Re: [EAT] Organizing IETF attestation work

[Carl Wallace <[e-mail]>]

I'd explicitly call out key attestation in the in-scope list. It's implied
by the references to TCG and the Attested TLS Token Binding but seems
important enough to call out:
-Key attestation schemes like Android P attestation, Yubikey attestation,
TPM/TCG key attestations.

The deliverables list would likely benefit from a document that describes
attestation verification in detail, including establishment of trust,
revocation of trust, etc.

From:  EAT <[e-mail]> on behalf of Laurence Lundblade
<[e-mail]>
Date:  Sunday, September 2, 2018 at 3:02 PM
To:  <[e-mail]>, <[e-mail]>
Subject:  [EAT] Organizing IETF attestation work

> Hi folks, here is a straw man proposal for organizing the IETF attestation
> work.
> 
> I proposed we combine eat and rats and call this the Remote Attestation or RA
> working group. 
> 
> Example in-scope use cases include:
> * TPM/TCG based attestations that are sent to remote entities, relying parties
> and such (non-local attestations)
> * Attestations used by protocols like FIDO that provide secured claims about a
> particular subsystem on a device to relying parties
> * Platform/system attestation schemes like Android O attestation
> * Reporting of device/system security characteristics by subsystems like TEEs
> and secure elements
> * Securing of risk signals (e.g., SW version, geographic location, device
> types) sent to relying parties
> * For IoT device on-boarding, proof of device provenance
> The documents produced would probably be:
> * An overall model and terminology document (we have a start with the RATS
> <https://tools.ietf.org/html/draft-birkholz-attestation-terminology-02>
> document)
> * A claims definition document (we have a start with the EAT
> <https://tools.ietf.org/html/draft-mandyam-eat-00>  document)
> * A protocol definition for transmitting attestations when they are not being
> carried in other protocols as extensions or such (not started)
> * Possibly the token binding attestation work (Giri has completed a lot of
> work on this <https://tools.ietf.org/html/draft-mandyam-tokbind-attest-04> )
> 
> We get to reference Ra, the Egyptian sun god and use hieroglyphics.
> 
> LL
> <snip>
> _______________________________________________ EAT mailing list [e-mail]
> https://www.ietf.org/mailman/listinfo/eat