Subject: [Seat] Re: FW: New Version Notification for draft-fossati-seat-early-attestation-06.txt
From: Songbo Bu <[email-masked]>
To: tirumal reddy <[email-masked]>
Cc: Ionut Mihalcea <[email-masked]>, Muhammad Usama Sardar <[email-masked]>, "[email-masked]" <[email-masked]>, nd <[email-masked]>
Date: Sat, 8 Aug 2026 21:51:40 +0800
List-Id: "Secure Evidence and Attestation Transport (SEAT) WG" <seat.ietf.org>

tirumal reddy <[email-masked]> 于2026年8月7日周五 18:29写道：

> The attestation binder in Section 5.1.1 binds the Evidence to the
> ClientHello...ServerHello transcript, which commits to both peers'
> ephemeral key shares. The binder additionally incorporates the hash of the
> attester's TLS identity key (the public key of the attester's end-entity
> certificate used for authentication).  The binding is therefore specific to
> the two endpoints of the TLS connection in which the Evidence was produced.
>
Hi Tiru,

It is important to understand that:
partial transcript binding ≠ channel-secret binding
There is no secret in ClientHello...ServerHello transcript, and can simply
be relayed over by the target environment, analogous to the one shown in
intra-handshake.fail paper.

Also, for example, it does not bind to is the identity and
proof-of-possession of the key of the cloud provider. So we do not know
which server it is and hence, it breaks if a single server in the whole
world breaks, as shown in the ID-Crisis paper.

Best,
Songbo