IETF Logo Mail Archive

Re: [Rats] About (E)UID's

"Salz, Rich" <rsalz@akamai.com> Wed, 12 February 2020 16:05 UTC

Return-Path: <rsalz@akamai.com>
X-Original-To: rats@ietfa.amsl.com
Delivered-To: rats@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDD191200E7 for <rats@ietfa.amsl.com>; Wed, 12 Feb 2020 08:05:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B-OR4x1RkxaC for <rats@ietfa.amsl.com>; Wed, 12 Feb 2020 08:05:22 -0800 (PST)
Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8DA7120013 for <rats@ietf.org>; Wed, 12 Feb 2020 08:05:22 -0800 (PST)
Received: from pps.filterd (m0050096.ppops.net [127.0.0.1]) by m0050096.ppops.net-00190b01. (8.16.0.42/8.16.0.42) with SMTP id 01CG4Zxn004768; Wed, 12 Feb 2020 16:05:21 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=f892NFyHx6OiMIPWwzT5Mn1cs1cT8ennW/8mQdUl8AU=; b=fW1PbqYpctQGDWPCWJkoYs/c2jL/xJODsjgMICLdGnZYKjdeJPItSt6rSrOqjgnEc+ZI iENVsdA7NLGTBv+qn7CYvVGDZB4nhB+uYpehcCCtS9UpLld3+J5mRcoVArDb8gHOVtGu IlOG7rPACAoH6F9wunr5IpD7apb3PM4Z14yPl+gj+OIzFG0uQ42hMa1N5eXxMSe7oQOb a/39WGaFM6Gjv3CzjDmQ6KLlGshx3QVMKkjuC38j1asAFMn16Fj2xH1olc50N62Bw3in yi22HPN7FqOcRePy7VtKzDGnzVI0gVoeSSZUGdSEY0PTOhGxILKtO4cyp8sHTuWSvYoJ Zg==
Received: from prod-mail-ppoint5 (prod-mail-ppoint5.akamai.com [184.51.33.60] (may be forged)) by m0050096.ppops.net-00190b01. with ESMTP id 2y456rb5me-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Feb 2020 16:05:21 +0000
Received: from pps.filterd (prod-mail-ppoint5.akamai.com [127.0.0.1]) by prod-mail-ppoint5.akamai.com (8.16.0.27/8.16.0.27) with SMTP id 01CG2Iru012466; Wed, 12 Feb 2020 08:05:20 -0800
Received: from email.msg.corp.akamai.com ([172.27.123.30]) by prod-mail-ppoint5.akamai.com with ESMTP id 2y1uub396v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 12 Feb 2020 08:05:20 -0800
Received: from USMA1EX-DAG1MB5.msg.corp.akamai.com (172.27.123.105) by usma1ex-dag1mb6.msg.corp.akamai.com (172.27.123.65) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 12 Feb 2020 11:05:20 -0500
Received: from USMA1EX-DAG1MB3.msg.corp.akamai.com (172.27.123.103) by usma1ex-dag1mb5.msg.corp.akamai.com (172.27.123.105) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 12 Feb 2020 11:05:19 -0500
Received: from USMA1EX-DAG1MB3.msg.corp.akamai.com ([172.27.123.103]) by usma1ex-dag1mb3.msg.corp.akamai.com ([172.27.123.103]) with mapi id 15.00.1473.005; Wed, 12 Feb 2020 11:05:19 -0500
From: "Salz, Rich" <rsalz@akamai.com>
To: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>, "rats@ietf.org" <rats@ietf.org>
Thread-Topic: [Rats] About (E)UID's
Thread-Index: AQHV3QtUaUOLh4A2CU2Ls4Ypa3w676gP+e6AgABDNQCAAF3YgIABrK8AgAQ09oCAAV4sAIAAGrEA///Ii4CAAFb5AP//rVgA
Date: Wed, 12 Feb 2020 16:05:18 +0000
Message-ID: <7CD1487A-2252-43D0-9D97-C3009F1A6A97@akamai.com>
References: <8BDAAE2E-9803-4048-AD5B-59233708E6FB@akamai.com> <1C16DAA0-D03B-417C-894A-30C4015AEED7@island-resort.com> <DBBPR08MB49031E717F69E4CF58CF67A1EF1C0@DBBPR08MB4903.eurprd08.prod.outlook.com> <509C8229-20DC-4888-BE1D-9109733A9E2D@intel.com> <5B9516E6-1441-462E-86D2-B630B32CE1C7@island-resort.com> <DBBPR08MB4903356ED09601AA7A6006FAEF180@DBBPR08MB4903.eurprd08.prod.outlook.com> <07A3E092-068F-4E35-8C39-D290FDB8CFDC@island-resort.com> <DBBPR08MB4903840E6D30A59083F8B119EF1B0@DBBPR08MB4903.eurprd08.prod.outlook.com> <6CD93307-E6F2-40F9-B041-FEBF5AD226CA@akamai.com> <eb6b796e-a2c3-407b-225d-fcd3903ca414@sit.fraunhofer.de>
In-Reply-To: <eb6b796e-a2c3-407b-225d-fcd3903ca414@sit.fraunhofer.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.22.0.200209
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [172.19.117.63]
Content-Type: text/plain; charset="utf-8"
Content-ID: <9C1FD9FA4480DE4D9C4C09E6DD6B1FF5@akamai.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2020-02-12_08:, , signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1911140001 definitions=main-2002120124
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.572 definitions=2020-02-12_08:2020-02-11, 2020-02-12 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 phishscore=0 priorityscore=1501 mlxscore=0 mlxlogscore=999 spamscore=0 bulkscore=0 lowpriorityscore=0 adultscore=0 clxscore=1011 suspectscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002120124
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/1nW4wDgcF48i8oeJllGxnuar15o>
Subject: Re: [Rats] About (E)UID's
X-BeenThere: rats@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Remote Attestation Procedures <rats.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rats>, <mailto:rats-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rats/>
List-Post: <mailto:rats@ietf.org>
List-Help: <mailto:rats-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rats>, <mailto:rats-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Feb 2020 16:05:25 -0000

