Re: [Rats] About (E)UID's

[Henk Birkholz <[e-mail]>]

The security of the RATS architecture does not rely on a single claim. 
It relies in trust anchors that you can put trust into in order to 
believe a certification path and therefore attestation provenance, it 
also relies an Endorsements provided by potential several Supply Chain 
entities.

A single UEID claim that could encounter a collision (maliciously 
intended or by accident) will not necessarily compromise a complete 
instance of a remote attestation procedures. If your Claim set and 
corresponding secret/shielded key material are sparse, this reduces the 
believability of the corresponding evidence and therefore lower the 
level of assurance/security of that implemented RATS architecture.

But that is an implementation choice. The architecture offers suitable 
set of secure methods. If base all you post-process decision, than that 
is a choice and should be aware of the risk involved for not using any 
other secure methods.

Viele Grüße,

Henk

On 12.02.20 10:49, Salz, Rich wrote:
> I am still concerned about what fails if someone re-uses an EUID, either 
> by accident or maliciously.  If the security of the RATS architecture 
> depends on uniqueness, this seems important.
> 
> 
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats
>