[Rats] Re: [lamps] Re: Hint Discussion in CSR Attestation Draft

[Thomas Fossati <[e-mail]>]

hi Carl,

On Thu, 27 Jun 2024 at 11:45, Carl Wallace <[e-mail]> wrote:
> On 6/24/24, 11:28 AM, "Thomas Fossati" <[e-mail] <mailto:[e-mail]>> wrote:
> On Mon, 24 Jun 2024 at 17:17, Carl Wallace <[e-mail] <mailto:[e-mail]>> wrote:
> >
> > The below was posted to LAMPS but I had missed the introduction of the "hint" notion to the msg-wrap spec and upon a brief review of the latest draft do not understand section 3.3.1, which was introduced in the recent -05 draft, so I replied to RATS. What is this paragraph trying to say?
> >
> > "A CMW Collection's tree structure is not required to be a spanning tree of the system's composite Attester topology. If a label changes Verifier state beyond a "hint" (e.g., for better Verifier performance or human comprehension), we say that it carries semantic content. When a label carries semantic content that is not bound to other forms of evidence contained in the collection, the collection SHOULD be signed by an attestation key, e.g., by including the collection in a signed EAT [I-D.ietf-rats-eat]."
>
> The PR that introduced Section 3.3.1 [1] has some extra context in its
> description that may help understanding Dionna's thinking.
>
> [1] https://github.com/ietf-rats-wg/draft-ietf-rats-msg-wrap/pull/78 <https://github.com/ietf-rats-wg/draft-ietf-rats-msg-wrap/pull/78>
>
> [CW] I read the PR but can't say that it helps much. The phrase "If a label changes Verifier state beyond a "hint"" must be evaluated from the point of view of a verifier, right? If different verifiers may elect to use or ignore a "hint", I don't see how this could be any other way. The rest of that sentence establishes that how a verifier acts upon a "hint" determines whether a label is considered to carry semantic content. This impacts the next sentence, which states that "the collection SHOULD be signed by an attestation key" when a label carries semantic content.  Maybe stating "if an attester expects for a label to change Verifier state beyond a "hint"" would salvage the paragraph. Separately, is "label" right here or should it be "item" or "message"? It might also help if "hint" were defined in this context as well as how the "hint" notion interacts with the last point made in the security considerations section.

We changed the confusing/overloaded "hint" with "label" (which was an
already established term).
We also added an explicit "label" to the CDDL key to link prose and formal spec.
This got packaged with a change requested by the JWT/CWT IANA experts
and the registration for CoAP two new Content-Formats.
See [1] for the details.

Thanks once again for your great reviews!

cheers, t

[1] https://author-tools.ietf.org/iddiff?url2=draft-ietf-rats-msg-wrap-06