Re: [Rats] Definition of an Attesting Environment (and layered attestation)

["Smith, Ned" <[e-mail]>]

The Arch draft captures two duties of an Attesting Env fairly clearly (1- collect Claims, 2- create Evidence). In a layering context the Attesting Env has another duty (3- pass execution thread to the Target Env).

#3 is probably also true for composite device as well, though in composite device the Attesting Env retains a thread of control.

Does the list believe these points should be in the arch draft or are they reasonably inferred?

Thx,
Ned

From: Laurence Lundblade <[e-mail]>
Date: Tuesday, July 13, 2021 at 9:56 PM
To: "Smith, Ned" <[e-mail]>
Cc: Thomas Fossati <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: Re: [Rats] Definition of an Attesting Environment (and layered attestation)

Thanks for the comments, Ned. Helps close the loop.


On Jul 13, 2021, at 4:14 PM, Smith, Ned <[e-mail]<mailto:[e-mail]>> wrote:


 Attesting Environment don’t ensure integrity
There is a sentence in layered attestation that goes “The first Attesting Environment… has to ensure integrity of the boot loader”.

Yes, the “ROM” does need to ensure integrity of the boot loader in this architecture, but I don’t think it's the Attestation Environment that is doing it. It’s another part of the  ROM that’s doing it. I would call that functionality staged boot and don’t think it has much to do with attestation.
NMS> The term ‘attesting environment’ is normative while ‘ROM’ is exemplary. The statement above seems to blend terminology between something that might read like normative from exemplary text. E.g., ‘attesting environments’ seems more normative language while ‘the boot loader’ seems more exemplary. Given the goal wasn’t to write a normative definition of layered device it seems to live up to its expectation. Does the WG want to see normative definition of common device patterns like layered device and composite device?

The statement that the normatively defined “Attesting Environment” “has to ensure the integrity of the boot loader” is the biggest point of confusion in all this for me. Personally I don’t think it is correct.
NMS>  I think the text “the read-only BIOS in this example,  has to ensure the integrity of the bootloader” is wrong since the example no longer has a “read-only BIOS” component. It should say “ROM” to be consistent. If ROM is changed to RoT then it would be changed along with all other occurances.


The thing that resolves this sentence "The first Attesting Environment… has to ensure integrity of the boot loader” is making explicit that the first execution environment (the ROM/BIOS/…) has two jobs:
   - Securely start up the following environment, the boot loader (which it can do in many different ways)
   - Host the Attesting Environment that measures the following environment, the boot loader

It would help me (and maybe others) understand layered attestation if the text made this clear.

With the sentence as is, I wondered if there was a RATS Verifier on the device or not. The definition of Attesting Environment is something that produces Evidence and Evidence has to be checked by a Verifier… so maybe the intention is that there is a Verifier and that is the means by which the integrity is ensured. It is through this email thread that I am clear that is not the intent.

LL