Re: [Rats] Standardizing TPM output in attestation evidence

Panwei,

I agree and that's what's proposed in my draft, to share the log output or
a link to the TPM log. I don't think we need to replicate the format of the
TPM and for the design in attestation sets, you'd include all of the
relevant logs (or a pointer if that can work) to the TPM log, PCR log, or
other relevant signed log on other platforms (TBD) that align to a set of
policies or measurements to that defined set.

Best regards,
Kathleen

On Thu, Aug 5, 2021 at 6:07 AM Panwei (William) <william.panwei@huawei.com>
wrote:

> Hi Laurence,
>
> Thanks for sharing your thoughts. I think the use case is reasonable.
> I agree with you that these types of devices may not use YANG, so some
> other means need to be provided, for example defining the CWT claims.
>
> The CHARRA draft defines the attestation evidence suitable for devices
> using TPMs in YANG, but YANG doesn't provide security protection for the
> output of TPM. Actually the output of TPM is already signed by the TPM
> itself, what we need is to provide a secure transportation for the output,
> for example using NETCONF. TPM itself isn't the Attesting Environment, so
> it doesn't produce the Evidence directly, it needs other component's help
> to generate the YANG styled Evidence, and TPM's output is
> So this may be a little different than the current EAT claims. We have two
> options to handle the TPM's output, one is to define the traditional CWT
> claims, and the TPM's output is the "value" part of the claim, and then use
> the EAT attester's key to protect the claim. The other option is to just
> define the UCCS-style claims and use the secure transportation to transfer
> the claims and no need to sign the claims again.
>
> I don't know whether this should be defined in EAT draft or a separate
> draft. But I'd like to highlight that even if the device only has TPM and
> has no EAT attester/Attesting environment, the YANG data models may also
> not be suitable for this device and it has to use some other format data
> models.
>
> Regards & Thanks!
> Wei Pan
>
> > -----Original Message-----
> > From: RATS [mailto:rats-bounces@ietf.org] On Behalf Of Laurence
> > Lundblade
> > Sent: Thursday, August 5, 2021 4:27 AM
> > To: rats <rats@ietf.org>
> > Subject: [Rats] Standardizing TPM output in attestation evidence
> >
> > There has been a side discussion about TPMs and EAT. This is to bring it
> to
> > the main RATS list and to state more clearly the use case I have in mind.
> >
> > The devices I’m thinking of are roughly this:
> >  - Desktops, servers, IoT devices… (not network equipment, probably not
> > mobile phones)
> >  - They have an off-the-shelf TPM2 soldered on to their PCB
> >  - Likely to be Intel CPUs, but not necessarily
> >
> > We want these devices to do attestation and generate attestation evidence
> > (all devices on the Internet should do attestation at some point!). We
> want
> > that attestation evidence to include measurements taken by the TPM. We
> > also want attestation evidence from parts of the device other than the
> TPM.
> >
> > That’s the very general use case I have in mind very simply stated.
> >
> > Assuming this use case makes sense, then how should this get standardized
> > and implemented?
> >
> > There is protocol standardization in YANG now for TPM output, but I don’t
> > think we want to use YANG for this. I don’t think YANG is in common use
> for
> > these types of devices and has a particular interaction model. I think
> EAT is
> > a good candidate because it is an independently secured blob that can be
> > carried by the protocols already in use with these devices.
> >
> > This then requires that some output from the TPM be put into an EAT. It
> > seems useful to standardize that here in RATS and it seems in scope for
> the
> > charter.
> >
> > I don’t have a strong opinion or detailed proposal for what TPM output
> > goes into the EAT or the particular HW, SW and attestation architecture
> of
> > the device. That’s something we can work out. I am pretty sure the device
> > would have two attesters in a compound/layered arrangement. The
> > attestation evidence produced by the TPM would be nested in the
> > attestation evidence produced by the EAT attester.
> >
> > I have some leaning towards putting this work in the EAT document, but it
> > could also be in another document.
> >
> > I think this is important for RATS because of the very strong
> association of
> > TPMs with good attestation and for the goal to support attestation for
> all
> > kinds of devices and environments (not just network equipment).
> >
> >
> > A few things this is not about:
> >
> > - This is not about changing the format that a TPM2 outputs. This is
> about
> > the ability to use the off-the-shelf TPMs that are manufactured by the
> > millions and sitting in warehouses today.
> >
> > - This is not about local device boot architecture. This is about remote
> > attestation, about attestation evidence transmitted to the
> verifier/relying
> > party.
> >
> > LL
> > _______________________________________________
> > RATS mailing list
> > RATS@ietf.org
> > https://www.ietf.org/mailman/listinfo/rats
> _______________________________________________
> RATS mailing list
> RATS@ietf.org
> https://www.ietf.org/mailman/listinfo/rats
>

-- 

Best regards,
Kathleen