[lamps] PKIX Attestation meeting notes 2023-05-22

[Mike Ounsworth <[e-mail]>]

Full meeting notes are in github [0].

Today we agreed to a slight change in direction for this group:
We will pause working on a vendor-agnostic key attestation format and focus first on defining a CSR attribute that allows key attestations that exist today
Yes Russ, this draft is mean to include and replace draft-ietf-lamps-key-attestation-ext.

We spent the meeting going through MSJ's ASN.1 for CSR attributes (in the file 2023-05-22-msj.isn in github [1]).

The general model we envision in the short-term for the CSR attribute is that a CA should be able to "forklift out" a proprietary key attestation blob and hand it to a command-line utility provided by a vendor that will validate the attestation and return the subject public key for comparison against the CSR.

To this end, we think the structures defined in draft-stjohns-csr-attest will do the trick since they allow for the following full use-cases  For full details, see the meeting notes in github [0].

1. Existing proprietary key attestation formats: just register yourself an OID, for example id-at-keyattest-entrust with a type OCTET STRING and you can put that into AttestStatement, ignoring the optional values.
2. We can later define a fully-ASN.1 statement format and assign it an OID. (this is the work Carl would want done in RATS)
3. MSJ will define a TPMAttestAttribute ASN.1 structure and OID to include in this document.
4. MSJ will define a WebAuthnOpaqueAttestAttribute ASN.1 structure and OID to include in this document.

Next Steps
---------------

* ACTION: MSJ and MikeO to update draft-stjohns-csr-attest to match -- mainly means adding the ASN.1 module and tweaking some of the text with short-term and long-term goals.

[0]: meeting notes: https://github.com/EntrustCorporation/draft-ounsworth-pkix-key-attestation/blob/master/meetingNotes/2023-05-22.md
[1]: msj.asn: https://github.com/EntrustCorporation/draft-ounsworth-pkix-key-attestation/blob/master/meetingNotes/2023-05-22-msj.asn
---
Mike Ounsworth
Software Security Architect, Entrust

Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.