Subject: [Rats] Re: qualifying "confidential computing" (was: Re: Re: Threat model and properties for remote attestation)
From: Michael Richardson <[email-masked]>
To: Henri Sirkkavaara <[email-masked]>, rats <[email-masked]>
Date: Wed, 19 Aug 2026 11:57:09 -0400
List-Id: Remote ATtestation procedureS <rats.ietf.org>

Henri Sirkkavaara <[email-masked]> wrote:
    > On privacy, the record does not carry evidence. It carries a
    > digest. evidenceRef.digest pins the normalized evidence and the
    > envelope commits to it under signature, so whether anything identifying
    > exists in the artifact is an operator decision about what goes into the
    > evidence in the first place. The format does not require identifying
    > material and a careless deployment can still put it there.

What is this envelope?
This sounds a bit like SD-CWT?
I'm unclear if there is any integrity for these measurements.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

**       My working hours and your working hours may be different.         **
** Please do not feel obligated to reply outside your normal working hours **