[Rats] Re: Adoption call for draft-richardson-rats-geographic-results

[Muhammad Usama Sardar <[e-mail]>]

Hi Serhii,

On 11.09.26 20:02, Serhii Nikolaichuk wrote:

> three things, then I stop taking the list's time.
I found it constructive and insightful exchange.

> Usama, on the chained pair: agreed. The VLEK half is a provider key
> domain, so the construction joins two identities, it does not take
> the CSP out of the trust set; that is the draft's point, not an
> exception to it.
My point was that it conflicts the confidential computing threat model 
by the Confidential Computing Consortium (CCC), where CSP is claimed to 
be out of TCB.
> On the binder: you are right and I had it too easy. What my runs
> bound is a public key generated in the guest, and a key is not a
> session. Rather than argue it I measured it this afternoon on one
> Google SEV-SNP VM: a TLS 1.3 server in the guest takes the client's
> nonce and requests two reports per session, REPORT_DATA = SHA-512(nonce
> || the session's RFC 9266 exporter value) and REPORT_DATA =
> SHA-512(nonce || SPKI of its TLS key), and signs the nonce with that
> key. The client derives its own exporter and checks both. Direct: both
> accept. Through a relay on my machine that holds the guest's TLS key
> (your leaked-key attacker)
Per [4], leakage itself -- per se -- is just one option but not the only 
option. Please see FAQ1 in [5].
> and terminates the client's session: the
> key binder accepts, every check passes, peer key equals the attested
> SPKI, signature valid, report genuine; the exporter binder rejects,
> client exporter 72b395fe..., guest exporter 361367e7.... Same chip,
> same REPORT_ID, equally genuine reports; only the shared-secret
> binding sees the relay. Files under gcp-cvm/exporter/runs in [6],
> write-up in PROTOCOLS.md.

[Changed your reference to [6] because they are conflicting with my 
references]

Great demonstration, that matches our formal analysis.

> The paragraph for Security Considerations now says exactly that:
> bind the Evidence to a value derived from the session's shared secret,
> the TLS exporter of RFC 9266, and a public key alone does not
> correlate the Evidence with the session, citing [0].
Rather than [0], perhaps the most relevant citation for binding is [4], 
which makes formal arguments about public key alone (binder#4) and with 
nonce (binder#6).
> Serhii Nikolaichuk
> Austin, Texas (basis = endorsement, signer = the author; the trust
> anchor is available on request, one coffee in Austin)

Fatal error: Owner and location of trust anchor unknown. GDPR violation 
is suspected. Attestation of trust anchor is requested. Dinner in Dresden 🙂

Best regards,

-Usama

>>>         [0] https://doi.org/10.1145/3779208.3785387
>>>         <https://doi.org/10.1145/3779208.3785387>
>>>
>>>         [1] SEV Secure Nested Paging Firmware ABI Specification. 
>>>         Rev. 1.59.  August 2026.
>>>         https://docs.amd.com/v/u/en-US/56860_PUB_SEV_SNP
>>>         <https://docs.amd.com/v/u/en-US/56860_PUB_SEV_SNP>.
>>>
>>>         [2] https://www.rfc-editor.org/info/rfc9711/#section-4.2.10
>>>         <https://www.rfc-editor.org/info/rfc9711/#section-4.2.10>.
>>>
>>>         [3] The Confidential Computing Consortium.  “A Technical
>>>         Analysis of Confidential Computing”.  V. 1.3. November 2022.
>>>         https://confidentialcomputing.io/wp-content/uploads/sites/10/2023/03/CCC-A-Technical-Analysis-of-Confidential-Computing-v1.3_unlocked.pdf
>>>         <https://confidentialcomputing.io/wp-content/uploads/sites/10/2023/03/CCC-A-Technical-Analysis-of-Confidential-Computing-v1.3_unlocked.pdf>.
>>>
[4] 
https://www.researchgate.net/publication/408219182_Intra-handshakefail_CVE-2026-33697_High-severity_CVE_in_Attested_TLS

[5] https://github.com/muhammad-usama-sardar/intra-handshake.fail#faqs

[6] https://github.com/nikolaichuk7/geoar-verifier