IETF Logo Mail Archive

[Rats] Re: Clarifications in draft-ietf-rats-eat

Muhammad Usama Sardar <muhammad_usama.sardar@tu-dresden.de> Fri, 11 April 2025 20:34 UTC

Return-Path: <muhammad_usama.sardar@tu-dresden.de>
X-Original-To: rats@mail2.ietf.org
Delivered-To: rats@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 8F85B1AEA883 for <rats@mail2.ietf.org>; Fri, 11 Apr 2025 13:34:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.397
X-Spam-Level:
X-Spam-Status: No, score=-4.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=tu-dresden.de
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n7GlHgy3pNGc for <rats@mail2.ietf.org>; Fri, 11 Apr 2025 13:34:30 -0700 (PDT)
Received: from mailout3.zih.tu-dresden.de (mailout3.zih.tu-dresden.de [141.30.67.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 21A671AEA841 for <rats@ietf.org>; Fri, 11 Apr 2025 13:34:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=tu-dresden.de; s=dkim2022; h=Content-Type:In-Reply-To:From:References:CC:To :Subject:MIME-Version:Date:Message-ID:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=fEsK/sfbToiN+8y0biaQ5gF55FA+CFVw1/LvJh0htmU=; b=rXV4pGfo/0OrIh+ElYjwwht3o1 5LqKt1S1XlMjX8qj4fqIOsq3vS0eF3VMM+N9We7ALfBu/mlLmub1bRXYiCCqaB/55F1WHZdzxlpc1 Mptadm5CfE/VQBTmBwW0/gZlzUqP/XL0qFDJwTb2/SqcRd9hTgE9wbdKTAmPvvexxVXTqroagqMAt R4bX7pHWtK7a5TkhoqOd0bvFXfzOiI19Ei3cmRr+XzlE9+9h+IM4DEmso+WBL61m2R3u6VbyhlDoe gLuqUHI+HkwOU1bphFjyk/Q/U6qSmavKNkz7ZjW06FyeU/l/BzdSUJt/qz4ubnI3yPi8iImgf7jpf 8Ub7K8aw==;
Received: from [172.26.35.139] (helo=msx.tu-dresden.de) by mailout3.zih.tu-dresden.de with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from <muhammad_usama.sardar@tu-dresden.de>) id 1u3L4y-00BFKo-Jj; Fri, 11 Apr 2025 22:34:24 +0200
Received: from [10.12.5.228] (81.201.156.93) by msx-t422.msx.ad.zih.tu-dresden.de (172.26.35.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1748.10; Fri, 11 Apr 2025 22:34:14 +0200
Message-ID: <28b5751b-cec6-4a7f-a696-8ac2b55c6345@tu-dresden.de>
Date: Fri, 11 Apr 2025 22:34:13 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: Laurence Lundblade <lgl@island-resort.com>
References: <4abff904-74ef-473f-8b80-6ba563018744@tu-dresden.de> <D6C150AF-DB13-439C-862E-93CEBF573F34@island-resort.com> <LV8PR02MB100170F5C089781552960B6D0F2B62@LV8PR02MB10017.namprd02.prod.outlook.com> <bd70a904-8675-43d6-8113-13ef9107450d@tu-dresden.de> <7064A6AB-4629-43B7-A071-986CEF1423C5@island-resort.com>
Content-Language: en-US
From: Muhammad Usama Sardar <muhammad_usama.sardar@tu-dresden.de>
In-Reply-To: <7064A6AB-4629-43B7-A071-986CEF1423C5@island-resort.com>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-512"; boundary="------------ms040205020408050605000307"
X-ClientProxiedBy: MSX-L416.msx.ad.zih.tu-dresden.de (172.26.34.136) To msx-t422.msx.ad.zih.tu-dresden.de (172.26.35.139)
X-TUD-Virus-Scanned: mailout3.zih.tu-dresden.de
Message-ID-Hash: NAVO2UGKZRS2Y3ECWJM6L37MT3OPVHI7
X-Message-ID-Hash: NAVO2UGKZRS2Y3ECWJM6L37MT3OPVHI7
X-MailFrom: muhammad_usama.sardar@tu-dresden.de
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-rats.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Jeremy O'Donoghue <jodonogh@qti.qualcomm.com>, "rats@ietf.org" <rats@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Rats] Re: Clarifications in draft-ietf-rats-eat
List-Id: Remote ATtestation procedureS <rats.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/4V2zZHhk5IuxwcUMNWpPBpnzpaM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rats>
List-Help: <mailto:rats-request@ietf.org?subject=help>
List-Owner: <mailto:rats-owner@ietf.org>
List-Post: <mailto:rats@ietf.org>
List-Subscribe: <mailto:rats-join@ietf.org>
List-Unsubscribe: <mailto:rats-leave@ietf.org>

Hi Laurence,

On 11.04.25 22:01, Laurence Lundblade wrote:
> We don’t want to exclude SGX and such. I do not know why you think we are excluding it.

That was pointed in my first email. In SGX, the keys are not configured 
by the manufacturer alone. Platform owner can provide a random value 
called OWNER_EPOCH.

Do you see anything wrong with the following text?

For attestation, the keys are typically injected by the hardware 
manufacturers. The keys may also be derived from a seed injected by 
hardware manufacturers at the manufacturing time.
This key derivation may involve additional factors, such as the current 
state of platform TCB, as well as a random value selected by the 
platform owner [1, Section 3.5].

[1] 
https://download.01.org/intel-sgx/sgx-dcap/1.22/linux/docs/Intel_SGX_ECDSA_QuoteLibReference_DCAP_API.pdf

v2.46.0 | Report a Bug | By Email | System Status