Re: [Rats] EAT claims needed by TEEP

[Michael Richardson <[e-mail]>]

I'm reviewing the pull request at:
   https://github.com/ietf-rats-wg/eat/pull/139/files

About the hardware-class-claim.

  "There is no global scheme or format for this claim."

So I wonder how TEEP's flow will deal with this.
Forgive me if that's buried in TEEP somewhere.
If so, I think that the EAT document should perhaps refer to that informatively.

I can see how the verifier can be okay with lack of scheme: the signing key on the
evidence can index into a database of devices, and then it's a string
comparison to see if the device claimed correctly.

But, equally well, the verifier already knows, via that database, what the
value is.  The only utility I can see if that the RP is going to see this in
the Attestation Results and use it to decide what binary to ask the TAM to
load.

I'm concerned that any hardware vendor can put any value in this.
The Verifier, provided by the hardware OEM, agrees.
The only thing the RP can do is the rely on it's contract with the Verifier.
That's actually the thing the RP ever does, I think: so don't mistake me.
What I'm asking is, given that, is this claim even needed as evidence?
Maybe it's only useful as Attestation Results.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide