Re: [Rats] Attestation Terminology

[Giridhar Mandyam <[e-mail]>]

Session attestation for keys related to transport (TLS) was actually defined in https://datatracker.ietf.org/doc/html/draft-richardson-rats-usecases-08#section-2.2.  So in my opinion there has already been an attempt to define a specific type of key attestation in RATS accepted group documents.

That being said - I have used a somewhat  similar definition to the one that Henk provided below in published work and feel it sufficient to cover common usage of the term.  For reference, the definition I used was "Remote attestation describes the process by which software executing on a device provides an assertion to a relying party about the integrity of its platform" (https://ieeexplore.ieee.org/document/7945438), which was derived from [1].

-Giri Mandyam

[1] Coker, George et al. “Principles of Remote Attestation.” International Journal on Information Security. Vol. 10. No .2. 2011. pp. 63-81.

-----Original Message-----
From: RATS <[e-mail]> On Behalf Of Henk Birkholz
Sent: Wednesday, September 20, 2023 3:41 AM
To: Tschofenig, Hannes <[e-mail]>; [e-mail]; [e-mail]
Subject: Re: [Rats] Attestation Terminology

WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.

Hi Hannes,

no, I do not think there was ever a list discussion on the term. Maybe I missed that. It might be useful to restate the whole definition from https://www.ietf.org/archive/id/draft-ietf-rats-tpm-based-network-device-attest-14.html
here:

> Attestation: the process of generating, conveying and appraising claims, backed by evidence, about device trustworthiness characteristics, including supply chain trust, identity, device provenance, software configuration, device composition, compliance to test suites, functional and assurance evaluations, etc.

The definition follows the context of NIST's 1st definition of `Attestation` as it describes an activity and the definition does unify IETF and TCG ("TPM/DICE/MARS") terminology.

In general, there was a lot of avoidance to become specific wrt to terms such as `Root of Trust` or `Attestation` in the scope of the architecture RFC. I am okay with becoming more specific in the RATS context, but that seems to be a strategy change to me and should become (maybe a lightweight) discussion here on the list. I doubt this is the first time this comes up, but taking into account the hesitance of key stakeholder in remote attestation to define such terms to rigidly, I would not be surprised if there is no referencable definition still.


Viele Grüße,

Henk

On 20.09.23 11:00, Tschofenig, Hannes wrote:
> Hi Henk,
>
> as you can imagine, I am confused. You are saying that the RATS group couldn't agree on a term for "attestation" in the architecture document. But now the term is defined in another RATS document, namely <ietf-rats-tpm-based-network-device-attest>.
> Is that because you finally found an agreement or just because nobody in the group wasn't paying attention?
>
> Regarding key attestation: IMHO it is what we are providing with draft-ietf-lamps-csr-attestation where Evidence includes information about the private key being stored in a hardware security module. I don't have a good definition of the term myself and hence I was wondering whether there is some established terminology in TCG or elsewhere already. It cannot be the first time that this issue arises.
>
> Ciao
> Hannes
>
> -----Ursprüngliche Nachricht-----
> Von: RATS <[e-mail]> Im Auftrag von Henk Birkholz
> Gesendet: Dienstag, 19. September 2023 13:59
> An: [e-mail]; [e-mail]
> Betreff: Re: [Rats] Attestation Terminology
>
> Hi Hannes,
>
> w.r.t.: `attestation`
>
> there is no satisfying answer to your question, I afraid. The RATS architecture was explicitly and carefully worded to avoid the word `attestation` as a stand alone term. As it causes confusion in the context of "activity vs. message" and is horribly overloaded, in general:
>
>> https://csrc/
>> .nist.gov%2Fglossary%2Fterm%2Fattestation&data=05%7C01%7Channes.tscho
>> f 
>> enig%40siemens.com%7C04d90290edb94ff2833508dbb907da4c%7C38ae3bcd95794
>> f
>> d4addab42e1495d55a%7C1%7C0%7C638307215597987825%7CUnknown%7CTWFpbGZsb
>> 3
>> d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%
>> 7
>> C3000%7C%7C%7C&sdata=wUKkQ85T%2BEDnoE2e7CENvC%2FGBvZLlCz8WtSdv%2F%2F%
>> 2
>> FQ2Q%3D&reserved=0
>
> (here NIST captures the confusion in a nutshell)
>
> That is why RATS is about _remote attestation_, and corresponding activities, such as Evidence Generation, Conveyance, Appraisal, etc.
>
> w.r.t.: `key attestation`
>
> The RATS WG has not defined the more narrow term "key attestation"
> today. As Denis pointed out, "OpenID for Verifiable Credential Issuance"
> does, for example. Looking at that definition there are two essential
> components:
>
> 1.) "a certificate including a certificate chain asserting that a particular key is managed, for example, by a hardware security module"
>
> 2.) "provide this data along with the proof of possession in the Credential Request"
>
> In RATS (IETF/TCG) words, I think, openid is defining `key attestation` as as an Endorsement (according to 1.) of key material that is then combined with a PoP (according to 2.). That is not the same thing as remote attestation, as there is no Evidence about the trustworthiness of the Attester generated.
>
> I am not entirely sure how useful it would be for the RATS WG to specify
>    yet another meaning of the term `key attestation`. What I would see as useful in any case, however, would be writing up a definition (independent of any name). Maybe something along the lines of "Evidence about an endorsed key storage that is augmented with a PoP of a stored key" or something to that effect.
>
> But that probably just reflects my half-baked understanding of "RATS key attestation"... what would you think `key attestation` means in the context of RATS, Hannes?
>
>
> Viele Grüße,
>
> Henk
>
> On 19.09.23 09:24, [e-mail] wrote:
>> Hi all,
>>
>> I am wondering why the group has not defined the term "attestation" 
>> in the RATS architecture RFC. Instead, it is defined in a solution 
>> document <ietf-rats-tpm-based-network-device-attest> where nobody finds it.
>>
>> Ciao
>> Hannes
>>
>> PS: Where is the term "key attestation" defined?
>>
>>
>> _______________________________________________
>> RATS mailing list
>> [e-mail]
>> https://www/.
>> ietf.org%2Fmailman%2Flistinfo%2Frats&data=05%7C01%7Channes.tschofenig
>> % 
>> 40siemens.com%7C04d90290edb94ff2833508dbb907da4c%7C38ae3bcd95794fd4ad
>> d 
>> ab42e1495d55a%7C1%7C0%7C638307215597987825%7CUnknown%7CTWFpbGZsb3d8ey
>> J
>> WIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C300
>> 0 
>> %7C%7C%7C&sdata=eCDY%2F9fUK5Jo1UHtMPf6qz3pJWAwyk8xu0qTEkm6288%3D&rese
>> r
>> ved=0
>
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats

_______________________________________________
RATS mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/rats