Re: [Rats] Attestation Terminology

Hi Henk,

as you can imagine, I am confused. You are saying that the RATS group couldn't agree on a term for "attestation" in the architecture document. But now the term is defined in another RATS document, namely <ietf-rats-tpm-based-network-device-attest>.
Is that because you finally found an agreement or just because nobody in the group wasn't paying attention?

Regarding key attestation: IMHO it is what we are providing with draft-ietf-lamps-csr-attestation where Evidence includes information about the private key being stored in a hardware security module. I don't have a good definition of the term myself and hence I was wondering whether there is some established terminology in TCG or elsewhere already. It cannot be the first time that this issue arises.

Ciao
Hannes

-----Ursprüngliche Nachricht-----
Von: RATS <rats-bounces@ietf.org> Im Auftrag von Henk Birkholz
Gesendet: Dienstag, 19. September 2023 13:59
An: hannes.tschofenig@gmx.net; rats@ietf.org
Betreff: Re: [Rats] Attestation Terminology

Hi Hannes,

w.r.t.: `attestation`

there is no satisfying answer to your question, I afraid. The RATS architecture was explicitly and carefully worded to avoid the word `attestation` as a stand alone term. As it causes confusion in the context of "activity vs. message" and is horribly overloaded, in general:

> https://csrc/
> .nist.gov%2Fglossary%2Fterm%2Fattestation&data=05%7C01%7Channes.tschof
> enig%40siemens.com%7C04d90290edb94ff2833508dbb907da4c%7C38ae3bcd95794f
> d4addab42e1495d55a%7C1%7C0%7C638307215597987825%7CUnknown%7CTWFpbGZsb3
> d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7
> C3000%7C%7C%7C&sdata=wUKkQ85T%2BEDnoE2e7CENvC%2FGBvZLlCz8WtSdv%2F%2F%2
> FQ2Q%3D&reserved=0

(here NIST captures the confusion in a nutshell)

That is why RATS is about _remote attestation_, and corresponding activities, such as Evidence Generation, Conveyance, Appraisal, etc.

w.r.t.: `key attestation`

The RATS WG has not defined the more narrow term "key attestation"
today. As Denis pointed out, "OpenID for Verifiable Credential Issuance"
does, for example. Looking at that definition there are two essential
components:

1.) "a certificate including a certificate chain asserting that a particular key is managed, for example, by a hardware security module"

2.) "provide this data along with the proof of possession in the Credential Request"

In RATS (IETF/TCG) words, I think, openid is defining `key attestation` as as an Endorsement (according to 1.) of key material that is then combined with a PoP (according to 2.). That is not the same thing as remote attestation, as there is no Evidence about the trustworthiness of the Attester generated.

I am not entirely sure how useful it would be for the RATS WG to specify
  yet another meaning of the term `key attestation`. What I would see as useful in any case, however, would be writing up a definition (independent of any name). Maybe something along the lines of "Evidence about an endorsed key storage that is augmented with a PoP of a stored key" or something to that effect.

But that probably just reflects my half-baked understanding of "RATS key attestation"... what would you think `key attestation` means in the context of RATS, Hannes?

Viele Grüße,

Henk

On 19.09.23 09:24, hannes.tschofenig@gmx.net wrote:
> Hi all,
>
> I am wondering why the group has not defined the term "attestation" in
> the RATS architecture RFC. Instead, it is defined in a solution
> document <ietf-rats-tpm-based-network-device-attest> where nobody finds it.
>
> Ciao
> Hannes
>
> PS: Where is the term "key attestation" defined?
>
>
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www/.
> ietf.org%2Fmailman%2Flistinfo%2Frats&data=05%7C01%7Channes.tschofenig%
> 40siemens.com%7C04d90290edb94ff2833508dbb907da4c%7C38ae3bcd95794fd4add
> ab42e1495d55a%7C1%7C0%7C638307215597987825%7CUnknown%7CTWFpbGZsb3d8eyJ
> WIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000
> %7C%7C%7C&sdata=eCDY%2F9fUK5Jo1UHtMPf6qz3pJWAwyk8xu0qTEkm6288%3D&reser
> ved=0

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats