[Seat] Re: FW: New Version Notification for draft-fossati-seat-early-attestation-06.txt

[Songbo Bu <[e-mail]>]

tirumal reddy <[e-mail]> 于2026年8月7日周五 18:29写道：

> The attestation binder in Section 5.1.1 binds the Evidence to the
> ClientHello...ServerHello transcript, which commits to both peers'
> ephemeral key shares. The binder additionally incorporates the hash of the
> attester's TLS identity key (the public key of the attester's end-entity
> certificate used for authentication).  The binding is therefore specific to
> the two endpoints of the TLS connection in which the Evidence was produced.
>
Hi Tiru,

It is important to understand that:
partial transcript binding ≠ channel-secret binding
There is no secret in ClientHello...ServerHello transcript, and can simply
be relayed over by the target environment, analogous to the one shown in
intra-handshake.fail paper.

Also, for example, it does not bind to is the identity and
proof-of-possession of the key of the cloud provider. So we do not know
which server it is and hence, it breaks if a single server in the whole
world breaks, as shown in the ID-Crisis paper.

Best,
Songbo