[Rats] Re: Clarifications in draft-ietf-rats-eat

[Laurence Lundblade <[e-mail]>]

Hi Usama,

> On Apr 10, 2025, at 2:11 AM, Muhammad Usama Sardar <[e-mail]> wrote:
> 
> Dear editors,
> 
> I would like the second paragraph of introduction to be more precise, because it contains some unjustified statements, such as:
> For attestation, the keys are
>    associated with specific devices and are configured by device
>    manufacturers.
> 
> I did some research on this and found that it is not always correct. The device manufacturer may also inject a seed based on which the attestation key would be derived. And this key derivation involves additional factors, such as platform TCB as well as platform OWNER_EPOCH value in case of Intel SGX.
> 
The text in EAT is intended to be very general to allow all sorts of means of establishing attestation key material including what you have described. I don’t see a problem personally. I think  trying to specify all the ways attestation keys can be set up would be a “rat hole” as they say.

> Also, we had some discussion about attester-generated nonce for single Attesting Environment, which I don't find addressed yet in [1]. Please let me know if I missed something.
> 
Similarly, the text about freshness and nonces is intended to be open-ended and allow lots of different approaches.

We are at the very end of work on RFC 9711. We can still change it, but there would have to be a really strong consensus or an egregious problem. Last call was about two years ago.

LL