[Rats] Standardizing TPM output in attestation evidence

[Laurence Lundblade <[e-mail]>]

There has been a side discussion about TPMs and EAT. This is to bring it to the main RATS list and to state more clearly the use case I have in mind.

The devices I’m thinking of are roughly this:
 - Desktops, servers, IoT devices… (not network equipment, probably not mobile phones)
 - They have an off-the-shelf TPM2 soldered on to their PCB
 - Likely to be Intel CPUs, but not necessarily

We want these devices to do attestation and generate attestation evidence (all devices on the Internet should do attestation at some point!). We want that attestation evidence to include measurements taken by the TPM. We also want attestation evidence from parts of the device other than the TPM.

That’s the very general use case I have in mind very simply stated.

Assuming this use case makes sense, then how should this get standardized and implemented?

There is protocol standardization in YANG now for TPM output, but I don’t think we want to use YANG for this. I don’t think YANG is in common use for these types of devices and has a particular interaction model. I think EAT is a good candidate because it is an independently secured blob that can be carried by the protocols already in use with these devices.

This then requires that some output from the TPM be put into an EAT. It seems useful to standardize that here in RATS and it seems in scope for the charter.

I don’t have a strong opinion or detailed proposal for what TPM output goes into the EAT or the particular HW, SW and attestation architecture of the device. That’s something we can work out. I am pretty sure the device would have two attesters in a compound/layered arrangement. The attestation evidence produced by the TPM would be nested in the attestation evidence produced by the EAT attester.

I have some leaning towards putting this work in the EAT document, but it could also be in another document.

I think this is important for RATS because of the very strong association of TPMs with good attestation and for the goal to support attestation for all kinds of devices and environments (not just network equipment).


A few things this is not about:

- This is not about changing the format that a TPM2 outputs. This is about the ability to use the off-the-shelf TPMs that are manufactured by the millions and sitting in warehouses today.

- This is not about local device boot architecture. This is about remote attestation, about attestation evidence transmitted to the verifier/relying party.

LL