Re: [Rats] Standardizing TPM output in attestation evidence

["Panwei (William)" <[e-mail]>]

Hi Laurence,

Thanks for sharing your thoughts. I think the use case is reasonable.
I agree with you that these types of devices may not use YANG, so some other means need to be provided, for example defining the CWT claims.

The CHARRA draft defines the attestation evidence suitable for devices using TPMs in YANG, but YANG doesn't provide security protection for the output of TPM. Actually the output of TPM is already signed by the TPM itself, what we need is to provide a secure transportation for the output, for example using NETCONF. TPM itself isn't the Attesting Environment, so it doesn't produce the Evidence directly, it needs other component's help to generate the YANG styled Evidence, and TPM's output is 
So this may be a little different than the current EAT claims. We have two options to handle the TPM's output, one is to define the traditional CWT claims, and the TPM's output is the "value" part of the claim, and then use the EAT attester's key to protect the claim. The other option is to just define the UCCS-style claims and use the secure transportation to transfer the claims and no need to sign the claims again.

I don't know whether this should be defined in EAT draft or a separate draft. But I'd like to highlight that even if the device only has TPM and has no EAT attester/Attesting environment, the YANG data models may also not be suitable for this device and it has to use some other format data models.

Regards & Thanks!
Wei Pan

> -----Original Message-----
> From: RATS [mailto:[e-mail]] On Behalf Of Laurence
> Lundblade
> Sent: Thursday, August 5, 2021 4:27 AM
> To: rats <[e-mail]>
> Subject: [Rats] Standardizing TPM output in attestation evidence
> 
> There has been a side discussion about TPMs and EAT. This is to bring it to
> the main RATS list and to state more clearly the use case I have in mind.
> 
> The devices I’m thinking of are roughly this:
>  - Desktops, servers, IoT devices… (not network equipment, probably not
> mobile phones)
>  - They have an off-the-shelf TPM2 soldered on to their PCB
>  - Likely to be Intel CPUs, but not necessarily
> 
> We want these devices to do attestation and generate attestation evidence
> (all devices on the Internet should do attestation at some point!). We want
> that attestation evidence to include measurements taken by the TPM. We
> also want attestation evidence from parts of the device other than the TPM.
> 
> That’s the very general use case I have in mind very simply stated.
> 
> Assuming this use case makes sense, then how should this get standardized
> and implemented?
> 
> There is protocol standardization in YANG now for TPM output, but I don’t
> think we want to use YANG for this. I don’t think YANG is in common use for
> these types of devices and has a particular interaction model. I think EAT is
> a good candidate because it is an independently secured blob that can be
> carried by the protocols already in use with these devices.
> 
> This then requires that some output from the TPM be put into an EAT. It
> seems useful to standardize that here in RATS and it seems in scope for the
> charter.
> 
> I don’t have a strong opinion or detailed proposal for what TPM output
> goes into the EAT or the particular HW, SW and attestation architecture of
> the device. That’s something we can work out. I am pretty sure the device
> would have two attesters in a compound/layered arrangement. The
> attestation evidence produced by the TPM would be nested in the
> attestation evidence produced by the EAT attester.
> 
> I have some leaning towards putting this work in the EAT document, but it
> could also be in another document.
> 
> I think this is important for RATS because of the very strong association of
> TPMs with good attestation and for the goal to support attestation for all
> kinds of devices and environments (not just network equipment).
> 
> 
> A few things this is not about:
> 
> - This is not about changing the format that a TPM2 outputs. This is about
> the ability to use the off-the-shelf TPMs that are manufactured by the
> millions and sitting in warehouses today.
> 
> - This is not about local device boot architecture. This is about remote
> attestation, about attestation evidence transmitted to the verifier/relying
> party.
> 
> LL
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats