Re: [SPICE] Why "The Entity Attestation Token" is inappropriate in the context of SPICE

["Tschofenig, Hannes" <[e-mail]>]

Hi Denis,

the use of attestation is not irrelevant in the context of SPICE since you want to be aware of what the security state of the hardware is. This is not a new concept - it has, for example, also been used by FIDO for their password-replacement protocol.

Additionally, there is the question about what attestation even means in the context of a human in the first place.

I would recommend you read through the RATS architecture draft to get a better understanding of what attestation is supposed to accomplish.

Ciao
Hannes

Von: SPICE <[e-mail]> Im Auftrag von Denis
Gesendet: Freitag, 15. September 2023 11:17
An: Orie Steele <[e-mail]>
Cc: [e-mail]
Betreff: [SPICE] Why "The Entity Attestation Token" is inappropriate in the context of SPICE

Hi Orie,

Thanks! This highlights one of the original distinguishing characteristics we had for SPICE, which was "machine / organization credential exchange at scale"
and not "personal credential presentations via mobile phones".

Please don't pick a new thread topic that is unrelated to your concern to re-open once again to address your concern about a mediator.

Hence, I changed the topic of this thread into:  Why "The Entity Attestation Token" is inappropriate in the context of SPICE

The W3C VCDM 2.0 Abstract starts with :

        "Credentials are a part of our daily lives; driver's licenses are used to assert that we are capable of operating a motor vehicle,
          university degrees can be used to assert our level of education, and government-issued passports enable us to travel between countries.
          This specification provides a mechanism to express these sorts of credentials on the Web in a way that is cryptographically secure,
          privacy respecting, and machine-verifiable".

It is quite clear that this document does not address "machine / organization credential exchange at scale",
nor "business-to-business / supply chain related credential use case".

It is quite clear that "The Entity Attestation Token" (draft-ietf-rats-eat-21) addresses a different topic.
Its Introduction states:

         "An Entity Attestation Token (EAT) is a message made up of claims about an entity.
          An entity may be a device, some hardware or some software".

Hence, EAT does not consider human beings.
I recognize there could be a lot of overlap here, especially regarding JWT / CWT... but I think it's important not to limit digital credential solutions
to ones that work only on mobile devices, especially for business-to-business / supply chain related credential use cases.

Perhaps mDoc would have looked differently if https://datatracker.ietf.org/doc/draft-ietf-rats-eat<https://datatracker.ietf.org/doc/draft-ietf-rats-eat/> and https://datatracker.ietf.org/doc/draft-prorock-cose-sd-cwt<https://datatracker.ietf.org/doc/draft-prorock-cose-sd-cwt/> had come sooner.

Maybe it's ok to have a unique claims oriented data model for mobile (personal?) credentials that is not interoperable or aligned with the data models
we have for id_token's and access_tokens.

I'm not an ISO contributor, so I can't tell what they are doing... Are they trying to make a credential format that only works for mobile devices
and personal credential use cases, where the subject of the credential is some kind of human who owns or shares a smartphone?

ISO is a large organization and it is difficult to be aware of what each SC (Standardization Committee) is doing. The ISO/IEC 23220 series
which is currently under development by ISO/IEC JTC 1/SC 17 (Cards and security devices for personal identification) intends
to be backwards compatible with the mDL.

However, the mDL has serious limitations. IMO, the most critical one is that it cannot support the Unlinkability privacy property between verifiers.

Denis

OS

On Thu, Sep 14, 2023 at 3:16 AM Denis <[e-mail]<mailto:[e-mail]>> wrote:
Hi everyone,
I open a new thread to indicate that ISO is currently working on six topics which are closely related to the possible scope of SPICE:
ISO/IEC 23220 series: Building blocks for identity management via mobile devices
The first one has been published this year as an IS, while the other parts which are targeted to be TSs rather than ISs are "under development".

ISO/IEC 23220-1:2023 : Cards and security devices for personal identification — Building blocks for identity management via mobile devices
— Part 1: Generic system architectures of mobile eID systems

ISO/IEC CD TS 23220-2: Cards and security devices for personal identification — Building blocks for identity management via mobile devices
— Part 2: Data objects and encoding rules for generic eID systems

ISO/IEC CD TS 23220-3: Cards and security devices for personal identification — Building blocks for identity management via mobile devices
— Part 3: Protocols and services for issuing phase

ISO/IEC CD TS 23220-4: Cards and security devices for personal identification — Building blocks for identity management via mobile devices
— Part 4: Protocols and services for operational phase

ISO/IEC CD TS 23220-5 : Cards and security devices for personal identification — Building blocks for identity management via mobile devices
— Part 5: Trust models and confidence level assessment

ISO/IEC CD TS 23220-6 :Cards and security devices for personal identification — Building blocks for identity management via mobile devices
— Part 6: Mechanism for use of certification on trustworthiness of secure area

The ISO site provides information about the published Part 1: https://www.iso.org/obp/ui/en/#iso:std:iso-iec:23220:-1:ed-1:v1:en

The ISO/IEC 23220 series inherits and enhances the functionality that was adopted by mobile driving licence applications
whereby ensuring backward compatibility with ISO/IEC 18013-5.

Other parts in the ISO/IEC 23220 series specify the following:

    — generic data formats (see ISO/IEC TS 23220-2);
    — protocols and services for issuing phase (see ISO/IEC TS 23220-3);
    — protocols and services for operational phase (see ISO/IEC TS 23220-4);
    — trust models and confidence levels (see ISO/IEC TS 23220-5);
    — mechanism for use of certification on trustworthiness of secure area (see ISO/IEC TS 23220-6).

Denis
--
SPICE mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/spice


--



ORIE STEELE Chief Technology Officer www.transmute.industries<http://www.transmute.industries/>

[cid:image001.png@01D9EA11.B61D7DF0]<https://transmute.industries/>