[Rats] More claims? When is EAT done?

[Laurence Lundblade <[e-mail]>]

One of my requested topics for Singapore is that of which new claims we should add to the current EAT draft and which ones should be left for subsequent work. This list here is a bit rough, but I wanted to get it in front of everyone sooner rather than later for some think / discussion time before meeting.

SW Inventory
This claim / set of claims would list SW installed on the device. It would probably include:
Name
Version
Checksum
Who signed it
This seems important for a lot of use cases including routers and IoT. It is important in RIV.
This seems like a relatively complex topic.

Measurements and Integrity Checks
The claims here could either be measurements that need to be checked or the result of a measurement after comparison with k-g-v. Note that systems like TIMA check against k-g-v on the device. So claims might look like:
Name
Measurement value
Measurement result (likely a Boolean)
Timestamp
This seems important for use cases including routers and mobile phones. It shows up in RIV.
This seems like a relatively complex topic.

Public Key
The claim would be a public key and its characteristics. Something like this:
The public key
How it is protected (TEE, secure element…)
User verification required to use it
Other key use and ownership characteristics (Android key store has implemented many of these)
This seems important for the mobile app world, particularly that this is supported by Android now. FIDO and WeChat pay have options to use the Android Keystore. This also seems important for IoT on boarding, particularly establishing a certificate for use with DTLS.

Attestation Result
An attestation result can be expressed as an EAT. For example a TPM / YANG interaction between the device and verifier might happen. The verifier outputs the result in EAT format. This is also likely where implicit claims are made explicit for the relying party. Interesting claims here might be:
Origination (an existing claim)
Certifications received
All other existing claims

While new claims can be added anytime through the IANA registry, I’d like to see the EAT document have a very solid set of well thought out core claims. My inclination is to do the work on all of these, even if it takes longer to get EAT done.

LL