Re: [Rats] security-level claim (was Re: WGLC for https://datatracker.ietf.org/doc/html/draft-ietf-rats-eat)

["Eric Voit (evoit)" <[e-mail]>]

> From: Giridhar Mandyam, June 3, 2022 4:56 PM
~
> So does this mean that security level as an EAT would be OK if conveyed as a
> X.509 and signed by a manufacturer key that is distinct from the attestation 
> key?

As this is just an indirect way of getting the information from an endorser, 
this would be fine.   I would prefer the more accurate name of 
"endorsed-security-level" to make it completely clear to a Relying Party that 
such a claim cannot come from Attesters or Verifiers.

> Note that  the EAT attestation key itself can be signed by the manufacturer
> already (see https://datatracker.ietf.org/doc/html/draft-ietf-cose-x509-08).

There is also the issue of ensuring that an indirectly provided Endorser claim 
is legitimately bound to the exact type of Attester making parallel EAT 
claims.  So both sets of signed Evidence would need to include information 
that can be assessed to evaluate whether the relationship between the two 
signed blobs is legitimate.

Eric