Re: [Rats] Age Claim in EAT

Hannes Tschofenig <Hannes.Tschofenig@arm.com> Thu, 30 July 2020 08:28 UTC

Return-Path: <Hannes.Tschofenig@arm.com>
X-Original-To: rats@ietfa.amsl.com
Delivered-To: rats@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 258323A1006 for <rats@ietfa.amsl.com>; Thu, 30 Jul 2020 01:28:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=Oa8CwDbp; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=Oa8CwDbp
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L1D7wWnFDK-W for <rats@ietfa.amsl.com>; Thu, 30 Jul 2020 01:28:46 -0700 (PDT)
Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10054.outbound.protection.outlook.com [40.107.1.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 638333A0FB1 for <rats@ietf.org>; Thu, 30 Jul 2020 01:28:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uYNeS45p5qaBzkNuTZx2iaaQMZXFhsxEcJooptb0oic=; b=Oa8CwDbpZmeJUD1kyuiRM23oEbKnK10y0H3IKY4qfeOeUdxk/l9Uu682mA+nQKEEH/JvZphNEfuYIMhiCoih0RvURwfnpEOjiPNT6S4fkO5L2Q72ggVhIx25+d8/U7C2qU7Bc5VcI4/SRNM7H6+29SxygpwOuHjAtM45Zi965P8=
Received: from AM5PR0601CA0076.eurprd06.prod.outlook.com (2603:10a6:206::41) by AM4PR0802MB2228.eurprd08.prod.outlook.com (2603:10a6:200:66::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.22; Thu, 30 Jul 2020 08:28:42 +0000
Received: from AM5EUR03FT045.eop-EUR03.prod.protection.outlook.com (2603:10a6:206:0:cafe::50) by AM5PR0601CA0076.outlook.office365.com (2603:10a6:206::41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3239.18 via Frontend Transport; Thu, 30 Jul 2020 08:28:42 +0000
X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT045.mail.protection.outlook.com (10.152.17.105) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3239.17 via Frontend Transport; Thu, 30 Jul 2020 08:28:42 +0000
Received: ("Tessian outbound 1dc58800d5dd:v62"); Thu, 30 Jul 2020 08:28:42 +0000
X-CR-MTA-TID: 64aa7808
Received: from 894c5da1c632.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 6611871B-2171-44F0-BCAE-6381E1213F52.1; Thu, 30 Jul 2020 08:28:37 +0000
Received: from EUR03-VE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 894c5da1c632.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 30 Jul 2020 08:28:37 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nXeHniqE6Lr/aKR1C5p/CYcpXqWFwTVgJqTUUGQZqc5blhlGNnWk87L/Q+C2vNHHbqu/vpXOVcj7YzQwXGPNSubMX3TAOr+I5ZEPDRDcJZSqueV45wLkg836offM5ruZ4hSJW9ASvopK5U54F2pGzOe3rjTGhIZ5LMcNyopjWJmZnlMTi3NVmLV4pa0/PxtcHv0jVUVh03AvSbfkJiX9I8T7dMVyi1gWsprySnUYpiW5zKRgT6/cMZFA6bGgnJESQs9pFa4uT0Z/AMB2b2DZo2diwqXg/7jByEH6ilPbFWDode7LVRLibDlMSRM5uLVynRq6ETAFmFxldYEV3/ijIA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uYNeS45p5qaBzkNuTZx2iaaQMZXFhsxEcJooptb0oic=; b=R0wJgAki8ifJsJ1GGyFPWhnXAovOdnmLqR5hq5focNhwKVLztY6qot4XFnxP/QfyYesSL2vxI+kpThUk44E5hC7zoFcAJswnQ0JojfLz2SCQ9pb26WcvvFiOjx0grbzHJ/ZK2fa1acD2UJN3qx586U8DjHm7OjglvTk6PQqhZwVYAw02StxbCgwg2clFuazmwF8Jt7mkD7yh3waXjA32ao3fCU+nhU/klXX2pOTwP7BtBRHH22LXYDXauT9PN8wkW1TEauv5Hjy/yqtEi4Rlww/tHfgzGoR/TpOQgNdC9bDMEEpEiTaQszdJEjCCfNgvai4QXZ3Ro3Nb603XIjJdLQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uYNeS45p5qaBzkNuTZx2iaaQMZXFhsxEcJooptb0oic=; b=Oa8CwDbpZmeJUD1kyuiRM23oEbKnK10y0H3IKY4qfeOeUdxk/l9Uu682mA+nQKEEH/JvZphNEfuYIMhiCoih0RvURwfnpEOjiPNT6S4fkO5L2Q72ggVhIx25+d8/U7C2qU7Bc5VcI4/SRNM7H6+29SxygpwOuHjAtM45Zi965P8=
Received: from AM0PR08MB3716.eurprd08.prod.outlook.com (2603:10a6:208:106::13) by AM0PR08MB3457.eurprd08.prod.outlook.com (2603:10a6:208:d7::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3239.17; Thu, 30 Jul 2020 08:28:35 +0000
Received: from AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::5d9e:7abf:79ac:95e3]) by AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::5d9e:7abf:79ac:95e3%5]) with mapi id 15.20.3216.034; Thu, 30 Jul 2020 08:28:35 +0000
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
To: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>, "rats@ietf.org" <rats@ietf.org>
Thread-Topic: [Rats] Age Claim in EAT
Thread-Index: AQHWZYg/C8vSkhifRkqcOCJniMcKaqkfyxgQ
Date: Thu, 30 Jul 2020 08:28:35 +0000
Message-ID: <AM0PR08MB371603337AFE742BF5564906FA710@AM0PR08MB3716.eurprd08.prod.outlook.com>
References: <AM0PR08MB371633B5B66CCC34BD38DB4BFA700@AM0PR08MB3716.eurprd08.prod.outlook.com> <b467f730-5000-0aad-9c2c-3bd3d92321e5@sit.fraunhofer.de>
In-Reply-To: <b467f730-5000-0aad-9c2c-3bd3d92321e5@sit.fraunhofer.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ts-tracking-id: edd1b0bb-55e3-488a-a6a2-ef0e383203d4.0
