Re: [Rats] UEID where an instance is a group member

[Laurence Lundblade <[e-mail]>]

> On Mar 27, 2020, at 4:03 AM, Thomas Fossati <[e-mail]> wrote:
> 
> In particular, there might be attributes of an attesting endpoint which
> are not necessarily related to the signing key.  For example, the
> linking to certification data, and more generally anything that has a
> chance to change during the lifetime of the device (or is not known at
> manufacturing time) is more easily supplied via endorsements to the
> verifier.  In my view, EUID/EGID is the handle to all this data, which
> MAY include the key used to verify the signature.

Ahhh. There’s the source of the issue: what bits in attestation evidence give the binding to the endorsement?

Since I didn’t understand endorsements very well until Berlin, there’s nothing that I’ve (consciously) put into EAT to handle that.

Seems like a critical point to be addressed in EAT and in architecture. :-)

LL