[Lake] Re: Fwd: [Ufmrg] Relay Attacks in Intra-handshake Attestation for Confidential Agentic AI Systems

[Muhammad Usama Sardar <[e-mail]>]

Hi Paul,

On 04.03.26 15:11, Paul Wouters wrote:
>
> On Tue, Mar 3, 2026 at 1:02 PM Muhammad Usama Sardar 
> <[e-mail]> wrote:
>
>     Hi lakers,
>
>     Following up with supporting public evidence: *Cocos AI has
>     publicly acknowledged [9]* the relay attacks last Friday.
>
>     # *Context*
>
>     As helpful context, Cocos AI [4] claimed their attested TLS to be
>     the "best in the world" in the Confidential Computing Consortium
>     and despite we having informed them repeatedly about the attacks
>     after our formal analysis, they were continuing to misguide the
>     community on social media. Anyway, we now respect their honesty
>     and transparency, and we remain fully committed to helping them
>     towards secure solutions.
>
>
> The "we" in the context appears to refer to IETF until you get to the 
> end and see two people signing of on this posting. I would be good to 
> make this more clear and avoid talking about "we" on mailing lists.

Please try to understand that I am a researcher and "we" is very common 
use for me, even when writing a single-authored paper. In my 
understanding, consensus of the IETF is represented in RFCs and not 
emails. The emails should at best be interpreted as the list of authors 
mentioned in the email. If I sometimes forget defining we, please 
interpret it in that context.

BTW there were only two paragraphs until the reader reaches the end of 
the email.

>
> Furthermore, the tone of this posting is not conducive to future 
> collaboration with Cocos AI. The claim of them "misguiding" isn't 
> really softened by the statement of "we respect them again now".
The collaboration exists already!
>
>     # *Cocos AI acknowledgment of attacks*
>
>     Cocos AI (one of the implementers of the protocol) has publicly
>     acknowledged [9] our email and the relay attacks we highlighted on
>     their design and implementation in our email. Particularly, see
>     the sections "Limitations and the Relay Attack" and "The Relay
>     Attack Scenario" in [9]. Note that their description is almost a
>     paraphrase of our email. There are some nits that we disagree with
>     them but that doesn't matter much. They have essentially
>     acknowledged the attacks and shared a short-term, medium-term and
>     long-term roadmap for mitigations of the attacks. We believe this
>     alone is sufficient supporting evidence.
>
> Similarly, the "has publicly acknowledged" is far from friendly, and 
> unhelpful for future cooperation.
The cooperation exists already! I don't see anything unfriendly and 
unhelpful in the phrase "has publicly acknowledged".
>
>     Chairs, if there is some time available and you feel it relevant,
>     we would like to request 5 minutes to present our formal analysis
>     for lake-ra draft.
>
>
> How does this relate to lake? From what I can tell, Cocos AI used 
> regular TLS over TCP?

You have already asked this before and I have already answered it at 
[0]. The chairs and authors know the connection and the best I can do is 
a relay attack to relay this question over to them :) Hopefully, they 
can explain in some other words that may resonate better with you.

Again, if you and LAKE members want that I don't share any results, 
please let me know and I will then surely not share. If you and LAKE 
members don't want me to present, I'll cancel the slot as well. I can 
raise my concerns at IETF Last Call anyway.

Best regards,

-Usama

[0] https://mailarchive.ietf.org/arch/msg/lake/VuWYJKpdpJsDqI_rtvgPqMf4y6o/