x-checkrecipientchecked: true
Authentication-Results-Original: sit.fraunhofer.de; dkim=none (message not signed) header.d=none;sit.fraunhofer.de; dmarc=none action=none header.from=arm.com;
x-originating-ip: [213.162.72.158]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: 4c60e7d0-a5ad-4439-cf37-08d834629173
x-ms-traffictypediagnostic: AM0PR08MB3457:|AM4PR0802MB2228:
X-Microsoft-Antispam-PRVS: <AM4PR0802MB22287E531B8AA40D23F3ABE9FA710@AM4PR0802MB2228.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:9508;OLM:9508;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: YUlzs5BMwfu6OmJSewW5pFPQGTrrYrJpaZljDSmSxdST9CWyYcGM8IoCHxd57bXsQfLJ/WWbhXllrrZI0LgWz0gai4y8BwS8suiehWz389kGUy8ma9IG3RAklxJ1jSPUgdPVQhtzguC466MYTOWlZSKXVQcSKlrz+H4rUsmVwI0XC5MDj3GwWZz/m+60Pn5tXilcRHAA/wI52Lc++kYoxY2QMq9p3lj6RtdoUhJg5woBIwTM7FTQab8focw/PpK6Y2LJRiJ2mjQjiydebXL9Zuf2wY7p1+sEcadgLzcxI5ZW8QGRdWnMHjpckobExHLe3HMxXFuhEtSTOxLffL2OupKUH7nOR74Gs4VtG3WJIjqsgH3t0/YVfJKA4qX76piPo7JtzwfCW+rdOXNdoN4Azg==
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB3716.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(376002)(39860400002)(396003)(366004)(346002)(316002)(33656002)(55016002)(26005)(5660300002)(71200400001)(186003)(86362001)(8676002)(52536014)(83380400001)(66446008)(64756008)(66556008)(66476007)(2906002)(110136005)(966005)(478600001)(76116006)(7696005)(53546011)(9686003)(8936002)(6506007)(66946007); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: FuskU/0M2YV6Sx8sfo9sUgSiaVhEZ9lDRsNWIft7503W91KlBcmhxkMcNK6o4DPii0D53QKB1WBE1LiZ3As0SwjjVKM3sSh75PApb/s4LTm7/kwwO8PIf3hPqYvnQL0KYES8m9UQN/h/hpkjDiZjPTO8OJa7n6lXhc95WNtx60+CzG71PeMYwz2Oaq951dYyo966z5KLPkyS7gYK8/y+IQI9zjh53wcPTAqfUw2Qo8prVX+EU4/CF5P2T0biySEFnJJVzMYX0393MD/ZLfFJiX5mm7oMdubP+i0tw3ZeMvHNCzP/coKOqNfGRB8gY7n10sgEsVUx357t9sJUVeVGfw3Nk6D4v5A/6jgpsPloMhU37F/LQtQhGmSBOzi+pvzQIebnP4wMr7WqnImBHPmzfh9HLIs3q4cGA6PUvYJ3urXBjP7f2/x/k2Z29BHyYByRC1EVbpeWqlIv6y4ywJ5hYG6MzGf7Ii+IwTEdqffwRq9qshPXRqVUUDRdd0GzI7SWyvbkYeLH4vgERO4EA7glN1jKIHi4IZKV+dvKjyBFXQKAV7VWiM2IzBGRe86HQXk+utrQh2iDqarhG0iilS3dy3bXZMBji1Q7/gC+HbKPqJ8nMhdk4XFkFmI3Yg3NLVnzxseww29Dco2quvzjCWzKxw==
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3457
Original-Authentication-Results: sit.fraunhofer.de; dkim=none (message not signed) header.d=none;sit.fraunhofer.de; dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT045.eop-EUR03.prod.protection.outlook.com
X-MS-Office365-Filtering-Correlation-Id-Prvs: c8b68b44-0fc7-4f83-8c1c-08d834628d4f
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: JxYm/h8VskLG9rt9QDXRNXXlg6Dz/ILJCdEjkqi9AYCmtpWa7qRG6V7VFOPqwWc7PgmioZ5REbJSWKkL71b7rXoEa+efr6lRmvQNkGtkmRKUmMyRWfSrTK0BgR9cDSfjMwkBnJv04M/wa9b8GuqmWPS0e1rZvvn9rz8nK1jF7tMn+FDL1PBc/pViClxKiZjQ7uBu/ojRBLsHvmzc1r4JK66d2NrCVt1YVGC6mvPFlbrHEeddbH1uB000g+iO6D3/suwMh6D2aqsQinxe2YaC5dWrONMtqZuLcjrGDhZP6EXvyEf4WFEh7o2QCgfFfdCT9BcWPhiYljv7d8Dr9ujxSHNYw0kMFyzPoBmMvBiJKFGTPW5XEQ+bocK1zAeDuhH99NHIl6SRbOL3QIR/AfnGaChJFatq/Ci2g4cdH05ydKQRiDsViYbTJUaH0XZ/JL0gFokVynJs4B4oHr1+cnPYR8stRSSJ/rj3fja/Mmempkg=
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(4636009)(136003)(346002)(396003)(376002)(39860400002)(46966005)(82310400002)(86362001)(52536014)(2906002)(9686003)(186003)(55016002)(70206006)(26005)(70586007)(81166007)(8936002)(110136005)(356005)(5660300002)(8676002)(36906005)(6506007)(478600001)(966005)(53546011)(336012)(33656002)(82740400003)(83380400001)(47076004)(316002)(7696005); DIR:OUT; SFP:1101;
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Jul 2020 08:28:42.4111 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 4c60e7d0-a5ad-4439-cf37-08d834629173
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-AuthSource: AM5EUR03FT045.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0802MB2228
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/aMnChWIsLXhgvRQ7a-5UhPTiUic>
Subject: Re: [Rats] Age Claim in EAT
X-BeenThere: rats@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Remote ATtestation procedureS <rats.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rats>, <mailto:rats-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rats/>
List-Post: <mailto:rats@ietf.org>
List-Help: <mailto:rats-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rats>, <mailto:rats-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Jul 2020 08:28:59 -0000

