Re: [EAT] Device Identity (was Re: [EXTERNAL] Re: [Rats] Attestation BoF charter updates?)

Carsten Bormann <> Mon, 22 October 2018 11:46 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A810A130E17; Mon, 22 Oct 2018 04:46:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id RxAyYbtNCZWm; Mon, 22 Oct 2018 04:46:12 -0700 (PDT)
Received: from ( [IPv6:2001:638:708:30c9::12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 951EF130E30; Mon, 22 Oct 2018 04:46:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
Received: from ( [IPv6:2001:638:708:30c8:406a:91ff:fe74:f2b7]) by (8.14.5/8.14.5) with ESMTP id w9MBk12a024192; Mon, 22 Oct 2018 13:46:06 +0200 (CEST)
Received: from [] ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 42dvqF2d44z1Bqf; Mon, 22 Oct 2018 13:46:01 +0200 (CEST)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
From: Carsten Bormann <>
In-Reply-To: <>
Date: Mon, 22 Oct 2018 13:46:00 +0200
Cc: Henk Birkholz <>, Laurence Lundblade <>, "" <>, Hannes Tschofenig <>, Guy Fedorkow <>, "Smith, Ned" <>, "Jeremy O'Donoghue" <>, "" <>
X-Mao-Original-Outgoing-Id: 561901558.288903-8225da9f9962033a1f11862f6477cd0c
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <>
To: Denis <>
X-Mailer: Apple Mail (2.3445.9.1)
Archived-At: <>
Subject: Re: [EAT] Device Identity (was Re: [EXTERNAL] Re: [Rats] Attestation BoF charter updates?)
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: EAT - Entity Attestation Token <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 22 Oct 2018 11:46:22 -0000

On Oct 22, 2018, at 12:01, Denis <> wrote:
> The wording "identity document" should not be used in the charter, since the most important characteristic when using attestations is to be able to know 
> the characteristics of a device, i.e. that it operates as expected, does what is required and does not do other (bad) things. Knowing the identity of a device 
> (e.g. the name of its manufacturer and a unique serial number given by that manufacturer) may certainly be useful in some cases, but it is not always necessary, 
> nor desirable (e.g. because of privacy issues).

Henk forecasted that I would say “the usual identity confusion” earlier…

This is indeed the usual identity confusion.

RFC 4949 says:

   $ identity
      (I) The collective aspect of a set of attribute values (i.e., a
      set of characteristics) by which a system user or other system
      entity is recognizable or known. (See: authenticate, registration.
      Compare: identifier.)

In other words: A set of claims.

When I buy cigarettes from a vending machine in Germany (I don’t, so please excuse inaccuracies), it needs an identity document with exactly one claim on it:  age ≥ 18 years.  For a cash buyer, that is the entire identity the vending machine cares about.  (Obviously, the asserter of that claim needs to be authorized to do so by the operator of a vending machine — that set of authorizations is probably something that is honed by a procession of court cases.)

Since even the identity of the entity authorized to make a claim may be subject to privacy, the actual identity may be mixed together through a number of verification services.  It is useful to have a protocol that can be used to convey identities through such a mixer; the actual relying party may not need to understand much about what is happening as long as it trusts the verification services.  Or, in the above example, the vending machine may use a claim from a bank card that I’m ≥ 18yo, without understanding how the bank came to that conclusion.

Maybe we should replace the term “identity” with “set of claims useful for recognizing something or somebody”, hmm, SOCUFRSOS?  “Identity” might be easier to say.

I’m not sure I understand the part about SEQUENCE — I don’t see any (ordered) sequences in the rest of your message.
What I do see is claims that have different kinds; and that is of course important.  It is also sometimes important that we can have multiple claims of the same kind, something that JWTs are not very good at yet (we could fix that in CWT).

Grüße, Carsten