Re: [Rats] freshness in the background check interaction model
Thomas Fossati <Thomas.Fossati@arm.com> Thu, 29 July 2021 08:30 UTC
Return-Path: <Thomas.Fossati@arm.com>
X-Original-To: rats@ietfa.amsl.com
Delivered-To: rats@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E62C3A18D2; Thu, 29 Jul 2021 01:30:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=dn35Ab7y; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=dn35Ab7y
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 267Hqwj4MEm8; Thu, 29 Jul 2021 01:30:54 -0700 (PDT)
Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20088.outbound.protection.outlook.com [40.107.2.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B81DB3A18D1; Thu, 29 Jul 2021 01:30:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=X7K698LdtCmJOaePyNKuq8iFzSlhUT8luxVbXZu+7HY=; b=dn35Ab7y7UHR+2EhIqEAWvqeaMem+wL6PhGuwI7sV72JWQcOW6wnMhrcqjC911Y9lkqgX/QUUU1aVLgfoHdLNvb4Jg+Vir/H51TU/9RPtRzRmFucSHRRYk4SLASyr49fOb2S+D/qxDlUIS50HyCqbcInx3TzcKjimTVwYVffmPw=
Received: from AM5PR0202CA0021.eurprd02.prod.outlook.com (2603:10a6:203:69::31) by DBAPR08MB5607.eurprd08.prod.outlook.com (2603:10a6:10:1ae::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.24; Thu, 29 Jul 2021 08:30:46 +0000
Received: from AM5EUR03FT027.eop-EUR03.prod.protection.outlook.com (2603:10a6:203:69:cafe::52) by AM5PR0202CA0021.outlook.office365.com (2603:10a6:203:69::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18 via Frontend Transport; Thu, 29 Jul 2021 08:30:46 +0000
X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=pass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT027.mail.protection.outlook.com (10.152.16.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18 via Frontend Transport; Thu, 29 Jul 2021 08:30:45 +0000
Received: ("Tessian outbound cee5995f7b16:v100"); Thu, 29 Jul 2021 08:30:45 +0000
X-CheckRecipientChecked: true
X-CR-MTA-CID: f534f8d1702b42b4
X-CR-MTA-TID: 64aa7808
Received: from 2678c3329cdc.2 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 89172C95-7D23-4E6A-931C-FA21E0DCB1A9.1; Thu, 29 Jul 2021 08:30:39 +0000
Received: from EUR05-VI1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 2678c3329cdc.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 29 Jul 2021 08:30:39 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FgmeqEqS9kDWumwNtq/qA66SD4MBwZIEI1lnAdxm5AFjeMLJXE3r2+jnKoSxf4nbuKqTE/g7Ut3kaT7JX6bdqHLaTEZsLnhXuAtEzU8mz0UQGtPgY/Nh+6Us7uhZoG5nWCv8WfhvAsboydecP20XovQjfivBQEj4dj8fCxU/jgaUU+wFIDV+byltX9MWXO5I4mYWsARDp5xoUt13ScibKPmgp2/1xSigb3n5v/hc+eakdI7J6hcj90pO3eBaQjpJSXy3Qg5dK3Xi3xR/svIjfpvN4JZTtNAxgVRnldLfEt7z7RKsNqWEL5U5HPv+c3wgTlGj0KCFuo9OnX5UuGgqnQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=X7K698LdtCmJOaePyNKuq8iFzSlhUT8luxVbXZu+7HY=; b=ACZ9fCbSKcU2sZ1XxTyeKhwuPHDSriWi9Yd8J94XblLRzo6qNgKMiDMGQZZOcyREMGlmRZYuI0yLCljTut