Text derived from this should show up in the architecture document.

On 2/12/20, 11:02 AM, "Henk Birkholz" <henk.birkholz@sit.fraunhofer.de> wrote:

    The security of the RATS architecture does not rely on a single claim. 
    It relies in trust anchors that you can put trust into in order to 
    believe a certification path and therefore attestation provenance, it 
    also relies an Endorsements provided by potential several Supply Chain 
    entities.
    
    A single UEID claim that could encounter a collision (maliciously 
    intended or by accident) will not necessarily compromise a complete 
    instance of a remote attestation procedures. If your Claim set and 
    corresponding secret/shielded key material are sparse, this reduces the 
    believability of the corresponding evidence and therefore lower the 
    level of assurance/security of that implemented RATS architecture.
    
    But that is an implementation choice. The architecture offers suitable 
    set of secure methods. If base all you post-process decision, than that 
    is a choice and should be aware of the risk involved for not using any 
    other secure methods.
    
    Viele Grüße,
    
    Henk
    
    On 12.02.20 10:49, Salz, Rich wrote:
    > I am still concerned about what fails if someone re-uses an EUID, either 
    > by accident or maliciously.  If the security of the RATS architecture 
    > depends on uniqueness, this seems important.
    > 
    > 
    > _______________________________________________
    > RATS mailing list
    > RATS@ietf.org
    > https://www.ietf.org/mailman/listinfo/rats
    > 
    
    _______________________________________________
    RATS mailing list
    RATS@ietf.org
    https://www.ietf.org/mailman/listinfo/rats

v2.23.0 | Report a Bug | By Email