IETF Logo Mail Archive

[Rats] Re: Proposed Changes to the CoRIM Document

Ned Smith IETF <ned.smith.ietf@outlook.com> Fri, 30 January 2026 18:54 UTC

Return-Path: <ned.smith.ietf@outlook.com>
X-Original-To: rats@mail2.ietf.org
Delivered-To: rats@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 1DE75AFAF13A; Fri, 30 Jan 2026 10:54:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.095
X-Spam-Level:
X-Spam-Status: No, score=-2.095 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=outlook.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mh-FZ1kG1fBP; Fri, 30 Jan 2026 10:54:39 -0800 (PST)
Received: from MW6PR02CU001.outbound.protection.outlook.com (mail-westus2azolkn19012048.outbound.protection.outlook.com [52.103.10.48]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 54EA6AFAF133; Fri, 30 Jan 2026 10:54:39 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MXaAjl2q8ufeor387N1/3S/EvE1LTb3IeHB1wHwOfC/cPxVfB4Oplb2hl1VgWJcLY2sI30Q6vggpvtdHYAhR9UtXfc+FTROw7qKUaEqRSJP72GrFST4fuDr9qwTwF0ZOZd77Rqdq+dMZWHb/xpoISxeXFxRMqv1rwUfqRbfByOwErgTofqb0e3MXbfeIEm6zNiYTPzUdmBbZCfOJjos+MhOfQ8uj/qt6BTb97fWfWz0zg7ZNZfwGZc9cYbUmAGJEBQaYbHP8K49KKE9jnyIlRT/xoA3ktIEKTAO7sDG2n/rBV7q+vWQXBji2M1hh29b24XexNWBWk87ksxdffDEGxw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LoF7kC+AawsNiPYgEQdgudxjVdiRKDk+lptEhDCF9T0=; b=oWICMXY1pWXS7pFi8zTQV5ghsrxeFes02uMlRi+fjEDJcC0Wr/F+vAdzPoKzpN/85/IWvkZBct1EeBcaEDe/X8WWT4YrFvO0kF6RTpxK/PaXRpKkrdEQtXJ/UqYEBAguUNDUtJHaURuQ915fAJqH/C0/s8gQyXXbUw3VCBC1ivdLIlVmcZRkCI0YlUG+DhZ8wpVsDPGp1sEPGPJcM3J1Rz/VA4QI+Bn09Jg72vl5xUNJoiMS0uv5p+mwgwz2vriF+LDWoXIrPEzFdLg43eHCj3Bsb3wP+yWbtrNVi5wR9Y22CzbEPRGW8Lxj/9tblVfTfBvnn69FfzsZL9rVdDlbpA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LoF7kC+AawsNiPYgEQdgudxjVdiRKDk+lptEhDCF9T0=; b=tUrtuqgl54bY31dtP1wHtFV68YOEg/hNZSJ2Hzu3lybETFlmI1lEwXqt/P3Ov9f+S2NPJj93fd2mJdursQ8t8TThx11rtjs23OkFDeh+QKuSXqWLJXzYx40jd90Iavb3jBkpD2ifmJamOqjDN5QORBoKadIiCnIE37VPpl3RVgIPRUo774tUZizCOgxe6x73zlzbSCZUymET1e0VhnJd9sA6uhzQayRS8y0EIJ7HVoKoO1/p5Ws5PGYKYWOVaF6jgaBQPa2O2MMOZmiy5OXewkOnloT9RyRWnyQUlNBrJqqWwko5H0CHvBlRNQlnUKq22aYbwGoEFaAto2ak7AkgoQ==
Received: from SN6PR04MB4816.namprd04.prod.outlook.com (2603:10b6:805:b3::10) by PH0PR04MB9854.namprd04.prod.outlook.com (2603:10b6:510:376::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9587.5; Fri, 30 Jan 2026 18:54:31 +0000
Received: from SN6PR04MB4816.namprd04.prod.outlook.com ([fe80::4ecf:3a4c:7f2a:84a6]) by SN6PR04MB4816.namprd04.prod.outlook.com ([fe80::4ecf:3a4c:7f2a:84a6%3]) with mapi id 15.20.9564.008; Fri, 30 Jan 2026 18:54:31 +0000
From: Ned Smith IETF <ned.smith.ietf@outlook.com>
To: Carl Wallace <carl@redhoundsoftware.com>, Yogesh Deshpande <Yogesh.Deshpande@arm.com>, rats <rats@ietf.org>
Thread-Topic: [Rats] Proposed Changes to the CoRIM Document
Thread-Index: AQHckX4AvMSCSF44uEOIeRXjhTppp7VrEDYi
Date: Fri, 30 Jan 2026 18:54:04 +0000
Message-ID: <SN6PR04MB4816B4244051CA5563E2C8F5C69FA@SN6PR04MB4816.namprd04.prod.outlook.com>
References: <7FD2065B-DB38-4EE0-91D2-F7ED458150FE@redhoundsoftware.com>
In-Reply-To: <7FD2065B-DB38-4EE0-91D2-F7ED458150FE@redhoundsoftware.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-reactions: allow
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SN6PR04MB4816:EE_|PH0PR04MB9854:EE_
x-ms-office365-filtering-correlation-id: e519e922-811c-4a77-5f00-08de6031007a
x-ms-exchange-slblob-mailprops: V85gaVfRD49S/pS4yJO2Rs6kXT7fKAkgnTdalyUD48TbXcMsOzwJD33TEAEfZaf+lkJBdO4QMrd/u7SJk4Cgff2xH8NkfgocjJzqdLu1xvTpikSGHpzn1aTt95BDRtaEe13ah6d20J7Qn2wDMA5Cleu4QaLxOwxvto/zMF+HKpArjgoggpwukxhlFFUmM1zYdsJSNQukAlRaiQhBh1asE0pM+XZvvTYh3667EFBWmravGE1viSgpEmCTHkTh3R8k9FBbeccxgfRRFqEmkwggRR4qgYI3MVqU+hmCC6bTATyyj9ibHXsJehgiIRhOOuxazCubdQwfiPGj9OSk2uv+hlgLTecfTwE6KoBQWhOpbL89JKCIt+qSQTxUp5e61jT0GZ1a5jI4hpTWLEb1/pX1FPyCwsMSOi4HvTMxY8PBhY8xkUPPvtEQLEAG3ZStbk8PhDUFuMSHZ/SB0tEksRsnni4ctVU0nvT9WTQugY3q6xmGD6aBbIxFbjzcr1ZpnKq2V3+ZGSUsI+GBxFcIE1bE9YAV+kP+JWzTL8NNKQYEdEy9FEFp+k2cCaT0E4B73dJOa+Uq8Zp//f4ncKdzybm7M1OzhjiKvx7EzgqnJpmx63T8gpYgc2qYLr+VOPRlwHGDz4rDW3fQZDtBnM2Epf6zHqi/eg0CNPYYlAD+DzzvuZMcbc04rnoZ8DWohu48d3soMPjVFRdHWKJxn7GRIAJqUaCmCqimezY8W8+6f+7iZfddE1pn4YaXvCmEYM1KXUAv5fW6Otk+nqWE5qyZPJluRpcq1XTDwClJmjFW/HxS8huYnDF+3+BjOmOo8pqZUj24nTQ6G05J0TRfwBqRH7gAbg==
x-microsoft-antispam: BCL:0;ARA:14566002|8062599012|8060799015|15080799012|12050799012|7042599007|31061999003|461199028|9400799043|19110799012|1602099012|52005399003|40105399003|17031999003|4302099013|440099028|3412199025|10035399007|102099032;
x-microsoft-antispam-message-info: RE5KKe1EtY3INz9z6Qb9FuODGiYAxdgVEpU8ApOOSgc/uCLzKY3Eif8UBHaopLVOpkPoJizC0UaSkTP0kMLZbWh20dIRxC3HIu8mjl5Fzxr/T84f4S8KWnFDo19W+TICs4WOEnRe/x1l7vw1zd0QHTnbw4Fk08m7QH7WZ8btb1JkxMVm9fXZE8Qq9UpJhXer87rk+VrBG5E5y1gzuIJ8TKVR9ECvLovKhIzd07w2kFAZqB7hZgOmB5t+ZTXxfYUNBHF0cWsbJRdHKgZGp8sF0D2tWcreAb4WGYz2wnKDah4EGv5ChLEpYYGmRaF7XrE8uM50qcOSs3Bx6BwobyPvBC/shcyRET+njBDpZ6+BE4eTW2d6OP8VcKpuWDM7tucktKBYdtAMa9TnNN2oUXlcv83HSxVkB7IrYOkOTMf5iNrr4waxEcNqORD1uIf6uEkTxyvm0aG+eXa8VjmsZcpjCWKRM65BPv6zxEQqwzBeiNlM32YSEIp8vXnjkRp+fpw8d4aT2tyXa26bkt007fkZxWkvhjTWPhl5gnooItkVP9OqeoC5k1edI4ExTdY3jRKTkVSkr7/ExSzR6b2aJGefsgHHJVRzauTzt2UzSZq7t+5+cSIAKAR3mDT1/fNhCgrQUpWSKBlxmN56c2tBYunuvNftXL/tDhGePOz40aes/0nkoq7QobQFK3dTLh3ietmPNJs2iRKNYjz4moY6SxyzNquApNIOdIFqeKoqN4bQUWrxQCsU/aCEUhEgyzOa6k/FfQ0p3jJu6RowArgHY8ecLaEBp1hz4vu3KPCFkUMd71fqTjqOxuojEBJ+jAuJVhjXS84fMaIwj2Ou++0ALGg0D8FLI0wGItqZDsmtdhQbxA7LuPPNvwsBRfZH/sN4YfwoMnEmS9iFIuiKoQlIMzoW94Jxw/rFA/bV+En8UeiOURgYfek5NTjZV40MKhLt1MmJCrDli9/1bnEmE9ei2ATg0LICB6W7u7hKYJhNG2ZMDa+FW8XikDNQrLeHgEQsG6w07mKpyRjoZ/iU9nmaND/lOeSU5nPdX0AkpPd9AACTR3H1DGmnrqOGA4NPt9UoJ3/RLnp/JvDSjLsJKAMsc96RQI+eJmye0euytsCPjzaIDwiGPv7wSxmeazcpjElqBUxXx413Yj9cmu0GHBTlBjBkzwnOwuZF6ixH6Va6sl1KaSVl2pbCT10K7C5BxNpsYKOOdtwbTx8u7jInApQe4/smiAJGBMBc7u1sj2+EL2fQCwy0dhBieIEwNSHEQPWxK9VKLM+J3yZXnfIpGm2bba6G9TpI6MVNaBpGWh+znJIMgt6FgIE3NdiHJdj7vhuQc7KN7KdGbxH9WlPFBVJ/mxOa/Gi12xr6RHulk0JfaZpJ+5EyosclkFZKylnCn1nHK/o+
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 2D1ZVZnMZ4WN4R5iMn0mPM2xhijBNRDBROjAvUyXrJILJo+bavy/J2gI/sfh+EVPgd7DvFEAGBK5l/Xa8Qp1b9dgaV19YEqmwrvzsoI3EJVaoUh6I4KpKhKCIS848ztXCC45lGZ5P+6CQ1V7kLHnAJadYj+xByD//YvwTUypPNnc+ZkctwO7bk0F2dd8MWefLDqDokzUEMXAdhjRBHm6huKH7RG9ixIvVsP6YhibJUCo9vFhw7CBP4HLHMb8kbcRVdSz0waSkV0OAFX3ZOsIWl97S2bnKJfW4jad1EME12UyUaF+njnfGSCb4SPWB2F3CpOuGEInTnPBuCbdoWVbuP7NIuPDc1DVjuvhWwZN6GZJ5bW59N5eYRsIUcZpZ4CF2SsvyDR8gf3M3xfWgpBavPSf1YhJYsl7aTqcceDDiG9Wz1MovnugYDh2DnqYjjytwPvI0M9P2SyCI3v0kgi77jUku8hyFYz9NYHps84WtrsaghbLAe+/HrbXoTl0IJrmKNC5nTvaAbNGC0mYVrkcm7HlS6bzNpZYKgfXkhC+WVAGU0XReOhgmWgykJaD0Y2B+lbbbYI+aINqpcHyvzPoDT271spyORBaKOQdwPDLBcxioVQofyNexqlYr6Po2WzLRN+7xyXccwfScdQFEBSwJq3DYHOH7+TBKAPDnUTXaz0GGMkB1L6XklUbz9oEOfKDEKv7Ji878wsMooH1uRgKV1keXcIEt7ahNjLHgdZLxKMJv9tXwWBzRGI7Tlskh0xr+PBJ5Q2vfUQp4qaSg6Xi9K3nCh6LMCu70Bq8OYwcyn+JokmSfgigX3a2GNHPNTJtjFvP0IGbzNqYpgA0wr6Gvta2CoCaY+JmtrkweR8L8lv31NENefA8a4ci0xu5TvsK06/2U4W1HSlJFZdz0h/1DlveXvM3lbRvrMk7pOssQVQ2Ms/czST9BwHqLpamQyJ7kFJRKLTqt8shdbUBkzTI5IULAhD33VL3CBGqGARPb2AMxHmgqlmyoT2GmMbtAqtYNpWsqs7ph/ND/pZCaw7RzdJBfqpbxrGOulMHZhrHjM2PxtEDVHs/7bNE+I3WQH/W+0JPe3I5HbBGacPVU+m10C/KCOaGfaGVTNVo9Un3a1VROoEfYi+ttD8XJOMntVNkabhvd6WYFmiNWkJS/n++zox51cJzjJrdlUpuNAsGKurmfT0EFL5UPBA8p7bC3KOx2GL59XCQ98Ye1RkfCYjyJJBXdxCk2vWkJv1etVOkiQF4CFUJgsLuGKijDip++5CCN2nzy5yqszxNMTbFIm21X+NnOK3BGS9RFKLTDgFekxEcNsXvIe1C/QnhtubU1YAFMgIJnYUa/YY0YUjQoQUkPwIbrmWz8vvyEoZJtVuACiOcJyZdsYwCrkiF83x2xvHn
Content-Type: multipart/alternative; boundary="_000_SN6PR04MB4816B4244051CA5563E2C8F5C69FASN6PR04MB4816namp_"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR04MB4816.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: e519e922-811c-4a77-5f00-08de6031007a
X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jan 2026 18:54:31.0558 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR04MB9854
Message-ID-Hash: 3WGRPSTIQI3SIXK6QFHN32WGGSW2AB3L
X-Message-ID-Hash: 3WGRPSTIQI3SIXK6QFHN32WGGSW2AB3L
X-MailFrom: ned.smith.ietf@outlook.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-rats.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "draft-ietf-rats-corim@ietf.org" <draft-ietf-rats-corim@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Rats] Re: Proposed Changes to the CoRIM Document
List-Id: Remote ATtestation procedureS <rats.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/o9AK69z-i3YKb_srccz2cAL9NZ4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rats>
List-Help: <mailto:rats-request@ietf.org?subject=help>
List-Owner: <mailto:rats-owner@ietf.org>
List-Post: <mailto:rats@ietf.org>
List-Subscribe: <mailto:rats-join@ietf.org>
List-Unsubscribe: <mailto:rats-leave@ietf.org>

I created issue 534<https://github.com/ietf-rats-wg/draft-ietf-rats-corim/issues/534> to track it.

On 1/29/26, 4:18 PM, "Carl Wallace" <carl@redhoundsoftware.com> wrote:

This is not related to the approaches you laid out, which seem fine, but since early reviews are arriving, I wanted to re-raise an earlier issue originally noted here [0].  I think the certificate validation steps in https://datatracker.ietf.org/doc/html/draft-ietf-rats-corim-09#section-9.3.4.4 are inadequate and again suggest that simply referencing Section 6 of RFC 5280 would make the most sense. As an example of a problem with the current text, given the lack of checking basicConstraints, what prevents someone with a private key corresponding to an unrevoked certificate with a chain for which signatures verify from generating new certificates that will pass these steps?

[0] https://mailarchive.ietf.org/arch/msg/rats/CPgHg7xqRCW2TI59XIKcXXc3wnM/

v2.46.0 | Report a Bug | By Email | System Status