4eg/WPypiSl9SwHDVE76H8r8YV0pSLUJfCx+nGlsQ4ddlbw+zJAPC1ev6Q9a9Xh+jrI6fX7PFYFKesSHTuRx+UTzhqQ7QG/8aeZJ/TV4DO2eeUCApjLxWJQbCiEA8NvE1dTaztfS2xxTtVHkbSXAxEjZSTw3ZSG0mS5zQvslCnXuCZKnZwku4hEwTjGmEhrGbT5jqLABcOdGkxq3CBGU3nQiwSBumtytyIynGlK3Y7f3+oer81dwe9SOl07sES8WINkA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=X7K698LdtCmJOaePyNKuq8iFzSlhUT8luxVbXZu+7HY=; b=dn35Ab7y7UHR+2EhIqEAWvqeaMem+wL6PhGuwI7sV72JWQcOW6wnMhrcqjC911Y9lkqgX/QUUU1aVLgfoHdLNvb4Jg+Vir/H51TU/9RPtRzRmFucSHRRYk4SLASyr49fOb2S+D/qxDlUIS50HyCqbcInx3TzcKjimTVwYVffmPw=
Received: from DB9PR08MB6524.eurprd08.prod.outlook.com (2603:10a6:10:251::8) by DB6PR0801MB1816.eurprd08.prod.outlook.com (2603:10a6:4:3c::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.18; Thu, 29 Jul 2021 08:30:37 +0000
Received: from DB9PR08MB6524.eurprd08.prod.outlook.com ([fe80::9d07:3b88:9775:9347]) by DB9PR08MB6524.eurprd08.prod.outlook.com ([fe80::9d07:3b88:9775:9347%8]) with mapi id 15.20.4331.035; Thu, 29 Jul 2021 08:30:37 +0000
From: Thomas Fossati <Thomas.Fossati@arm.com>
To: Michael Richardson <mcr@sandelman.ca>, "rats@ietf.org" <rats@ietf.org>
CC: "anima@ietf.org" <anima@ietf.org>, Thomas Fossati <Thomas.Fossati@arm.com>
Thread-Topic: [Rats] freshness in the background check interaction model
Thread-Index: AQHXhBKReicgMJApwUGIumuRXdpJBKtZsKGA
Date: Thu, 29 Jul 2021 08:30:37 +0000
Message-ID: <A99F0966-2E1E-4D84-B539-7E9042B26179@arm.com>
References: <19612.1627519296@localhost>
In-Reply-To: <19612.1627519296@localhost>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/16.51.21071101
Authentication-Results-Original: sandelman.ca; dkim=none (message not signed) header.d=none; sandelman.ca; dmarc=none action=none header.from=arm.com;
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-Correlation-Id: 82695d66-8de9-4bfd-e61a-08d9526b2958
x-ms-traffictypediagnostic: DB6PR0801MB1816:|DBAPR08MB5607:
x-ms-exchange-transport-forked: True
X-Microsoft-Antispam-PRVS: <DBAPR08MB5607BE09F89C8F88F3C554989CEB9@DBAPR08MB5607.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:9508;OLM:10000;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: iqR1C3NnREPvfhHW73xQFfqEIYsLEiA3Xf4XdDmVDItGWguOCrkvvIiG2mGiTPHKld8ZbWPDAdOB2s7XEJ32oQNGxo2h8E7w10lVt5d3/rHumkGkZ5YtBqpA3PiX9jITjxj/p980oPHJYk4q/TOFunblag9FD7wnAT8MXU1VsIKG2gUsFJV+F7DoRkUVZDiAkGsDmFjZRvjqgzNpO7CTcA6CIOBs4XtRn+JtlcRzjiuvI2AyomEXqtTVdowAQk89R+i+KkJUTESi8D7wvOkruEVKqq//hSiB7m2T6EqakFmKp8LqU/BrvC2UfoI7ScPo8SRkf1pzvw48HbUHkwpFfBR1mjKrwR58zf5XLhd7FGaiqTCB4Bz4/58cP9eciH0ejAKJuglUahqwpC6SFi9Mk8mtMABzSLDZxLFGYPlICbV3Atgr42m1YGR9rbGykpfKcVkDaxJYTnT0+AjgWBFJoynmZsrGXsJMKq4JG4cSGIj+/OlsBmUP3htAB9YYqpFFUqjAGvAXvL1nltxaUmr0c8N7pTq9VneOVHjrP3W2PNhl10unj9wueFTKbzeoq0z0TH9PdeeHzYe04nKkNOsNaLLtxRqbsfk4qo+/s0CALrnD0LGUyydkqwXGLnd/TwXA6oRsKE4xzQbwdFQ2IlMdoD4qK89LQ/eKTdmreqsEEEyBuc1F6pScsLtnSWRkOIawYyoyDzioO5Z5O6VN/nPX7JD1PxvYoyGbTM7Uj5RnmRz+50wHvDTbydvoCfBcnuvR
