[Rats] PKIX Attestation design team meeting notes 2024-02-26

[Mike Ounsworth <[e-mail]>]

As always, full notes are on github:

 

https://github.com/lamps-wg/csr-attestation/blob/main/meetingNotes/2024-26-0
2.md

 

 

Discussions

LAMPS > csr-attestation

 

Monty and Hannes' Examples PRs are ready for merging (except for formatting
or merge conflicts). MikeO to do this before the 119 submission cutoff
deadline on Mar 4.

 

 

RATS > x509-evidence

 

JP from Crypto4A presented the Crypto4A Attestation format for the group.

 

I think this is a good time to reflect that the CSR work has dominated this
design group so far, and the Evidence Format work has happened very
piecewise and disjointedly. We should re-evaluate the design goal and scope
to decide how big an ocean we are trying to boil. Perhaps we should be
trying to reduce the set of claims to the bare minimum
mandatory-to-implement claims (each represented by an OID) that a public CA
needs, and then allow for extension with future standards or proprietary
claims. Perhaps X.509, while common for carrying Attestations, is not the
most elegant format, and a new outer ASN.1 structure should be used. We
should also think about nesting-vs-flattening of platform attestations,
multple key attestations, and potentially attestations of other types of HSM
objects. Going into IETF 119, this is a good opportunity to review the C4A
document, and restructure the proposal here.

 

 

- - -


Mike Ounsworth

Software Security Architect

(pronouns: he/him)