IETF Logo Mail Archive

[Rats] Re: Security considerations of remote attestation (RFC9334)

"Smith, Ned" <ned.smith@intel.com> Thu, 19 December 2024 17:42 UTC

Return-Path: <ned.smith@intel.com>
X-Original-To: rats@ietfa.amsl.com
Delivered-To: rats@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 241E5C14F615 for <rats@ietfa.amsl.com>; Thu, 19 Dec 2024 09:42:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.248
X-Spam-Level:
X-Spam-Status: No, score=-2.248 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.148, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=intel.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Io_m1Jq1lVqZ for <rats@ietfa.amsl.com>; Thu, 19 Dec 2024 09:42:39 -0800 (PST)
Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 349ABC14F60A for <rats@ietf.org>; Thu, 19 Dec 2024 09:42:39 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1734630159; x=1766166159; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=MiN4oCh+ptjFMnjtVbfTnM6/ycnfGBknLJD7QdmrZTM=; b=N7zSh35GtHarFF6ag1kgmEF18J6T7+c4+k08bsvzHNTikStLQov/pOfs OmcfmG8eAtQS0bReK0Wi0ehdHxlENWN6EwRIWxkWxhkF06yk+G0chIzB1 RLU4TAXwgsEYV6Qc5HNQjXxN7Vz2vvxqPNBl5t2I3qlHzx2JNPgL2eiIY AbSPAaVXxAERIi3zvSemODZTTezNlhZHzsNwBHaE3Q34yAKfFP1fAkyMh TP9f/flkdbR/DhuNZm7ZoWw7k/j5SYt1pBasYE683KPcSbVbbU7+nw70o uOOpcEKw6SL3DTKodOOL+q7vpvoCVnaS+D3KIHVe20TXczwIQCXO7i9Eo Q==;
X-CSE-ConnectionGUID: 0vY7iGliS5WZQ4jsSVKUUA==
X-CSE-MsgGUID: tEhk/NHITBinAWusBMirIA==
X-IronPort-AV: E=McAfee;i="6700,10204,11291"; a="35188501"
X-IronPort-AV: E=Sophos;i="6.12,248,1728975600"; d="scan'208,217";a="35188501"
Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by orvoesa109.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Dec 2024 09:42:37 -0800
X-CSE-ConnectionGUID: xVI6nEBkRfuy0OrLtgeiiQ==
X-CSE-MsgGUID: 1x9WfmH2S8m7VpQEdSpl+g==
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="6.12,248,1728975600"; d="scan'208,217";a="98658245"
Received: from orsmsx603.amr.corp.intel.com ([10.22.229.16]) by fmviesa010.fm.intel.com with ESMTP/TLS/AES256-GCM-SHA384; 19 Dec 2024 09:42:37 -0800
Received: from orsmsx601.amr.corp.intel.com (10.22.229.14) by ORSMSX603.amr.corp.intel.com (10.22.229.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.44; Thu, 19 Dec 2024 09:42:36 -0800
Received: from orsedg603.ED.cps.intel.com (10.7.248.4) by orsmsx601.amr.corp.intel.com (10.22.229.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.44 via Frontend Transport; Thu, 19 Dec 2024 09:42:36 -0800
Received: from NAM10-MW2-obe.outbound.protection.outlook.com (104.47.55.42) by edgegateway.intel.com (134.134.137.100) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.44; Thu, 19 Dec 2024 09:42:35 -0800
