Re: [Rats] FW: [EXTERNAL] New Version Notification for draft-ounsworth-rats-x509-evidence-00.txt

[Carl Wallace <[e-mail]>]

Here are some comments, questions and nits from a first read of the new draft.

 

Comments/Questions

- In section 3.2, if EAT semantics are retained, you don't need the type field as the type is indicated in the first byte of the UEID value. The definition could just be claim_ueid ::= OCTET STRING. If you intend to not convey the type as the first byte, using a tagged CHOICE would save a few bytes vs a separate type field. Same comment applies to section 3.3. You could reuse the CHOICE definition in the claim_sueids type. 

- To align with EAT, section 3.3 should define the claim as SEQUENCE OF claim_sueid (note, the existing claim_sueids should be singular since it only conveys on SUEID). UTF8String may be a better first for the label field instead of OCTET STRING since it is a text value.

- The definition in section 3.4 does not really align with EAT semantics because the structure uses OCTET STRING for all three types and PEN is an int. A tagged CHOICE is likely right here. There are also size constraints. For example:

 

claim_oemid ::= CHOICE {

                pen INTEGER,

                ieee [0] OCTET STRING (SIZE 3),

                random [1] OCTET STRING (SIZE 16)

}

 

- In section 3.5, you could express the constraints a la EAT as:

                claim_hwmodel ::= OCTET STRING (SIZE 1..32)

 

- In section 3.6, the type should probably be UTF8String.

- In section 3.7, why PrintableString instead of UTF8String?

- In section 3.9, given both measurement-value and signer-id are hashes, why not use a SEQUENCE with alg identifier and value? You could define sha256 as default to avoid unnecessarily bloating the structure in the default case.

 

  HashValue ::= SEQUENCE {

      algorithm         AlgorithmIdentifier

                            DEFAULT mda-sha256,

      value             OCTET STRING }

- 

 

Nits

- s/consitute/constitute

- In first sentence of introduction, change ', which' to 'and'

- s/EAP profile/EAT profile

- s/time prefer/time, prefer

- s/supposed to be/intended to be

- In last sentence of introduction, change 'context' to 'contexts'

- The last paragraph of security considerations is a bit clunky. Why is there a need to try to split out verifying evidence vs preparing attestation results? The signature will be checked as part of path validation in any event. I'd delete the first sentence.

 

 

 

From: RATS <[e-mail]> on behalf of Mike Ounsworth <Mike.Ounsworth=[e-mail]>
Date: Monday, October 23, 2023 at 2:08 PM
To: "[e-mail]" <[e-mail]>
Cc: Russ Housley <[e-mail]>, Tim Hollebeek <[e-mail]>
Subject: [Rats] FW: [EXTERNAL] New Version Notification for draft-ounsworth-rats-x509-evidence-00.txt

 

Hi RATS! 

(he-he-he)

 

This is both an -00 announcement and a request for a speaking slot at 118.

 

 

This is work emerging from the LAMPS design team that has also produced draft-ietf-lamps-csr-attestation. 

 

This draft is an EAT profile (sortof) targed at FIPS and Common Criteria certified HSMs. This draft encodes EAT claims, plus a few HSM-specific claims, into X.509 certificate extensions – ie we’re using X.509 as the evidence statement format because the HSM vendor community represented in our design group unanimously decided that staying within X.509 ASN.1 is preferable from an implementation perspective compared with CBOR / CMW which would be entirely new code within HSM firmware boundaries.

 

We imagine that the publication path for this document is RATS with Russ Housley as the expert reviewer for all the X.509 certificate extensions that this draft will register with IANA.

 

 

PS sorry for the weird urldefense links. That’s my corp email filter.

---

Mike Ounsworth

 

From: [e-mail] <[e-mail]> 
Sent: Monday, October 23, 2023 12:59 PM
To: Hannes Tschofenig <[e-mail]>; Hannes Tschofenig <[e-mail]>; Mike Ounsworth <[e-mail]>
Subject: [EXTERNAL] New Version Notification for draft-ounsworth-rats-x509-evidence-00.txt

 

A new version of Internet-Draft draft-ounsworth-rats-x509-evidence-00. txt has been successfully submitted by Mike Ounsworth and posted to the IETF repository. Name: draft-ounsworth-rats-x509-evidence Revision: 00 Title: X. 509-based Attestation 

 
A new version of Internet-Draft draft-ounsworth-rats-x509-evidence-00.txt has
been successfully submitted by Mike Ounsworth and posted to the
IETF repository.
 
Name:     draft-ounsworth-rats-x509-evidence
Revision: 00
Title:    X.509-based Attestation Evidence
Date:     2023-10-23
Group:    Individual Submission
Pages:    12
URL:      https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-ounsworth-rats-x509-evidence-00.txt__;!!FJ-Y8qCqXTj2!YKUosO2y-QX6kn5tveLLlnGkD8zrTz-OVSkntiWXewmDFxQYnAQOeZ-QprQMmFwa6UM08hYguj0vX9FcqnvjD4oJBcSCNA$
Status:   https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-ounsworth-rats-x509-evidence/__;!!FJ-Y8qCqXTj2!YKUosO2y-QX6kn5tveLLlnGkD8zrTz-OVSkntiWXewmDFxQYnAQOeZ-QprQMmFwa6UM08hYguj0vX9FcqnvjD4pDgrQ81w$
HTML:     https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-ounsworth-rats-x509-evidence-00.html__;!!FJ-Y8qCqXTj2!YKUosO2y-QX6kn5tveLLlnGkD8zrTz-OVSkntiWXewmDFxQYnAQOeZ-QprQMmFwa6UM08hYguj0vX9FcqnvjD4qbFzD2wg$
HTMLized: https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/draft-ounsworth-rats-x509-evidence__;!!FJ-Y8qCqXTj2!YKUosO2y-QX6kn5tveLLlnGkD8zrTz-OVSkntiWXewmDFxQYnAQOeZ-QprQMmFwa6UM08hYguj0vX9FcqnvjD4qEwXIktQ$
 
 
Abstract:
 
   This document specifies Claims for use within X.509 certificates.
   These X.509 certificates are produced by an Attester as part of the
   remote attestation procedures and consitute Evidence.
 
   This document follows the Remote ATtestation procedureS (RATS)
   architecture where Evidence is sent by an Attester and processed by a
   Verifier.
 
 
 
The IETF Secretariat
 
 
Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system. 

_______________________________________________ RATS mailing list [e-mail] https://www.ietf.org/mailman/listinfo/rats