[Seat] Re: A Note on Allowing Vulnerability Reporting on the SEAT List

[Chengxin Huang <[e-mail]>]

Dear chairs,

I agree with Steve and want to add my two cents too. I think if someone
finds a vulneability in attested TLS deployment maintained for 3.5 years,
it is relevant and welcome input for SEAT WG. I believe it should not be
given a warning, rather welcomed. It helps us all synchronise, learn from
the pitfalls and improve our mental and formal models.

I don't see anything promotional in the report or the email. As far as I
can tell right now, both GHSAs appear to be genuine and technical.

About the comments of WG individual, it is not "high-severity flaw".
Anything above 8.9 is critical-severity [cvss] and this one is 9.1. Yes,
the charter says "will allow per-connection freshness" and "will also
describe a minimum subset of properties" but what will get us there is
exactly this kind of vulnerability analysis. Conflating "aware of risk" as
broad as the charter statement and actually finding a vulnerability in a
concrete real-world implementation is a category error. I kindly ask the WG
individual not to equate their opinion to the WG opinion.

Best regards,
Chengxin Huang

[cvss] https://nvd.nist.gov/vuln-metrics/cvss

On Wed, Sep 2, 2026 at 9:55 AM Steve <[e-mail]> wrote:

> Dear SEAT chairs,
>
> I am not seeking to reopen the discussion but just to share my two cents
> here. The most valuable and practically actionable information that I and
> CSA-GCR have obtained so far from this working group is the practical CVEs
> and ProVerif artifacts that Sardar et al. have shared on list. With all due
> respect, I want to kindly ask that such reporting be allowed and welcomed
> on list.
>
> My rationale is the following:
> 1. Both advisories explicitly state [draft-fossati-seat-early-attestation].
> 2. It actually adds information because it is not only the claim of
> authors but rather statement and approval of cocos maintainers.
> 3. It is not clear to me what "SEAT working group's active specification
> work" and "working group's active work items" actually represent. There is
> no SEAT working group adopted draft for specification. My understanding is
> that use-cases will not contain specification.
> 4. Technically, the only difference between TLS's
> [draft-fossati-tls-attestation] and SEAT's
> [draft-fossati-seat-early-attestation] is the binder and re-attestation.
>
> This is not a request for the Working Group to adopt, validate or discuss
> the recent vulnerability report, but just that such reporting may be
> allowed because it is very helpful for us. In my humble opinion, such
> reporting rather deserves welcome, and surely not warning.
>
> Best regards,
>
> Steve Luo
>
> Research Analyst, Cloud Security Alliance (CSA-GCR)
>
>
> [draft-fossati-seat-early-attestation]
> https://datatracker.ietf.org/doc/draft-fossati-seat-early-attestation/06/
> [draft-fossati-tls-attestation]
> https://datatracker.ietf.org/doc/draft-fossati-tls-attestation/
> _______________________________________________
> Seat mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>