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=u1qtSKlZthSV3/PokoaNe+MsMgOF2GbQkgE955zvgoXrWQi25Ca0vE+9f2am4BecLwbr9Nn/uGQLGbi6nI6zK6PClGdHOD7SZF5r9nza8mmGMTSe0jiGpuX+bbnaoSOtszZWmDk/BoGlLmCHC/dg4e1dUhWf015cOhiLA2PbURdGEs5fNwE29WDbLu/km1FfEfclSu3MfUzOo9/lyvZYrwR0SCVF8DMyocg6xZ1Hk2yf9Npv/+0jNRdO315+vhcNonidaozsGzidHEP4bKipuxWbrHTnOFDh2boToPFjoqbJeMDnzTqAvCn8FC/4cz0OTn0yoZD0hHiQFnsMQmlfKg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=eq+C0KO8OBk4rlie0r+YkfTBFVpVPxaCVPeJKk0vIVM=; b=uS5TWHp2OqUGnnZwX8EftIr3vGqHT8VBK5DGrcraBZ0RBXrIeviizPlUUUnUZ3UGg4O9RJMDknRXbzIwvNbxgrbdKKIhNbE+VAPJwZift04d3bTKV4ARPHRvK3TJdj92Yv5CF5mPTKeayJnWBJ3V8c4dHUGBobuJyeA05oWoi6xXPgg/Fz+aZmb+kvEvafbr1/9iIouYilmEFUFenNOCAtbiq3O+odovQWUAFGvMkK5kcvqSXzs1YJX9VUL7keR46jjFSGHfbzEEyNzGAnxqdALkjHyGgW34a2KInUP1/c5ZfxBJGZv5Poqy9pyY9uT0p+w+DtnyLAa5Gu77kOsh+A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none
Received: from CO1PR11MB5169.namprd11.prod.outlook.com (2603:10b6:303:95::19) by SJ2PR11MB7672.namprd11.prod.outlook.com (2603:10b6:a03:4cd::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8251.20; Thu, 19 Dec 2024 17:42:20 +0000
Received: from CO1PR11MB5169.namprd11.prod.outlook.com ([fe80::9bf0:5425:d055:42b7]) by CO1PR11MB5169.namprd11.prod.outlook.com ([fe80::9bf0:5425:d055:42b7%6]) with mapi id 15.20.8272.005; Thu, 19 Dec 2024 17:42:20 +0000
From: "Smith, Ned" <ned.smith@intel.com>
To: Muhammad Usama Sardar <muhammad_usama.sardar@tu-dresden.de>, Michael Richardson <mcr+ietf@sandelman.ca>, Thomas Fossati <thomas.fossati@linaro.org>, Henk Birkholz <henk.birkholz@ietf.contact>, junzhang <junzhang1@huawei.com>, Giridhar Mandyam <giridhar.mandyam@gmail.com>, "lgl island-resort.com" <lgl@island-resort.com>, "rats@ietf.org" <rats@ietf.org>
Thread-Topic: [Rats] Re: Security considerations of remote attestation (RFC9334)
Thread-Index: AQHbNH/DYWfSc7u5cEiooLQ1tlKvsrLG8bIAgAAeFQCAAP5NgIAAKOqAgAElFoCAABMygIAABEUAgAHLkYCAABvQAIAAU4CAgACuqgCAAB+FgIAACOqAgAAFOYCAABAJAIAABnYAgAAWDACAAJbbAIAXILGAgAByDeiAB9XdgIABWqFc
Date: Thu, 19 Dec 2024 17:42:20 +0000
Message-ID: <CO1PR11MB516988E02678059E77D0D464E5062@CO1PR11MB5169.namprd11.prod.outlook.com>
References: <4ffdd034-05ec-4565-9cad-b40ff82f83fc@tu-dresden.de> <6ae884d8-b7a2-4e5d-9f36-a819284f7589@tu-dresden.de> <f356d4cfc944484ba53600177001ba30@huawei.com> <42365842-ea0e-4129-8469-9f8a22ac0c7d@tu-dresden.de> <9006a93d-4fdd-18da-185a-d20606bb3d20@ietf.contact> <196f403d-f95a-4f81-b00e-08aace4976cc@tu-dresden.de> <CA+1=6yfED4vPA=SJE6OLK7Tpva6QBKGvOnbVpOUexT_nv2T+jA@mail.gmail.com> <5073b0a0-e938-4299-936b-0dd644ea3f88@tu-dresden.de> <CA+1=6ydHjEf8cBEu0oaa8pHBn_As2dowwoEtrtRHR1U+=Vhscg@mail.gmail.com> <92b82fe0-34e6-4a35-b265-a29466cda69a@tu-dresden.de> <CA+1=6yffVFhnMxcXo2pwD1xFdWdHKCj60zT2RKgAg=5DyBKDXQ@mail.gmail.com> <01ede5ee-6e98-4855-b351-5c3c0961f8d2@tu-dresden.de> <CA+1=6yfP+RV0MuyKhSw8CkjJh6gX4pG0hreQdYgqb9AZyZ1kvg@mail.gmail.com> <b273e32a-8855-48b8-b16a-839a238537ee@tu-dresden.d e> <22509.1732828924@obiwan.sandelman.ca> <9656e051-450a-43db-a0f9-6cdd323f255f@tu-dresden.de> <CO1PR11MB5169A23D48E5401162D7E20EE5382@CO1PR11MB5169.namprd11.prod.outlook.com> <1b1ae008-94e6-47fd-9c3a-ae4fa8c2c85a@tu-dresden.de>
In-Reply-To: <1b1ae008-94e6-47fd-9c3a-ae4fa8c2c85a@tu-dresden.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-reactions: allow
