[Rats] Re: Hint Discussion in CSR Attestation Draft

[Carl Wallace <[e-mail]>]

Inline...

On 6/21/24, 2:56 PM, "Thomas Fossati" <[e-mail] <mailto:[e-mail]>> wrote:


Hi Carl,


On Fri, Jun 21, 2024 at 8:24 PM Carl Wallace <[e-mail] <mailto:[e-mail]>> wrote:
> On 6/19/24, 4:58 PM, "Michael Richardson" <[e-mail] <mailto:[e-mail]> <mailto:[e-mail] <mailto:[e-mail]>>> wrote:
> <large snip>
> ht> In the CSR attestation draft we suggested to use a hint,
> ht> i.e. information that helps the relying party to select a verifier
> ht> that can help process the evidence. Since this hint will not be used
> ht> in all deployments, for example in deployments that only have a single
> ht> verifier, this hint is optional. As such, those who do not want to use
> ht> the optional hint do not need to look at it. For the other use cases
> ht> it provides value. Hence, I don’t really understand the objections
> ht> and I don’t want to remove the hint!
>
> I guess I've lost track of who and why this is being objected to.
>
> [CW] As an attester, how would you populate the hint field?


That may be information that is injected at manufacturing time into
the device and updated via its device management infra. An example
here [1].


[1] https://www.ietf.org/archive/id/draft-tschofenig-rats-psa-token-22.html#section-4.5.1 <https://www.ietf.org/archive/id/draft-tschofenig-rats-psa-token-22.html#section-4.5.1>


> As a verifier, how would you consume the hint field?


You wouldn't. The hint is a routing label that is used by the relying
party to decide which verifier to contact for handling this specific
piece of attestation evidence. When evidence reaches the verifier the
hint is no more.

[CW] OK, so relying party, not verifier. How would the relying party use a "free form" label to route anything? 

cheers!
-- 
Thomas