[Seat] Re: Updated Attacker Model in SEAT Use Cases Draft

[Chengxin Huang <[e-mail]>]

Hello everyone,

My feedback is not welcomed on SEAT but I agree with Songbo that
CVE-2026-33697 must be added. I also suggest to add a pointer to [Edgeless]
advisory in attacker model. Both are wildly exploited and I don't see how
proposed text covers both. Making both explicit will help ensure everybody
agrees what is talked about and constructively move forward, following the
[advice] of Dr. Schmieg. If we don't account for the wild exploits in the
attacker model, nobody will use the SEAT protocol we are designing.

Best regards,

Chengxin Huang

[Edgeless]
https://github.com/edgelesssys/contrast/security/advisories/GHSA-hjgc-jc5v-fw7h

[advice]
https://mailarchive.ietf.org/arch/msg/seat/t8aobzB374lWiLzrVrORY7kGYyQ/

On Tue, Aug 18, 2026 at 4:09 PM Songbo Bu <[e-mail]> wrote:

> Tiru,
>
> Thank you for the answers. I want to followup more narrowly.
>
> The link between the following is missing:
> Threat model => Security goals
>
> The following section is missing:
> Formal properties
>
> On cross-connection replay handling: I think we can agree on desired
> handling in this draft and solutions can then implement this.
>
> On CVE-2026-33697: This is already exploited in the wild. Therefore,
> please make it explicit in the threat model. I don't think
> "cross-connection replay" is a standard term in the literature. I think
> CVE-2026-33697 is related to relay and not "cross-connection replay".
> Therefore, as a first step, making it explicit in the draft is useful for
> further discussion.
>
> Best,
> Songbo
>
> tirumal reddy <[e-mail]> 于2026年8月18日周二 14:26写道：
>
>> Hi Songbo,
>>
>> Right now the focus is to capture all the relevant threat vectors. Formal
>> properties come later, after the WG concludes on the attacker model, attack
>> vectors and security requirements.
>>
>> On cross-connection replay: how a solution detects and handles it (abort
>> or otherwise) is a separate discussion for the solution drafts, not this
>> document.
>> On CVE-2026-33697: it is an instance of the cross-connection and relay
>> class already covered in the PR. What is it you would like to see
>> covered about it in the draft ?
>>
>> Best Regards,
>> -Tiru
>>
>> On Tue, 18 Aug 2026 at 07:39, Songbo Bu <[e-mail]> wrote:
>>
>>> Tiru,
>>>
>>> Thank you. I have one narrow suggestion and two questions.
>>>
>>> I think the draft's flow could be:
>>>
>>> Threat model => Security goals => Formal properties
>>>
>>> The draft does not currently state the desired behavior when the
>>> server attempts a "cross-connection replay." Should the connection be
>>> aborted?
>>>
>>> How is CVE-2026-33697 covered by the threat model?
>>>
>>> Best,
>>> Songbo
>>>
>> _______________________________________________
> Seat mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>