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB9PR08MB6524.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(346002)(39850400004)(376002)(396003)(136003)(366004)(36756003)(83380400001)(76116006)(6506007)(53546011)(478600001)(38100700002)(122000001)(66556008)(64756008)(66476007)(5660300002)(186003)(66946007)(54906003)(91956017)(26005)(66446008)(2616005)(33656002)(6486002)(110136005)(86362001)(6512007)(2906002)(316002)(4326008)(8936002)(8676002)(71200400001)(38070700005)(45980500001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: W6Y85h1VUQBUTRD6G1PjYIjKgwRoAd6gOYEJwa85kgGaG3Lp5lWqDPGO1E5X4BaKGvgFe3T3fbfPppbbyY/rSTMsRQRt2Pd1xoM7Z6ANgZHwUOZe4azHZIXHjhVZDLnt6g0zNpL8YfJvVxLheC7j931zEG32+v/ZezZ4dKvHHrKn9Gd+7LjFDUxlsmkPSpPoLxMzU57XQXr8HyxWVR6dWV+OQzr5QstM+lVlBBxMtJg/ePOAzl5brlSCXuBhYT2iEfoHMyLrjUAAhPARoOfbTOpgupT1vab0/CIAVT9sWfJepMzoiXgaGHBrEpUsmOaTXVG6/yTY2Wk3HbreMVLANKT7tsobJ+p0z/ltox6Gq1geahCti0h80YZH19Y1hEm60AJ5DNGpmrSADLhXQ95Py47dQ2Q0SVxSeKHs3tEImGcFRYeGHGERFWl002BmkgR0mSLys0Yfxza1JcUqbtR8MEwANEdwZ0Ji747ZFHfcqY49/OS59uY99j+VRvPtpEu95ND3vbeIdojxAEhuCsiVtDq8mUSREH+i40PqPWQ1LX22V1Wz/5RY/yjQwNw/GkBzFVvRCI4pnuhjOxhp5DXw4TGmmrLdqJ+4TBEI9E6nx67Vip1Nkg+tjpsjycmqjhJNGkhftUKDQw6H4WFKd7cXSduwsULrVInkremZIk5ct5AYfRAw3W9o/wLL3eQlfnQH9IGhtb0P+gJ8GjeEqM3GzRr+JKbk9mMrg6uUr//8O65haoUIMANyj6xXWWiGDYbGHBVsUx275m7JUjvb0MsX3dx+TJiisKQoqlP/Kqxap6Igfp23Vggnikl0ZCeqagJFnKwcRtpIyY2eR91XTb0DKFKRXts0UUMMzlkAWr8MevupKUZaREDXkIS8RUH5eq12E4oTFvWY5EO8aBDl69AB3847Lechmqk0k/7RwVI63mUERp7byQdfe23dDWWm5yv+quHr4rGnzYy7Qy06ERL8GGbR0zLgefeoFXpOKeavYAb2j3fmbSP9vVpteWZdAaMQEOPU5ZBiGyw+K6JOyRu7LAf+uVqal/L1bGvSdFELO8RzlEWtaC5qxpkhHwGODrxAOKtOWYs2stGbaY4zyJaV1cqPpPIlwB8VbiVBK5La3EPKnp4YK7twXmd8TjJvi0JNz0z0eg1lfPuzeyLjH8cZkMb3DAkQns1o/XQzLIcZzAZGiPR7pKgahqwkj2RCc4KV0K+hm0m7V7dY/ZZIZxtdGltyZnNNOU4oD72M1LT7yX4pzCRTu3srAZ2DTwRSpL9o76mufjqm8UH57Zmm7mVJL4QcZhfVBFKw0r7e9wLfI1dIcrHV8U96h3MWUZtAfuRgrfF29x6RMRm+NE1Nc2+pmw==
Content-Type: text/plain; charset="utf-8"
Content-ID: <13DB1BE9F5E0964FAE07B2B7FDB65713@eurprd08.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB1816
Original-Authentication-Results: sandelman.ca; dkim=none (message not signed) header.d=none; sandelman.ca; dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT027.eop-EUR03.prod.protection.outlook.com
X-MS-Office365-Filtering-Correlation-Id-Prvs: 8aeb5f18-0ca8-40b1-67a9-08d9526b246f
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: UTL37ab3cK0hPV8llLjqlOAQCshJlGl1GOdgMQPBWpBex29opza5s0+3MSZhhgaQ77J/zTm/w+BYepKe0lcJSaxJND4IbELeVF0/tjJSz5ulXh0ArnMj9afM2ECOoXA02xH23cICI49PsYskywXoWg/iPz5HYJnz8HxvsMYnTI+ur5vbyjy5+Fjuv+EcuoCKtCbs0LGUFi9ugNMTi/tzZdOyCW8UvgJvjMlSMhR9vkMbaTWlIvfLKT+4S5WGI5rs4axFDufLVHGwRAwDa4x7HenNTWV0ZiRD5p76VOktBvNezMzYfsgo49Vu6giagjF2yb3cBwREPlkhyg8wyplpkpHeHXKVURyahtm+d8TKdB3UteC76Tbr38KnCIg7UmQFoVvDLIv/h2FaUljdgMnAMxsaR0Evbwrd7bVrUH6hO0U9ApYceP0uAeWuW3y9bEK68b46NdhoBn1Ep2ZVreIH47r60chJpEgELsF1Fy/o0wY2+azXdo3C2pTzrkW+24D+H03Y5NXfxgKoUyXCEwTwMS1bezUyuF959g37aPDJXF220NPX+TQQQGs6+tj7RKcYuTjfbHYpRuIPWTXzASHZwfYrorhDnj5/wBBfY/BGk4NyH4EAM77TxZMUZQlYIt/eIIKzQky1xOekHWDRa9tFppwPryC4Oh8muHctnedBVTMAWQCs0hZ390845y+7ZXWX/fxYHSMvazU+vXHaKoCTpg==
