[Seat] Re: FW: New Version Notification for draft-fossati-seat-early-attestation-06.txt

[Iman Schrock <[e-mail]>]

All,

I also agree with Usama and Songbo. There is no binding to TLS 1.3
secrets and thus CVE-2026-33697 is clearly still applicable to this
version of draft.


Best,
Iman Schrock
Founder, EMILIA Protocolemiliaprotocol.ai


On Sat, 8 Aug 2026 21:51:40 +0800, Songbo Bu <[e-mail]> wrote:
> tirumal reddy <[e-mail]> 于2026年8月7日周五 18:29写道：
>
> The attestation binder in Section 5.1.1 binds the Evidence to the
ClientHello...ServerHello transcript, which commits to both peers'
ephemeral key shares. The binder additionally incorporates the hash of the
attester's TLS identity key (the public key of the attester's end-entity
certificate used for authentication). The binding is therefore specific to
the two endpoints of the TLS connection in which the Evidence was produced.
>
> Hi Tiru,
>
> It is important to understand that:
> partial transcript binding ≠ channel-secret binding
> There is no secret in ClientHello...ServerHello transcript, and can
simply be relayed over by the target environment, analogous to the one
shown in intra-handshake.fail paper.
>
> Also, for example, it does not bind to is the identity and
proof-of-possession of the key of the cloud provider. So we do not know
which server it is and hence, it breaks if a single server in the whole
world breaks, as shown in the ID-Crisis paper.
>
> Best,
>
> Songbo