Re: [Rats] Function of an endorsement relative to evidence

["Eric Voit (evoit)" <[e-mail]>]

From: Laurence Lundblade, June 6, 2022 3:45 PM



~

 

Think about these static Attestation claims set by the Attester Manufacturer:

OEMID: Set once at manufacturer time and never changes; it is the same for large numbers of devices

UEID: Set once at manufacturing and never changes; it is different for each device

HW Version and Mode: Set once at manufacturing time and never changes; large groups have the same ID

 

We’re fine with these being set and sent as claims. They don’t have to be in an Endorsement, right? Some of them could be in an Endorsement, but there is nothing wrong with them in Evidence.

 

Of course if they are sent in Evidence, then there has to be an Endorsement that tells the Verifier they can believe these claims in Evidence and the signature on Evidence has to be verified.

 

To me security-level (the static statement of designed security level; see here <https://mailarchive.ietf.org/arch/browse/rats/?qdr=d> ) is pretty much the same as the above claims in the way it is conveyed securely.

 

 

What ever the outcome for security-level is, I think getting to common understanding of how claims are secured relative to Endorsements is critical to Rats.

 

<eric> The three claims listed above are focused on establishing instance identity. A policy of the Relying Party needs to establish an instance identity to understand the context of other claims.  An endorsed security level should be a known function of the instance identity once that identity has been established.

 

Eric

 

 

LL