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=intel.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: CO1PR11MB5169:EE_|SJ2PR11MB7672:EE_
x-ms-office365-filtering-correlation-id: 09f6e606-aae4-4dc6-9921-08dd20547d38
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|366016|1800799024|376014|7053199007|8096899003|38070700018;
x-microsoft-antispam-message-info: TEFWQXWukeVu2pkw8Suv/CMwiVoW4Zd6DtQzc4PkvEULdxG+MO+A4P9nY1RnqGVqjNTorlvsvj4Fo0lynYHVwmPT0pNfVfTNlw2pglQNYyHTddTo0Q6I+mWYmcE2VYiyEqXHYSH5nn4+GhDQZ3PvuwxFgtQ0Th4hCIWp9bBQlVdQe7uKIawzqPGzKG/9WQX3ka88rfwRvIUiivCPCeBZSsLIX6Rb7Q61I35rT8v+xjtdSbABDVZx8RWDw+75w3QWFuIN+7UCtfFrbf8JV17ynAENSuoIXMTwmj9o8id3i8EolbmppMSLl5wmKEcmumIf9uqyviWJ3we4aCzeBuBuVjJ2bIIlAIZgRD+h2Qu1sj6aF64f1VD4Dl9I8Yt3dFHFbOEz7kHxoeR+KKEb3ZQU3YM0XbmetI9JlZUXjp3qhH8ZqC4GCxZly0uovhLNBq/en6RpA3fmFFB7ZP5l2tDuE4qMlWZn6xBkqGdNYIO2rbq3S5uM+/P5bKP3nXaSTJLV5Lt0vTuDQ7kt9zHi/gjPn0z/ojUebClxJ7Tz3StSASBw+OkWyo6oL0C76yK/Fe5WV4lxmGkuyACXQ8+v3NNWLf3gzkKFGOMEqWhESa19I/TNBJICavkiTb/eNQzMwVOzhNjuiPqhSBGl320ynqoep6UBnQL6bLfjl6FrF4y/iSP3A4pAGthNQN+mWKCNZGVWzHd8Yp5QZ0rykgch6kaAgzm5DH1TR78fmGjvizJAsgxixHqf2FzBJfawtxk58bfy7fLpYasPcXOfpibjyzu03srDQTkNOdI/8kjKHi+MrzEca+hxqEXz553/EEBnyLOwV6PvI0hw2R6HW7Q014xhSNprRJ6OTzNEtwWJ+iXH0geiU6iSxSLqe3VDnFOE1zM9S66UP3ekzIb8o+wHAbN4vcvh7wo64GMniByXIywfc43As13FOTSO+/q/T88+kvP2p1jsjVDigwDPKY+3dtTeaMBn7z6v1hmo2U4aZAdji9EwRi6QedZM/RQo6xwEPYLPLyM8hFUAWbLMFFuHZ9yT70lI80P4PAlgb7gMHGTcTjxM4EgMKm2pP8Ln74joTt3ee1NY+BuOfXmDFSNBZWfGpVDVdaxMoIvlqjGNQDY1ST84QV9IiAWtPk+e7pmpSHgu57uqTeAes6Hja/tbCkpzoXy5NM0PsqvzGdi8U8A/b9uRDwg6q+dWvRNCmyK5xUL/VwTWbogxiMWB3QnSSMl6OCEPLDyrEOxenUE0jG9htQcItlInNkOjvzH+X5+wmVUgYLHpUCV3rj2wPZ7g4lEMGtXL12YA9ari4nTV2PwgOnJ2F40PBy37mmOsEdeJ9zmjCi5XbVphPZLHsvI/BaUdQvOnH61GUJapPOAo3RJacNeQGVNkJwPcRaob8ZSy8XYYug5iLXAXz2wkglRxDUFOXg==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CO1PR11MB5169.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014)(7053199007)(8096899003)(38070700018);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: cvryfOjgDa33AucQsdPZ0tJ+4bPT2PieACxvkRV8/54HihI+hAGllmBs0p4G6DD+I8+F+mWezq/6mcboZBz2w7oTgLGX9vsprBuTP0M1+RN+YJCmUCqa3zQnRjsF59c2qDqC/Z6wH0Bq8XJdhxcePVBPafc6t3LQcUSdZpG6lN9hgYRTXGx7qJy3DwDX93x+kFSDYwTl5IK3D++edzzWveRKhW2rFa76aI1zLq+Kkz28PAQwFUoBxGZrMBaPoG7Dn3++kwUp3RSNPrLUzaeflLt+tACLs8xEEb3cPbjWRxwzX1/0Mso3hZCx14qzludVXatgeBRwLJUC6MgrbofJXv1pWrNKDxcYv5wnaA3KaB8QL3fUm/izd7pMiam28aTFxuxvAuP3J1qgvNLtdPGhPepY/MX7lJO2wIqaHu/Xq2snBhhgqcc8duKAC7t6hOi6xlFBrSWGroTFbUogCihgGCHfaGoCDINn4gCdeiXlPJl4elAeEcu/tqDwy8K3oVQNn8hE9UD0wkHyHkXiIRfyiBwZzT59Nr+5RvDfiSPFs6f6l0N+OU9hc59nsDviPBxLcll2R93uvWt78+Mu0GZzC9jATOSU8EBMYH9qF4qmeNx00HlBGDaWtF1fJxTxc//lX4FAYyyxSeGpDJ0lmz2aB3lxu8TaXScK0g7l9Z8S7wMoBrXDXKGso8QmnSfrHRtIUNtQ/AQkZ+G6YOn5mJB5/eDu3uF04vFFWxRf4MaiX2FevHC6f/wbtj8bv+Sa78KML1sVlgl8GdStKnAGj3mEQdZ+4dMXNs4CSWx8qM/7A6Y5W9xwyTPgmF/ZYQT9xD61x875S0cTOhV8G8DC/n0TepxdcfpafnGcTeCDdFcbSKjvD/2qgzmgybub5ok+Ey67AoNLbO04t5QGlFxpOnwY5azXfZ/kk3tHuBmKO3PrcWTI1+GfdgS+leXx28XtNHOFoHFTiVPiHrkezO0zEXAWx45VLvcKKl3DwONqr+ok0P8WIkHozejC7xIQWJ90IihmkhXVK5eGxM3nx3ddC0cZdF3iRnhRfmomfmIxUthPWXO25HPFYEOsM9JtPe7IXuJe9nbrrdfwkzTJlKoHdUbieW1Q1DxTOsMVbiFlXvVzJVtq4WD1krIYCqITaICkCKYXHoo89odQbOAnlqq6KwMAaRdrxWLZbBJqaGSGnZIRQoZ28hOWI/R2RnqaivUS38prNd/Rc1/NIr7K8HdtqNAA0hYz8WYiFmte1gY4goLFsCE2ditjSQJO4FpQPj8IL65wPUpFYgszAndhnjhTPbDqGcNRPdjbFBP6bP2PV73c6+rTEJdY5TEcwAM7xgWHCnjaOffrnJzjk7vkamxf2WhOr8u2YQ7/px4+u1KW1pvspo6GOugs0Y3DE0ejAZDZlVC+IHSVicgzmE0XgWeBXtc+249C92eny//RNajCBN6C8Rp5qySDGjLlEYrkR/GgOFOhndOhiUJmi7PG2Vlmjr58zHrjPLT9fOS0/XOo5fd+qxPS3nMBFwL8B5VTj4MhzdoMTXbAyEGZJiVqoqKHZJiOLbqvxLX3SVDVvdczhhJqag4nhrySnqPVxmHQjy+YWOU+GUENrqW5QNLQoPaCXFX69w==
Content-Type: multipart/alternative; boundary="_000_CO1PR11MB516988E02678059E77D0D464E5062CO1PR11MB5169namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CO1PR11MB5169.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 09f6e606-aae4-4dc6-9921-08dd20547d38
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Dec 2024 17:42:20.6309 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: WXJXvPrkAEarHDkCdI0cXsfBj5X1wVVp5Gwyyu+P/dmE2rcrcJY4ObVIjMCPCTvSL/TYusIqRHs//5jm985b9A==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR11MB7672
X-OriginatorOrg: intel.com
Message-ID-Hash: ZH53WU5I56HKGDUYG6KDWQAUKPDPBVRE
X-Message-ID-Hash: ZH53WU5I56HKGDUYG6KDWQAUKPDPBVRE
X-MailFrom: ned.smith@intel.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-rats.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Rats] Re: Security considerations of remote attestation (RFC9334)
List-Id: Remote ATtestation procedureS <rats.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/Gh6nK3vCf0WA2jQlzFHdV3an7Uc>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rats>
List-Help: <mailto:rats-request@ietf.org?subject=help>
List-Owner: <mailto:rats-owner@ietf.org>
List-Post: <mailto:rats@ietf.org>
List-Subscribe: <mailto:rats-join@ietf.org>
List-Unsubscribe: <mailto:rats-leave@ietf.org>

> I didn't hear anyone saying that the statement in RFC9334 is correct.
The fact that 9334 has RFC status means that there is broad consensus that it is correct. Please don’t try to flip it the other way.

On 12/18/24, 13:01, "Muhammad Usama Sardar" <muhammad_usama.sardar@tu-dresden.de> wrote:
Hi all,

On 13.12.24 22:22, Smith, Ned wrote:
> Pointing to specific text that is “wong” would be helpful since there
> is general consensus that the section as a whole is reasonable.

I didn't hear anyone saying that the statement in RFC9334 is correct.
Therefore, as proposed by the chairs, I have started creating a micro
I-D [1] pointing to the specific text and explaining why it is wrong.
The repo setup, however, fails [2]. I will appreciate if someone with
familiarity with the tooling can help out.

Thanks,

Usama

[1] https://github.com/muhammad-usama-sardar/rats-unprotected-evidence

[2]
https://github.com/muhammad-usama-sardar/rats-unprotected-evidence/actions/runs/12400875792/job/34619028321

v2.46.0 | Report a Bug | By Email | System Status