Re: [Rats] Attestation Terminology

[Henk Birkholz <[e-mail]>]

Hi Hannes,

no, I do not think there was ever a list discussion on the term. Maybe I 
missed that. It might be useful to restate the whole definition from 
https://www.ietf.org/archive/id/draft-ietf-rats-tpm-based-network-device-attest-14.html 
here:

> Attestation: the process of generating, conveying and appraising claims, backed by evidence, about device trustworthiness characteristics, including supply chain trust, identity, device provenance, software configuration, device composition, compliance to test suites, functional and assurance evaluations, etc.

The definition follows the context of NIST's 1st definition of 
`Attestation` as it describes an activity and the definition does unify 
IETF and TCG ("TPM/DICE/MARS") terminology.

In general, there was a lot of avoidance to become specific wrt to terms 
such as `Root of Trust` or `Attestation` in the scope of the 
architecture RFC. I am okay with becoming more specific in the RATS 
context, but that seems to be a strategy change to me and should become 
(maybe a lightweight) discussion here on the list. I doubt this is the 
first time this comes up, but taking into account the hesitance of key 
stakeholder in remote attestation to define such terms to rigidly, I 
would not be surprised if there is no referencable definition still.


Viele Grüße,

Henk

On 20.09.23 11:00, Tschofenig, Hannes wrote:
> Hi Henk,
> 
> as you can imagine, I am confused. You are saying that the RATS group couldn't agree on a term for "attestation" in the architecture document. But now the term is defined in another RATS document, namely <ietf-rats-tpm-based-network-device-attest>.
> Is that because you finally found an agreement or just because nobody in the group wasn't paying attention?
> 
> Regarding key attestation: IMHO it is what we are providing with draft-ietf-lamps-csr-attestation where Evidence includes information about the private key being stored in a hardware security module. I don't have a good definition of the term myself and hence I was wondering whether there is some established terminology in TCG or elsewhere already. It cannot be the first time that this issue arises.
> 
> Ciao
> Hannes
> 
> -----Ursprüngliche Nachricht-----
> Von: RATS <[e-mail]> Im Auftrag von Henk Birkholz
> Gesendet: Dienstag, 19. September 2023 13:59
> An: [e-mail]; [e-mail]
> Betreff: Re: [Rats] Attestation Terminology
> 
> Hi Hannes,
> 
> w.r.t.: `attestation`
> 
> there is no satisfying answer to your question, I afraid. The RATS architecture was explicitly and carefully worded to avoid the word `attestation` as a stand alone term. As it causes confusion in the context of "activity vs. message" and is horribly overloaded, in general:
> 
>> https://csrc/
>> .nist.gov%2Fglossary%2Fterm%2Fattestation&data=05%7C01%7Channes.tschof
>> enig%40siemens.com%7C04d90290edb94ff2833508dbb907da4c%7C38ae3bcd95794f
>> d4addab42e1495d55a%7C1%7C0%7C638307215597987825%7CUnknown%7CTWFpbGZsb3
>> d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7
>> C3000%7C%7C%7C&sdata=wUKkQ85T%2BEDnoE2e7CENvC%2FGBvZLlCz8WtSdv%2F%2F%2
>> FQ2Q%3D&reserved=0
> 
> (here NIST captures the confusion in a nutshell)
> 
> That is why RATS is about _remote attestation_, and corresponding activities, such as Evidence Generation, Conveyance, Appraisal, etc.
> 
> w.r.t.: `key attestation`
> 
> The RATS WG has not defined the more narrow term "key attestation"
> today. As Denis pointed out, "OpenID for Verifiable Credential Issuance"
> does, for example. Looking at that definition there are two essential
> components:
> 
> 1.) "a certificate including a certificate chain asserting that a particular key is managed, for example, by a hardware security module"
> 
> 2.) "provide this data along with the proof of possession in the Credential Request"
> 
> In RATS (IETF/TCG) words, I think, openid is defining `key attestation` as as an Endorsement (according to 1.) of key material that is then combined with a PoP (according to 2.). That is not the same thing as remote attestation, as there is no Evidence about the trustworthiness of the Attester generated.
> 
> I am not entirely sure how useful it would be for the RATS WG to specify
>    yet another meaning of the term `key attestation`. What I would see as useful in any case, however, would be writing up a definition (independent of any name). Maybe something along the lines of "Evidence about an endorsed key storage that is augmented with a PoP of a stored key" or something to that effect.
> 
> But that probably just reflects my half-baked understanding of "RATS key attestation"... what would you think `key attestation` means in the context of RATS, Hannes?
> 
> 
> Viele Grüße,
> 
> Henk
> 
> On 19.09.23 09:24, [e-mail] wrote:
>> Hi all,
>>
>> I am wondering why the group has not defined the term "attestation" in
>> the RATS architecture RFC. Instead, it is defined in a solution
>> document <ietf-rats-tpm-based-network-device-attest> where nobody finds it.
>>
>> Ciao
>> Hannes
>>
>> PS: Where is the term "key attestation" defined?
>>
>>
>> _______________________________________________
>> RATS mailing list
>> [e-mail]
>> https://www/.
>> ietf.org%2Fmailman%2Flistinfo%2Frats&data=05%7C01%7Channes.tschofenig%
>> 40siemens.com%7C04d90290edb94ff2833508dbb907da4c%7C38ae3bcd95794fd4add
>> ab42e1495d55a%7C1%7C0%7C638307215597987825%7CUnknown%7CTWFpbGZsb3d8eyJ
>> WIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000
>> %7C%7C%7C&sdata=eCDY%2F9fUK5Jo1UHtMPf6qz3pJWAwyk8xu0qTEkm6288%3D&reser
>> ved=0
> 
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats