Re: [Rats] Function of an endorsement relative to evidence

[Ira McDonald <[e-mail]>]

Hi Laurence,

I strongly agree with all the points that you made here.

And I also specifically point out that the TCG Network Equipment WG
(routers, switches, etc.)
have recognized all along the varying security-levels in composite device
attestation (some
elements may have direct access to a TPM, others to a DICE, and others to a
MARS - all of
which are far preferable to strictly software-based device attestation).

Cheers,
- Ira


*Ira McDonald (Musician / Software Architect)*

*Chair - SAE Trust Anchors and Authentication TF*
*Co-Chair - TCG Trusted Mobility Solutions WG*

*Co-Chair - TCG Metadata Access Protocol SG*








*Chair - Linux Foundation Open Printing WGSecretary - IEEE-ISTO Printer
Working GroupCo-Chair - IEEE-ISTO PWG Internet Printing Protocol WGIETF
Designated Expert - IPP & Printer MIBBlue Roof Music / High North
Inchttp://sites.google.com/site/blueroofmusic
<http://sites.google.com/site/blueroofmusic>http://sites.google.com/site/highnorthinc
<http://sites.google.com/site/highnorthinc>mailto: [e-mail]
<[e-mail]>(permanent) PO Box 221  Grand Marais, MI 49839
906-494-2434*


On Sat, Jun 4, 2022 at 5:16 PM Laurence Lundblade <[e-mail]>
wrote:

> This is a step back for framing for the security-level discussion.
>
> The fundamental purpose of an Endorsement is to tell the Verifier that
> they can believe what they get in Evidence. There may be some varying
> degree here from claim to claim and device to device, but the basic
> principle always holds.
>
> Assuming for the sake or argument here that the Attester Manufacturer and
> Endorser are the same, it goes like this. The Endorser/AttesterManufacturer
> only puts private keys into devices that it knows are built correctly. They
> won’t lie. They’ll protect their keys. They produce correct claims. This
> really is the fundamental work of the Endorser/AttesterManufacturer above
> all else.
>
>  For example, maker of a device with a TPM selects a good TPM and also
> carefully writes the boot code that does the measurement. They make sure
> that the devices that the TPM is soldered into always has the good boot
> code. Then they publish the public keys supplied with the TPM to the
> Verifier so it knows it can trust the measurements.
>
> In the TPM world, you can’t really have the Attester send much more than
> PCRs in Evidence, but in the non-TPM world, lots of stuff can go into
> Evidence.
>
> Tell me if you disagree with this!
>
>
> By all that, Evidence can be a parallel channel for the
> Endorser/AttesterManufacturer to convey claims to the Verifier.
>
> The Endorsement can mean “believe all the Evidence from this Attester”.
> (It might always not be all the Evidence, but it will always be some of the
> Evidence).
>
> By this it is entirely reasonable for security-level to be transmitted
> either as an Endorsement or in Evidence.
>
>
> I think there is also room for security-level in Evidence in composite
> device attestation. One Attester may have a good way to evaluate the
> security-level of a subsystem, perhaps a subsystem that varies from device
> to device.
>
> LL
>
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats
>