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(396003)(346002)(39850400004)(136003)(376002)(46966006)(36840700001)(26005)(53546011)(6486002)(4326008)(70206006)(33656002)(2616005)(316002)(36756003)(110136005)(2906002)(336012)(36860700001)(478600001)(82310400003)(5660300002)(8676002)(6506007)(450100002)(186003)(82740400003)(6512007)(54906003)(356005)(47076005)(70586007)(83380400001)(81166007)(8936002)(86362001); DIR:OUT; SFP:1101;
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2021 08:30:45.7556 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 82695d66-8de9-4bfd-e61a-08d9526b2958
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-AuthSource: AM5EUR03FT027.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR08MB5607
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/J8pZ5oXfl8Q6i0eBJIAlfE59M9E>
Subject: Re: [Rats] freshness in the background check interaction model
X-BeenThere: rats@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Remote ATtestation procedureS <rats.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rats>, <mailto:rats-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rats/>
List-Post: <mailto:rats@ietf.org>
List-Help: <mailto:rats-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rats>, <mailto:rats-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Jul 2021 08:30:59 -0000
[assuming a threat model where RP and Attester do not collude, but either could be malicious.] On 29/07/2021, 02:42, Michael Richardson <mcr@sandelman.ca> wrote: > [...] > > Is it acceptable for a nonce to be created via TLS Exporter? yes, it seems infeasible to anyone (including a mitm) to manipulate the exporter output (and therefore the nonce) in any meaningful way. > Is it acceptable for the nonce to be known to the RP? yes, as long as the nonce is non-predictable -- and the construction that you described has that property -- it is immaterial that the RP "knows" the nonce (the nonce is a public parameter in the protocol). > Is it okay that the Verifier didn't get to insert entropy into the > nonce? yes, if we rule out colluding RP & Attester, the freshness guarantee is preserved even if the Verifier did not contribute to the computation of the nonce. my two cents, t IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
- [Rats] freshness in the background check interact… Michael Richardson
- Re: [Rats] freshness in the background check inte… Thomas Fossati
- Re: [Rats] freshness in the background check inte… Dave Thaler