Re: [Rats] Attestation Terminology

["Smith, Ned" <[e-mail]>]

Right. This echoes the consensus of the RATS WG, that definition of attestation was a non-blocking item.

Possibly, this thread is clarifying that any RATS draft (outside of 9334) that includes a definition does so to accommodate the interest of the audience that is the focus of the draft/RFC?

At some point in the future, if there is interest and a clear path to a consensus definition, then either 9334 or 4949 could be updated to include a definition.

From: RATS <[e-mail]> on behalf of "lgl island-resort.com" <[e-mail]>
Date: Wednesday, September 20, 2023 at 12:19 PM
To: Henk Berkholz <[e-mail]>
Cc: Hannes Tschofenig <[e-mail]>, rats <[e-mail]>
Subject: Re: [Rats] Attestation Terminology

I personally don’t have a need for a canonical definition, but here’s how I think of it — how does it tie back to the legally responsible party?

User authentication like passwords, SASL and FIDO authenticate the human or organization buying the item, accessing the data, …

Server authentication, primarily TLS, authenticates services, the company selling something or providing a service

Attestation authenticates a device or implementation that is doing something for you and indirectly the manufacturer of that device

Lawyers move liability around with contracts. We move liability around with crypto and protocols. It eventually goes back to some legal entity you can sue, prosecute for a crime or such.

It good and well to check that the SW is up to date, but that requires you trust the HW that is reporting on the SW, so in the end you really need to *authenticate* the HW.

LL



On Sep 19, 2023, at 4:58 AM, Henk Birkholz <[e-mail]<mailto:[e-mail]>> wrote:

Hi Hannes,

w.r.t.: `attestation`

there is no satisfying answer to your question, I afraid. The RATS architecture was explicitly and carefully worded to avoid the word `attestation` as a stand alone term. As it causes confusion in the context of "activity vs. message" and is horribly overloaded, in general:


https://csrc.nist.gov/glossary/term/attestation

(here NIST captures the confusion in a nutshell)

That is why RATS is about _remote attestation_, and corresponding activities, such as Evidence Generation, Conveyance, Appraisal, etc.

w.r.t.: `key attestation`

The RATS WG has not defined the more narrow term "key attestation" today. As Denis pointed out, "OpenID for Verifiable Credential Issuance" does, for example. Looking at that definition there are two essential components:

1.) "a certificate including a certificate chain asserting that a particular key is managed, for example, by a hardware security module"

2.) "provide this data along with the proof of possession in the Credential Request"

In RATS (IETF/TCG) words, I think, openid is defining `key attestation` as as an Endorsement (according to 1.) of key material that is then combined with a PoP (according to 2.). That is not the same thing as remote attestation, as there is no Evidence about the trustworthiness of the Attester generated.

I am not entirely sure how useful it would be for the RATS WG to specify  yet another meaning of the term `key attestation`. What I would see as useful in any case, however, would be writing up a definition (independent of any name). Maybe something along the lines of "Evidence about an endorsed key storage that is augmented with a PoP of a stored key" or something to that effect.

But that probably just reflects my half-baked understanding of "RATS key attestation"... what would you think `key attestation` means in the context of RATS, Hannes?


Viele Grüße,

Henk

On 19.09.23 09:24, [e-mail]<mailto:[e-mail]> wrote:

Hi all,
I am wondering why the group has not defined the term “attestation” in the RATS architecture RFC. Instead, it is defined in a solution document <ietf-rats-tpm-based-network-device-attest> where nobody finds it.
Ciao
Hannes
PS: Where is the term “key attestation” defined?
_______________________________________________
RATS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/rats

_______________________________________________
RATS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/rats