Thanks for the clarification, Henk.

Since I don't know what information consumers of Entity Attestation Tokens really need to make decisions I am not sure whether the current functionality is sufficient already or not. To me as a reader it appears underspecified.  At a minimum a reference to Appendix A of the RATS architecture document in the EAT spec would be useful.

Ciao
Hannes

-----Original Message-----
From: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>
Sent: Wednesday, July 29, 2020 11:11 AM
To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>om>; rats@ietf.org
Subject: Re: [Rats] Age Claim in EAT

Hi Hannes,

in the scope of Evidence:

Signing a CWT structure is creating an EAT. This event is defined as
time(EG) here:
https://tools.ietf.org/html/draft-ietf-rats-architecture-05#appendix-A

"Creating a token" would mean "Evidence Generation", for example.

Age also is a time interval based on a time unit (units that apply to Henk are years, I claim that Henk's age is 21, of course. Trust in Henk's Claims can be established via Endorsements). Age is a time interval expressed as a duration. That means that the beginning of that time interval is set as zero (an epoch) and then counts the time units.

The semantics of age in EAT are:

the epoch is time(EG) and the unit is seconds.
This only works, if time sources for relative time-counters are available, of course.

Collection of Claims - time(CC) was proposed to the architecture, but did not find consensus yet (we are working on time(AA), though, the time at which the Attester becomes aware of a changes value in the Target Environment right now).

But! there is time(VG), the Value Generation. This time can often only be inferred or approximated (in contrast to time(AA)), but it is the best we have defined right now in the context of:

> If that's the case, I wonder whether it would also make sense to take into account that different information may be collected at a different point in time and hence the age indication would better go (somehow) with specific claims where the time difference between the collection of the data and the signature generation matters.

As a note: We have not talked at all before about the common concept of "latches" or stage transitions... this is an important concept that does capture the "this event has happened" (before/after a defined event) and represents strong security implications that are not included in the RATS architecture today. Would that maybe help in your context?

Viele Grüße,

Henk


On 29.07.20 10:37, Hannes Tschofenig wrote:
> Hi Laurence, Hi all,
>
> How does the age claim work?
>
> The spec says "represents the number of seconds that have elapsed since the token was created".
>
> By creating a token you also protect the claims with a signature and hence you cannot change the content of the claims anymore (without breaking the signature).
>
> Hence, here "creating a token" must mean something different. I suspect it means when certain values have been collected from the device and before the token with the signature was put together. Correct?
>
> If that's the case, I wonder whether it would also make sense to take into account that different information may be collected at a different point in time and hence the age indication would better go (somehow) with specific claims where the time difference between the collection of the data and the signature generation matters. I also wonder whether the number of seconds matter and whether you really want to communicate something more abstract, such as "I created a hash over the firmware during boot time" rather than "I created the hash over the firmware in real-time when I was asked".
>
> Ciao
> Hannes
>
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
>
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats
>
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.