[Seat] Re: Updated Attacker Model in SEAT Use Cases Draft

[tirumal reddy <[e-mail]>]

Hi Songbo,

Right now the focus is to capture all the relevant threat vectors. Formal
properties come later, after the WG concludes on the attacker model, attack
vectors and security requirements.

On cross-connection replay: how a solution detects and handles it (abort or
otherwise) is a separate discussion for the solution drafts, not this
document.
On CVE-2026-33697: it is an instance of the cross-connection and relay
class already covered in the PR. What is it you would like to see covered
about it in the draft ?

Best Regards,
-Tiru

On Tue, 18 Aug 2026 at 07:39, Songbo Bu <[e-mail]> wrote:

> Tiru,
>
> Thank you. I have one narrow suggestion and two questions.
>
> I think the draft's flow could be:
>
> Threat model => Security goals => Formal properties
>
> The draft does not currently state the desired behavior when the
> server attempts a "cross-connection replay." Should the connection be
> aborted?
>
> How is CVE-2026-33697 covered by the threat model?
>
> Best,
> Songbo
>