[Seat] Re: Regarding symbolic analysis of draft-fossati-seat-early-attestation-06

[Songbo Bu <[e-mail]>]

Nathanael,

Thank you.

You have skipped some of my questions. So please narrowly answer them all.

You haven't explained the rationale on your statements for
draft-fossati-seat-early-attestation-06 and binder7.

You also haven't answered about vulnerability CVE-2026-33697.

Leaving the model untouched and using `rdata = (log_SH, pubEK)` which
abstractly models section 5.1.1 of this draft with ProVerif v2.05 on the
commit `819bb7f20ac458b27c9be2c91cce1e72b8b5f4f7` gives me G1=true,
G2=true, G3=false. Are you claiming that you get G3=true?

About Meta's binder, Meta and others may not be offended with it but that
is not my question. My question is technical. How can a very reputed
cybersecurity firm miss "niaeve binders" in their "extensive security
review"?

In your opinion, is the binder in draft-fossati-seat-early-attestation-06
also "niaeve binders"?

You also haven't answered my questions in
https://mailarchive.ietf.org/arch/msg/seat/pB39abN1QrH4_ATM_E78vxPTuxk/.

Best,
Songbo


Nathanael Ritz <[e-mail]> 于2026年8月10日周一 11:26写道：

> Hi,
>
> On Sun, 9 Aug 2026 at 20:59, Songbo Bu <[e-mail]> wrote:
>
>> [snip] My understanding is that `selfsign` is self-signed certificate for
>> the
>> key generated within the TEE. Evidence cannot be transmitted as it is
>> in TLS 1.3, so a self-signed certificate is generated. Could you
>> clarify what sense it would make to check the self-signed certificate
>> at client-side? What needs to be checked before gate release is the
>> signature using AK and that is correctly there in my reading
>> (
>> https://github.com/muhammad-usama-sardar/intra-handshake.fail/blob/819bb7f20ac458b27c9be2c91cce1e72b8b5f4f7/binder1/tls-lib-simple.pvl#L682
>> ).
>>
>
> The symbolic `selfsign` parameter is a redundant modeling bug. Within the
> CRT message of Usama's model, the Evidence is conveyed in the `quote`
> parameter. The ephemeral signing key is the `pubEK` parameter. However, as
> mentioned before, outside of introducing a modeling artifact, its presence
> is generally harmless. I say this because as one may have already seen, a
> query like "Property G-C2: Composition Property for Relay attack," already
> demonstrates that using the CH...SH checkpoint successfully mitigates
> CVE-2026-33697/EUVD-2026-16488 -- even with the modeling bug left
> untouched.
>
> On Sun, 9 Aug 2026 at 20:59, Songbo Bu <[e-mail]> wrote:
>
>> I don't think it is helpful to downplay someone's work by calling it
>> "niaeve binders". Do you really believe that tall companies like Meta
>> are using what you call as "niaeve binders"? According to section 8 of
>> intra-handshake.fail paper, that has gone through "extensive security
>> review" (
>> https://github.com/trailofbits/publications/blob/master/reviews/2025-08-meta-whatsapp-privateprocessing-securityreview.pdf
>> )
>> by a cybersecurity firm "Trail of Bits". In my search, Trail of Bits
>> appears to be a very reputed firm. Do you really believe that a very
>> reputed cybersecurity firm missed "niaeve binders" in their "extensive
>> security review"?
>>
>
> Absolutely. Funny, Usama asked me the exact same thing a few weeks ago
> [0]. The answer to that same question remains unchanged [1]: "I highly
> doubt [anyone] will be offended, if that's what you might be concerned
> about."
>
> Secure systems get better with a healthy dose of collaboration between
> both red teams (finding attacks) and blue teams (constructively guarding
> and mitigating). Both are highly valuable to the community.To quote someone
> else I spoke to in a discussion about this technology space, "it's all just
> a gigantic work in progress."
>
> Cheers,
> Nathanael
>
>
>>
>> Best,
>> Songbo
>>
>
> [0]
> https://github.com/CCC-Attestation/attested-tls-poc/pull/58#discussion_r3580301451
>
> [1]
> https://github.com/CCC-Attestation/attested-tls-poc/pull/58#discussion_r3580393272
>
> _______________________________________________
> Seat mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>