MIME-Version: 1.0
References: <5521ffe4-4f9f-4470-93a2-644841713996@tu-dresden.de>
 <f40756f9-a7d3-4d3e-a744-1e273d96c496@tu-dresden.de>
 <2386e955-426e-4e19-ace2-0220d6552be4@tu-dresden.de>
In-Reply-To: <2386e955-426e-4e19-ace2-0220d6552be4@tu-dresden.de>
From: Paul Wouters <paul.wouters@aiven.io>
Date: Wed, 4 Mar 2026 09:11:23 -0500
Message-ID: 
 <CAGL5yWa6v7awcJv7GAoJ96jgAM7Vy4T4j9nSkiLReUs7zm91Rg@mail.gmail.com>
To: Muhammad Usama Sardar <muhammad_usama.sardar@tu-dresden.de>
Content-Type: multipart/alternative; boundary="000000000000bf4654064c3365ab"
Message-ID-Hash: 6GV4CRL2YGDIPIBDTQBNVTGFYPAPNNSM
CC: "lake@ietf.org" <lake@ietf.org>
Precedence: list
Subject: =?utf-8?q?=5BLake=5D_Re=3A_Fwd=3A_=5BUfmrg=5D_Relay_Attacks_in_Intra-handsha?=
 =?utf-8?q?ke_Attestation_for_Confidential_Agentic_AI_Systems?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/lake/ZXU4aMbLS2DcKpRk4eIhe_xjAcI>

--000000000000bf4654064c3365ab
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Mar 3, 2026 at 1:02=E2=80=AFPM Muhammad Usama Sardar <
muhammad_usama.sardar@tu-dresden.de> wrote:

> Hi lakers,
>
> Following up with supporting public evidence: *Cocos AI has publicly
> acknowledged [9]* the relay attacks last Friday.
>
> # *Context*
>
> As helpful context, Cocos AI [4] claimed their attested TLS to be the
> "best in the world" in the Confidential Computing Consortium and despite =
we
> having informed them repeatedly about the attacks after our formal
> analysis, they were continuing to misguide the community on social media.
> Anyway, we now respect their honesty and transparency, and we remain full=
y
> committed to helping them towards secure solutions.
>

The "we" in the context appears to refer to IETF until you get to the end
and see two people signing of on this posting. I would be good to make this
more clear and avoid talking about "we" on mailing lists.

Furthermore, the tone of this posting is not conducive to future
collaboration with Cocos AI. The claim of them "misguiding" isn't really
softened by the statement of "we respect them again now".

# *Cocos AI acknowledgment of attacks*
>
> Cocos AI (one of the implementers of the protocol) has publicly
> acknowledged [9] our email and the relay attacks we highlighted on their
> design and implementation in our email. Particularly, see the sections
> "Limitations and the Relay Attack" and "The Relay Attack Scenario" in [9]=
.
> Note that their description is almost a paraphrase of our email. There ar=
e
> some nits that we disagree with them but that doesn't matter much. They
> have essentially acknowledged the attacks and shared a short-term,
> medium-term and long-term roadmap for mitigations of the attacks. We
> believe this alone is sufficient supporting evidence.
>
> Similarly, the "has publicly acknowledged" is far from friendly, and
unhelpful for future cooperation.

Chairs, if there is some time available and you feel it relevant, we would
> like to request 5 minutes to present our formal analysis for lake-ra draf=
t.
>

How does this relate to lake? From what I can tell, Cocos AI used regular
TLS over TCP?

Paul

--000000000000bf4654064c3365ab
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><div class=3D"gmail_quote gmail=
_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Mar 3, 2026=
 at 1:02=E2=80=AFPM Muhammad Usama Sardar &lt;<a href=3D"mailto:muhammad_us=
ama.sardar@tu-dresden.de">muhammad_usama.sardar@tu-dresden.de</a>&gt; wrote=
:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.=
8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>

 =20
   =20
 =20
  <div>
    <p>Hi lakers,<br>
    </p>
    <p>Following up with supporting public evidence: <b>Cocos AI has
        publicly acknowledged [9]</b> the relay attacks last Friday.=C2=A0<=
/p>
    <p># <b>Context</b><br>
    </p>
    <p>As helpful context, Cocos AI [4] claimed their attested TLS to be
      the &quot;best in the world&quot; in the Confidential Computing Conso=
rtium
      and despite we having informed them repeatedly about the attacks
      after our formal analysis, they were continuing to misguide the
      community on social media. Anyway, we now respect their honesty
      and transparency, and we remain fully committed to helping them
      towards secure solutions.</p></div></blockquote><div><br></div><div>T=
he &quot;we&quot; in the context appears to refer to IETF until you get to =
the end and see two people signing of on this posting. I would be good to m=
ake this more clear and avoid talking about &quot;we&quot; on mailing lists=
.</div><div><br></div><div>Furthermore, the tone of this posting is not con=
ducive to future collaboration with Cocos AI.=C2=A0The claim of them &quot;=
misguiding&quot; isn&#39;t really softened by the statement of &quot;we res=
pect them again now&quot;.=C2=A0</div><div><br></div><blockquote class=3D"g=
mail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204=
,204,204);padding-left:1ex"><div>
    <p># <b>Cocos AI acknowledgment of attacks</b><br>
    </p>
    <p> Cocos AI (one of the implementers of the protocol) has publicly
      acknowledged [9] our email and the relay attacks we highlighted on
      their design and implementation in our email. Particularly, see
      the sections &quot;Limitations and the Relay Attack&quot; and &quot;T=
he Relay
      Attack Scenario&quot; in [9]. Note that their description is almost a
      paraphrase of our email. There are some nits that we disagree with
      them but that doesn&#39;t matter much. They have essentially
      acknowledged the attacks and shared a short-term, medium-term and
      long-term roadmap for mitigations of the attacks. We believe this
      alone is sufficient supporting evidence.</p>
    <p></p></div></blockquote><div>Similarly, the &quot;has publicly acknow=
ledged&quot; is far from friendly, and unhelpful for future cooperation.</d=
iv><div><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px=
 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
    <p>Chairs, if there is some time available and you feel it relevant,
      we would like to request 5 minutes to present our formal analysis
      for lake-ra draft.<br></p></div></blockquote><div><br></div><div>How =
does this relate to lake? From what I can tell, Cocos AI used regular TLS o=
ver TCP?</div><div><br></div><div>Paul</div><div><br></div></div></div>

--000000000000bf4654064c3365ab--