit we gain from this optimization.

[dthaler]

A closely related issue is the state requirement on the TAM, which affects scalability.
For example, if you have to create state when sending a QueryRequest (e.g., to store the token to check against in the QueryResponse), you can only support so many clients, compared to a stateless approach.

(If your TAM is also a Verifier instead of separating that role, then if you use a nonce for attestation evidence freshness you have to create state anyway, but the RATS arch also discusses approaches where no such state requirement exists if you use timestamps or epoch handles.)

Relaxing this check that a QueryResponse must be in response to a QueryRequest, and removing the token check on reception of a QueryRequest thus also helps scalability.

[dthaler]

Another related requirement is around freshness (replay protection), as discussed in section 10 of draft-ietf-rats-architecture. It's unclear whether you can provide freshness without a QueryRequest unless you rely on synchronized clocks and a trusted source of time.

[dthaler]

I might propose we just match RATS and have TEEP be agnostic as to which approach is used. Allow a challenge in the QueryRequest (which we have) but allow for a QueryResponse to be sent without a QueryRequest, which wouldn't pass verification unless some scheme like time sync is required outside the scope of the TEEP protocol. This is related to issue #83 in terms of being able to get rid of the token, or not.

[dthaler]

A proposed resolution was shown in IETF 110 slides