Protocol Action: 'RATS Conceptual Messages Wrapper (CMW)' to Proposed Standard (draft-ietf-rats-msg-wrap-22.txt)

[The IESG <[e-mail]>]

The IESG has approved the following document:
- 'RATS Conceptual Messages Wrapper (CMW)'
  (draft-ietf-rats-msg-wrap-22.txt) as Proposed Standard

This document is the product of the Remote ATtestation ProcedureS Working
Group.

The IESG contact persons are Paul Wouters and Deb Cooley.

A URL of this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-rats-msg-wrap/




Technical Summary

   The Conceptual Messages introduced by the RATS Architecture (RFC9334)
   are protocol-agnostic data units that are conveyed between RATS roles
   during remote attestation procedures.  Conceptual Messages describe
   the meaning and function of such data units within RATS data flows
   without specifying a wire format, encoding, transport mechanism, or
   processing details.  The initial set of Conceptual Messages is
   defined in Section 8 of RFC9334 and includes Evidence, Attestation
   Results, Endorsements, Reference Values, and Appraisal Policies.

   This document introduces the Conceptual Message Wrapper (CMW) that
   provides a common structure to encapsulate these messages.  It
   defines a dedicated CBOR tag, corresponding JSON Web Token (JWT) and
   CBOR Web Token (CWT) claims, and an X.509 extension.

   This allows CMWs to be used in CBOR-based protocols, web APIs using
   JWTs and CWTs, and PKIX artifacts like X.509 certificates.
   Additionally, the draft defines a media type and a CoAP content
   format to transport CMWs over protocols like HTTP, MIME, and CoAP.

   The goal is to improve the interoperability and flexibility of remote
   attestation protocols.  By introducing a shared message format like
   the CMW, we can consistently support different attestation message
   types, evolve message serialization formats without breaking
   compatibility, and avoid having to redefine how messages are handled
   in each protocol.

Working Group Summary

Reviews and comments were received from many WG members, coming from many
backgrounds (e.g., IoT, confidential computing, PKIX) through the IETF
meetings, mailing list, and GitHub, resulting in lots of progress. This
feedback has brought improvements to the security and privacy considerations,
the design and semantics of newly proposed data structures, accuracy and
correctness of sections written in formal languages (e.g., CDDL), alignment
with other dependent drafts, and so on.

There is strong consensus among interested participants.

Document Quality

   The "Implementation Status" section of the document lists two existing
   implementation: a Go one [Veraison-Go] and a Rust one [Veraison-Rust] which
   cover all the features in the draft and are currently alpha-status.

   The ASN.1 module for the X.509 extension has been reviewed and validated using
   available tooling to check it compiles correctly [ASN1-check]. ASN.1 extension
   request has been verified by IANA Designated Expert [ASN1-request].

   The CDDL and ABNF included in the draft, and the associated ABNF specification,
   have been reviewed and refined repeatedly, e.g. [ABNF-fix], [CBOR-tag-CDDL].
   CDDL is validated on the draft repo CI (part of the `build` job in [CDDL-CI]),
   and the standalone module is published alongside the draft version it belongs
   to (e.g., [CDDL-module]).

   Media Type Registration Requested on 25 Aug 2025:  
   https://mailarchive.ietf.org/arch/msg/media-types/VUzse4NM6yhSq8454bcGS5OsH2I/

Personnel

   The Document Shepherd for this document is Ionuț Mihalcea. The
   Responsible Area Director is Deb Cooley.