IETF Logo Mail Archive

[Seat] Re: Comments on formal analysis of relay attacks in attested TLS (CVE-2026-33697)

Songbo Bu <bluedognull@gmail.com> Thu, 02 July 2026 23:56 UTC

Return-Path: <bluedognull@gmail.com>
X-Original-To: seat@mail2.ietf.org
Delivered-To: seat@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 723EA10D25B35 for <seat@mail2.ietf.org>; Thu, 2 Jul 2026 16:56:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1783036606; bh=4rSf3enOmoPN9m2leawr1Ean7ngD8aOjUTlBwyBg/gQ=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=Mp6Xn72dAo8nDzaVgP1mDw12KAkyiqgbBeyzn7ngjBe/yl/vO04HbdmuyQV3NvyvD cl+oI7xhEzOVIUv2suqcxiyzOxu+ZAUKNq4ejnDnhCRR+gR2RT7lGd+ABIwZhffEkI 9S9ZYucAtU2RiBqoMeu8d+c5lSEkJMjTeQ3wxbh8=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.099
X-Spam-Level:
X-Spam-Status: No, score=-1.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FORGED_GMAIL_RCVD=1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2URPAbp0A4Kr for <seat@mail2.ietf.org>; Thu, 2 Jul 2026 16:56:46 -0700 (PDT)
Received: from mail-qv1-xf30.google.com (mail-qv1-xf30.google.com [IPv6:2607:f8b0:4864:20::f30]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 5FDE710D24E86 for <seat@ietf.org>; Thu, 2 Jul 2026 16:54:20 -0700 (PDT)
Received: by mail-qv1-xf30.google.com with SMTP id 6a1803df08f44-8f2509d6becso23523736d6.2 for <seat@ietf.org>; Thu, 02 Jul 2026 16:54:20 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1783036460; cv=none; d=google.com; s=arc-20260327; b=R2BtVgORY+wi2fNSaRdmn3/Il4Z16IVjD/IFFT/SvZtkEB6FR9j/BoEVsuoxlXlYwD TnJwb0mgjfo4KhIQDJHEu3ibKWN3oJ49f2cNIdf/OlQzH1McW+wQnVfXByoh8VDCp4u1 jpx5TkNJBTQMFsUGmafVZF4Pjft/UV7Rs3O7umV8fVW9RmXKFbvvyUtSsmYhxpgCqtWI 0I4MT4QFYS6jhtFNJLBqn+Z0BY31b5BlQJvBYLXHrkezRZJ4HJfWFjQD1CigVq6yzeK8 TFRKJ8IW34EFSiQQxbDLqqBVrzO4MN0L1McG2lUH287RyK9GQ+DuAY/8InRO/Cu+pt2z fjFQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=4rSf3enOmoPN9m2leawr1Ean7ngD8aOjUTlBwyBg/gQ=; fh=L6POtM4Rvaha9fcV7ZM7zGxzjsEkP668CBYc42S0nyA=; b=PgN8hrWc8qEDmj5PtYMtEEuFqmCvmHwjjZJWifpR8BbqoJfiPX7oWiFI5dCSgD2+dU NBKVqhfJTauVVxBWmGhFLlbl5a2zfjU6kl84EpSIHCwFf2WnqE4rpXPfKik/zLb9W1x1 yrC23MS8++H8/PdqyJBUY9e+Imranir66KDv3fUYftqFiSeXZPCwWSoghTANaPHy9nbu E7/1sKgBdIwXtV8jozGwYA639eCzSC1jAw++fV3cilqVhrN4uSm1kJhemaTqfbKZmUdU a4xDBe0XZoPRxm4bMeY8wpYUAn0c45JQfhUkgG9RnzVTtP0nuL+vMB4NiMmoMtlzgH8I 3FHw==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783036460; x=1783641260; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=4rSf3enOmoPN9m2leawr1Ean7ngD8aOjUTlBwyBg/gQ=; b=MhovI0zd4rhW+zYV4TNCO9m7CsVoO3TnESYZ/eGjgvvKSfo+c59zCxVgOGXIovTvUB Rz4x+NAGOeya1XmGbABw5kznnruReSTIEdyUkCBU/tfzG3n6IeODD3zpkr3SBa8KZOI3 yKqp1aWrAVfziGrt27643bGu/dnooU+SPEzYxj0l7/3M2AJ99t3tinqS1c3NkW9YNEqw C1Oi8DtetTt+CpvZw3TpRjioom2G5BZm/QISO8F9CSgRQ0mwoyETzc0eX4lshaRFwtYq u4i81QthNfTkpIm2PpVbwIS9e830ctwbasDHDXb6Bgi9GEGTk2PK8MlUl32jdX36iGG5 MDpg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783036460; x=1783641260; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=4rSf3enOmoPN9m2leawr1Ean7ngD8aOjUTlBwyBg/gQ=; b=fzi+l5vYwxEVrxBuxH3+aAEqQJqnY/j+bAst8oBvlr2p0DdYEDgQJy1yEKZWJRM5Z4 Olmj0TzVA0O15MfJV6knMK1YCECTwkxPWB1Z0W1VX2SE32yKmsLgiSjoOMVJRC1vCyDu obM52xBNCvlgPTcepVWKyVD1NvG5JSDM8qmqkvfKUapOS+9s7HK8+DX6Juh9I9zuvFVZ sr/vfYCRzSy/Q5Gp0HA5BKaoZRX+eOu7DczUvsDp+6H6GrbqwbxTJPNe/44/ELL3qUI0 rd7MIqIV9Q3NLKKI0LUZB6QqaHpsFz0A4UB9XpcqYaRlnbdToVae4m/E3zlloGzwIbez GTug==
X-Forwarded-Encrypted: i=1; AHgh+Row83K+3Hx9ClyUvwKsdRVR+CmHO8h1UjboEyVcZIOXS81t7tOyOtv9Ap+Sh1dPvKe3nGMJ@ietf.org
X-Gm-Message-State: AOJu0YxRwEXPN3WnqB0gTzcM0f4fRRG7F/FD5tLlC9EwhPRj+01S8gd1 4LUoNq9FFnonS7GmKlggpfwWkTR99QQFI3ENURfSbyoMv6uC7NBNUslliH+C9UCoZpguxZIOs9i ynE5i+WmzTUx6H2w1CLAhIN4kgNxuO3SXIs+9UJ0yzw==
X-Gm-Gg: AfdE7clgslRzA4XLfvMxD4Qxp2k8qY5Lf9hQx8MANZCZKy19wy1cYkJVq6EoigrkQBz AsQZlF9E6HaTBW4HYFxUlqjJGdbITgI2WtnXGL4S7IQhTXCRjiWxPC/8zMH6/wwTMgfUMNDM4sO KXUL/R1uDl51Ul+FIx+1pxxqJXNoTp3A8rueumb8r8mge+otA549BESJLMjuBauuCrAcrMF0+st Q6ofC8YPt51Lwwvc9L8mDa4MCWoRgZI2ata3bZ64SSR82uqeR07iZoDzeEMjvmy4qMVaZy14CBP Xo8Ffq7UUrbJL9Hch0/EJfj4ag==
X-Received: by 2002:ad4:4c4a:0:b0:8ce:aace:eaf7 with SMTP id 6a1803df08f44-8f3c93e0557mr92318646d6.39.1783036459268; Thu, 02 Jul 2026 16:54:19 -0700 (PDT)
MIME-Version: 1.0
References: <5f361893-bc32-4737-9578-fdb3ad7be3f9@tu-dresden.de> <9F03163D-B0F9-40DD-A4AB-69C151B872D6@aiven.io> <c4a0c433-173d-44ac-bd48-eed642a674d3@tu-dresden.de> <CAHxYnaOBMnPp7EiRLNYWX8AQDc2zYoBL226nfeBiPXsyii7Now@mail.gmail.com> <CAHxYnaOFWQBLf0Pn8bY=CMx7ytSEkTbvj7xp-s0GCHJohRh5xg@mail.gmail.com> <2b53d833-51b8-4915-82b0-ac3305e89528@tu-dresden.de> <CAHxYnaPDTzHuXyeC06bKWNOQ+wYfc-02AVyDETveL7dTteYURA@mail.gmail.com> <CAK08nYaQb6tQzy_nZrJbGbyu1oLuFpAEjTWqe_hY6cmmGzJFvA@mail.gmail.com> <CAHxYnaPyD+mFBgk-axNXCS+9qob-nhF_+Y6eqz9fgPnDvNF5Nw@mail.gmail.com> <34201e80-edb7-4f99-afa2-0d5b5799c6da@tu-dresden.de> <CAHxYnaOUyvMrMRN2C4wjO_s3hpqXDDMJAOAUYyGVt0JRu4RSQQ@mail.gmail.com> <3f87fe50-f0bc-45f7-8ed5-0a7cc7cf975c@tu-dresden.de> <CAHxYnaOsUBJF1+dkhEuPdhExNmk14cWcauxEw-zo6TotWzxsHQ@mail.gmail.com> <CAK08nYZH=Qb5OcdoVhXKn5=hHGS1k-GHisLg--heK=d3W55sxw@mail.gmail.com> <CAHxYnaN_3kC4M0a+M=3SocsLBVs6RiUCtg0J4UaVb1jTMhp64g@mail.gmail.com>
In-Reply-To: <CAHxYnaN_3kC4M0a+M=3SocsLBVs6RiUCtg0J4UaVb1jTMhp64g@mail.gmail.com>
From: Songbo Bu <bluedognull@gmail.com>
Date: Fri, 03 Jul 2026 07:54:07 +0800
X-Gm-Features: AVVi8CdEuekGCF4liLNZwOmIZbouAAV7ckNaKmz_VmsdGseGssTRTG_ztSmAzw4
Message-ID: <CAK08nYaOBx7H0M6oACjf5KCwH1dTY_gw75D+=dbFuu1XfWLvfg@mail.gmail.com>
To: Nathanael Ritz <nathanritz@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Message-ID-Hash: CYKHPT2XVVW6M6AOLZC427XRXYANFUP5
X-Message-ID-Hash: CYKHPT2XVVW6M6AOLZC427XRXYANFUP5
X-MailFrom: bluedognull@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: UFMRG IRTF <ufmrg@irtf.org>, seat@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Seat] Re: Comments on formal analysis of relay attacks in attested TLS (CVE-2026-33697)
List-Id: "Secure Evidence and Attestation Transport (SEAT) WG" <seat.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/seat/3w7-OW2CAVr0-QBz97eAMxB_nMI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/seat>
List-Help: <mailto:seat-request@ietf.org?subject=help>
List-Owner: <mailto:seat-owner@ietf.org>
List-Post: <mailto:seat@ietf.org>
List-Subscribe: <mailto:seat-join@ietf.org>
List-Unsubscribe: <mailto:seat-leave@ietf.org>

Hi Nathanael,

Thanks, this helps clarify the architectural point.

Let me ask the comparison more narrowly: for a hybrid intra-handshake
+ post-handshake attestation design, what concrete security property,
preferably formalizable as a protocol goal or query, justifies the
added intra-handshake component compared with post-handshake
attestation alone?

In particular, is the added property about cryptographic binding,
failure handling before application data, exposure before appraisal,
or deployment structure?

Best,
Songbo

v2.46.0 | Report a Bug | By Email | System Status