Re: [Rats] draft-ietf-rats-yang-tpm-charra tpm2_quote response and TPMS_QUOTE_INFO

[Michael Eckel <[e-mail]>]

Hi Philippe,

Thank you for pointing this out. We agree that this is a technical error 
to be fixed and will take care of it while the I-D is still stuck in 
C455, if possible.

Thanks,
Henk and Michael

Fraunhofer SIT
*Michael Eckel*
Deputy Head of Department | Cybersecurity Researcher
🏭 Cyber-physical Systems Security & Automotive Security
📧 [e-mail]
🕿 [phone] <tel:[phone]>

🏢 Fraunhofer Institute for Secure Information Technology SIT
🏠 Rheinstraße 75, 64295 Darmstadt, Germany
🌍 sit.fraunhofer.de <https://sit.fraunhofer.de/>

Member of ATHENE <https://www.athene-center.de/>

On 07.02.24 17:10, Philippe Bergeon (Nokia) wrote:
>
> Hello,
>
> Draft-ietf-rats-yang-tpm-charra-21 section 2.1.1.3.2 defines 
> tpm20-attestation-response to include among other things a) 
> TPMS_QUOTE_INFO and b) quote-signature.
>
> However, the output of the tpm2_quote command is TPM2B_ATTEST + 
> signature instead of TPMS_QUOTE_INFO + signature.
>
> The output of the tpm2_quote command is described in Trusted Platform 
> Module Library Part 3: Commands 
> <https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_pub.pdf> 
> section 18.4, with section 18.4.2 describing the request and response 
> content for tpm2_quote with the response including:
> - quoted TPM2B_ATTEST: the quoted information
>
> - signature TPMT_SIGNATURE: the signature over quoted
>
> The details of TPM2B_ATTEST can be found in Trusted Platform Module 
> Library Part 2: Structures 
> <https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part2_Structures_pub.pdf>: 
> TPM2B_ATTEST is a sized buffer that contains attestationData which is 
> TPMS_ATTEST:
>
> TPMS_QUOTE_INFO is eventually contained within this data but it is not 
> what is signed, see TPMS_ATTEST and TPMU_ATTEST.
>
> If you agree with this remark, it would be best to rename the leaf in 
> tpm20-attestation-response Yang so it is not mislead for a different 
> information, it could be called quote or quoted just like in the TCG 
> specs for instance pointing back to the TCG specifications as to what 
> information this actually is.
>
> Thx
> Philippe
>
>
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats