Verifiers appraise the authenticity of Evidence A set of information about an Attester that is to be appraised by <del> a Verifier </del>  A role performed by an entity that depends on the validity of information about an Attester, for purposes of reliably applying

This is based upon comments in .
Ok with me, but I thought there was some resistance to "telemetry" so I thought others might want that word removed. I'm ok either way.
Kathleen's comment: For evidence, should this definition be more about what evidence is rather than about the roles involved? The attester may not be the same component or system that attests to the evidence as well. Evidence could be measurement data, telemetry (e.g. counters on a system interface - YANG or SNMP), results of a policy comparison to configuration data). Perhaps:
I think attestation pertains to the claims that most directly affect trustworthiness. Since a telemetry, auditing, AV scan etc… are code that is presumed to be telling the truth, they depend on Attestation for evidence they’re valid. They are examples of what might be in a Target Environment. Greetings! I took some time to review the current version of the architecture document and have some comments and suggestions. The comments are from the editor's version. Please do post early and often updates to the IETF draft repository. Version numbers do not matter, it's okay to have a large number :-) These are meant to be helpful comments to improve the draft. Introduction: Could we change: From: Trust is a decision being made. To: To trust is a decision that spans beyond the technical assertions. I struggle a little with the following: "Trustworthiness is a quality that is assessed via evidence created." As when one determines trustworthiness, it may span beyond evidence that is "created". Perhaps drop the word created? I think it spans beyond that as well, but may be too nit picky to expand. The evidence could have to do with something other then the system and those who manage it for instance. Terminology: The following definition should be just for "appraisal policy" unless there are other types of appraisal policies in context for this body of work: Appraisal Policy for Attestation Result: A set of rules that direct how a Relying Party uses the Attestation Results regarding an Attester generated by the Verifiers. Compare /security policy/ in [RFC4949] I don't think direct is the right word. If this is so you can make judgments on relying party decisions, the policy is more of a statement on the decision process than how they are directed, which could be more subjective. The verifier here reads as if they generate the policy, but are verifying against a set policy. Proposed: A set of rules for a Relying Party to verify attestation results. The following 'definition' seems to get into role recommendations rather than being a definition: Attester: An entity whose attributes must be appraised in order to determine whether the entity is considered trustworthy, such as when deciding whether the entity is authorized to perform some operation Shouldn't this stick to what an attester is/does? Perhaps: attester - entity who puts forth data that may include configuration or static system information, evidence, or claims. The evidence may be digitally signed. For evidence, should this definition be more about what evidence is rather than about the roles involved? The attester may not be the same component or system that attests to the evidence as well. Evidence could be measurement data, telemetry (e.g. counters on a system interface - YANG or SNMP), results of a policy comparison to configuration data). Evidence: A set of information about an Attester that is to be appraised by a Verifier Perhaps: Evidence: Information about or originating from a system/firmware/software that may include configuration data, measurements, telemetry, or inferences. Is the following definition necessary? Verifier Owner: An entity, such as an administrator, that is authorized to configure Appraisal Policy for Evidence in a Verifier Section 3: Consider changing the following sentence: From: " Each use case includes a description, and a summary of what an Attester and a Relying Party refer to in the use case." To: " Each use case includes a description followed by a summary of the Attester and a Relying Party roles." Section 3.1: Sentence 1: Consider changing from: "Network operators want a trustworthy report of identity and version of information of the hardware and software on the machines attached to their network, for purposes such as inventory, auditing, and/or logging." To: "Network operators want a trustworthy report that includes identity and version of information of the hardware and software on the machines attached to their network, for purposes such as inventory, audit, anomaly detection, record maintenance and/or trending reports (logging)." In the following sentence, "health" is fine, but did you consider the more commonly used, "hygiene"? >From the editor's version: "Typically, solutions start with a specific component (called a "Root of Trust") that provides device identity and protected storage for measurements. These components perform a series of measurements, and express this with Evidence as to the hardware and firmware/software that is running." Perhaps better stated as: "Typically, solutions start with a specific component (called a "Root of Trust") that provides device identity and protected storage for measurements. The system components perform a series of measurements that may be signed by the Root of Trust, considered as Evidence of the hardware, firmware, BIOS, software, etc. that is running." "express this with" is confusing and possibly misleading. This proposed phrasing allows for evidence to be broader than the series of measurements as it might include system or configuration information. It's not the RoT that does the measurements, but they do attest to it. Would the attester in this example be the root of trust of the device rather than the full system? Section 3.2: Perhaps change the wording from: "A device manufacturer wants to protect its intellectual property in terms of the ML model it developed and that runs in the devices that its customers purchased, and it wants to prevent attackers, potentially including the customer themselves, from seeing the details of the model." To: "A device manufacturer wants to protect its intellectual property. This is primarily the ML model it developed and runs in the devices purchased by its customers. The goals for the protection include preventing attackers, potentially the customer themselves, from seeing the details of the model." I'm confused by the phrasing of the rest of the section and am wondering if it can be improved. Current: "This typically works by having some protected environment in the device attest to some manufacturer service. If remote attestation succeeds, then the manufacturer service releases either the model, or a key to decrypt a model the Attester already has in encrypted form, to the requester. Attester: A device desiring to run an ML model to do inferencing Relying Party: A server or service holding ML models it desires to protect" I think it would help to talk about inferences in the written description. For the attester, if it's the whole system as opposed to a component, then then definition makes sense. I'm wondering if it is crisper when narrowed. RoT captures inferences of the ML modeling used as evidence. Does the relying party hold the ML model or knowledge of expected inferences? I'm happy to propose alternative text once I have more information to more fully understand the use case. Section 3.3:This one took a couple of reads to understand. While it is understandable, it could be more explicit to make it easier to get on first read. How about changing the following From: Attestation is desired to prevent leaking data to compromised devices. To: "An assessment of system hygiene is made against a set of policies to verify the state of a system using attestations for the system requesting data. Attestation is desired to prevent leaking data to compromised devices." Section 3.6 Nit: From: "One significant problem is malware that holds a device hostage and does not allow it to reboot to prevent updates to be applied. " To: "One significant problem is malware that holds a device hostage and does not allow it to reboot to prevent updates from being applied. Remote attestation aids in the verification process that may occur locally as well as it is less likely that the policy or verification processes have also been compromised if hosted on a separate system." The second sentence is suggested as this also occurs locally on systems today, but there is value in having this via remote attestation. I'll send the next batch when I get far enough through the document. I didn't want to hold up on these comments. Thank you for all your work on the document! Best regards, Kathleen

Verifiers appraise the authenticity of Evidence A set of information about an Attester that is to be appraised by  <ins> a Verifier.  Evidence may include configuration data, measurements, telemetry, or inferences. </ins> A role performed by an entity that depends on the validity of information about an Attester, for purposes of reliably applying


One significant problem is malware that holds a device hostage and does not allow it to reboot to prevent updates from being applied. <del> Remote attestation aids in the verification process that may occur locally as well as it is less likely that the policy or verification processes have also been compromised if hosted on a separate system. </del> This is a significant problem, because it allows a fleet of devices to be held hostage for ransom. <del> A hardware watchdog can be implemented by forcing a reboot unless remote attestation to a server succeeds within a periodic interval, and having the reboot do remediation by bringing a device into compliance, including installation of patches as needed. </del>  The device that is desired to keep from being held hostage for a long period of time

text proposal for changes in
OLD: NEW: Greetings! I took some time to review the current version of the architecture document and have some comments and suggestions. The comments are from the editor's version. Please do post early and often updates to the IETF draft repository. Version numbers do not matter, it's okay to have a large number :-) These are meant to be helpful comments to improve the draft. Introduction: Could we change: From: Trust is a decision being made. To: To trust is a decision that spans beyond the technical assertions. I struggle a little with the following: "Trustworthiness is a quality that is assessed via evidence created." As when one determines trustworthiness, it may span beyond evidence that is "created". Perhaps drop the word created? I think it spans beyond that as well, but may be too nit picky to expand. The evidence could have to do with something other then the system and those who manage it for instance. Terminology: The following definition should be just for "appraisal policy" unless there are other types of appraisal policies in context for this body of work: Appraisal Policy for Attestation Result: A set of rules that direct how a Relying Party uses the Attestation Results regarding an Attester generated by the Verifiers. Compare /security policy/ in [RFC4949] I don't think direct is the right word. If this is so you can make judgments on relying party decisions, the policy is more of a statement on the decision process than how they are directed, which could be more subjective. The verifier here reads as if they generate the policy, but are verifying against a set policy. Proposed: A set of rules for a Relying Party to verify attestation results. The following 'definition' seems to get into role recommendations rather than being a definition: Attester: An entity whose attributes must be appraised in order to determine whether the entity is considered trustworthy, such as when deciding whether the entity is authorized to perform some operation Shouldn't this stick to what an attester is/does? Perhaps: attester - entity who puts forth data that may include configuration or static system information, evidence, or claims. The evidence may be digitally signed. For evidence, should this definition be more about what evidence is rather than about the roles involved? The attester may not be the same component or system that attests to the evidence as well. Evidence could be measurement data, telemetry (e.g. counters on a system interface - YANG or SNMP), results of a policy comparison to configuration data). Evidence: A set of information about an Attester that is to be appraised by a Verifier Perhaps: Evidence: Information about or originating from a system/firmware/software that may include configuration data, measurements, telemetry, or inferences. Is the following definition necessary? Verifier Owner: An entity, such as an administrator, that is authorized to configure Appraisal Policy for Evidence in a Verifier Section 3: Consider changing the following sentence: From: " Each use case includes a description, and a summary of what an Attester and a Relying Party refer to in the use case." To: " Each use case includes a description followed by a summary of the Attester and a Relying Party roles." Section 3.1: Sentence 1: Consider changing from: "Network operators want a trustworthy report of identity and version of information of the hardware and software on the machines attached to their network, for purposes such as inventory, auditing, and/or logging." To: "Network operators want a trustworthy report that includes identity and version of information of the hardware and software on the machines attached to their network, for purposes such as inventory, audit, anomaly detection, record maintenance and/or trending reports (logging)." In the following sentence, "health" is fine, but did you consider the more commonly used, "hygiene"? >From the editor's version: "Typically, solutions start with a specific component (called a "Root of Trust") that provides device identity and protected storage for measurements. These components perform a series of measurements, and express this with Evidence as to the hardware and firmware/software that is running." Perhaps better stated as: "Typically, solutions start with a specific component (called a "Root of Trust") that provides device identity and protected storage for measurements. The system components perform a series of measurements that may be signed by the Root of Trust, considered as Evidence of the hardware, firmware, BIOS, software, etc. that is running." "express this with" is confusing and possibly misleading. This proposed phrasing allows for evidence to be broader than the series of measurements as it might include system or configuration information. It's not the RoT that does the measurements, but they do attest to it. Would the attester in this example be the root of trust of the device rather than the full system? Section 3.2: Perhaps change the wording from: "A device manufacturer wants to protect its intellectual property in terms of the ML model it developed and that runs in the devices that its customers purchased, and it wants to prevent attackers, potentially including the customer themselves, from seeing the details of the model." To: "A device manufacturer wants to protect its intellectual property. This is primarily the ML model it developed and runs in the devices purchased by its customers. The goals for the protection include preventing attackers, potentially the customer themselves, from seeing the details of the model." I'm confused by the phrasing of the rest of the section and am wondering if it can be improved. Current: "This typically works by having some protected environment in the device attest to some manufacturer service. If remote attestation succeeds, then the manufacturer service releases either the model, or a key to decrypt a model the Attester already has in encrypted form, to the requester. Attester: A device desiring to run an ML model to do inferencing Relying Party: A server or service holding ML models it desires to protect" I think it would help to talk about inferences in the written description. For the attester, if it's the whole system as opposed to a component, then then definition makes sense. I'm wondering if it is crisper when narrowed. RoT captures inferences of the ML modeling used as evidence. Does the relying party hold the ML model or knowledge of expected inferences? I'm happy to propose alternative text once I have more information to more fully understand the use case. Section 3.3:This one took a couple of reads to understand. While it is understandable, it could be more explicit to make it easier to get on first read. How about changing the following From: Attestation is desired to prevent leaking data to compromised devices. To: "An assessment of system hygiene is made against a set of policies to verify the state of a system using attestations for the system requesting data. Attestation is desired to prevent leaking data to compromised devices." Section 3.6 Nit: From: "One significant problem is malware that holds a device hostage and does not allow it to reboot to prevent updates to be applied. " To: "One significant problem is malware that holds a device hostage and does not allow it to reboot to prevent updates from being applied. Remote attestation aids in the verification process that may occur locally as well as it is less likely that the policy or verification processes have also been compromised if hosted on a separate system." The second sentence is suggested as this also occurs locally on systems today, but there is value in having this via remote attestation. I'll send the next batch when I get far enough through the document. I didn't want to hold up on these comments. Thank you for all your work on the document! Best regards, Kathleen

One significant problem is malware that holds a device hostage and does not allow it to reboot to prevent updates from being applied.  This is a significant problem, because it allows a fleet of devices to be held hostage for ransom.  <ins> In the case, the Relying Party is the Watch Dog timer in the TPM/ secure enclave itself, as described in TCGarch section 43.3.  The Attestation Results are returned to the device, and provided to the enclave. If the watch dog does not receive regular, and fresh, Attestation Results as to the systems' health, then it forces a reboot. </ins> The device that is desired to keep from being held hostage for a long period of time


audit, anomaly detection, record maintenance and/or trending reports (logging).  The network operator may also want a policy by which full access is only granted to devices that meet some definition of <del> health, and so wants to get claims about such information and verify </del>  their validity.  Remote attestation is desired to prevent vulnerable or compromised devices from getting access to the network and potentially harming others.

health->hygiene
Kathleen's comment: Did you consider the more commonly used, "hygiene"? Greetings! I took some time to review the current version of the architecture document and have some comments and suggestions. The comments are from the editor's version. Please do post early and often updates to the IETF draft repository. Version numbers do not matter, it's okay to have a large number :-) These are meant to be helpful comments to improve the draft. Introduction: Could we change: From: Trust is a decision being made. To: To trust is a decision that spans beyond the technical assertions. I struggle a little with the following: "Trustworthiness is a quality that is assessed via evidence created." As when one determines trustworthiness, it may span beyond evidence that is "created". Perhaps drop the word created? I think it spans beyond that as well, but may be too nit picky to expand. The evidence could have to do with something other then the system and those who manage it for instance. Terminology: The following definition should be just for "appraisal policy" unless there are other types of appraisal policies in context for this body of work: Appraisal Policy for Attestation Result: A set of rules that direct how a Relying Party uses the Attestation Results regarding an Attester generated by the Verifiers. Compare /security policy/ in [RFC4949] I don't think direct is the right word. If this is so you can make judgments on relying party decisions, the policy is more of a statement on the decision process than how they are directed, which could be more subjective. The verifier here reads as if they generate the policy, but are verifying against a set policy. Proposed: A set of rules for a Relying Party to verify attestation results. The following 'definition' seems to get into role recommendations rather than being a definition: Attester: An entity whose attributes must be appraised in order to determine whether the entity is considered trustworthy, such as when deciding whether the entity is authorized to perform some operation Shouldn't this stick to what an attester is/does? Perhaps: attester - entity who puts forth data that may include configuration or static system information, evidence, or claims. The evidence may be digitally signed. For evidence, should this definition be more about what evidence is rather than about the roles involved? The attester may not be the same component or system that attests to the evidence as well. Evidence could be measurement data, telemetry (e.g. counters on a system interface - YANG or SNMP), results of a policy comparison to configuration data). Evidence: A set of information about an Attester that is to be appraised by a Verifier Perhaps: Evidence: Information about or originating from a system/firmware/software that may include configuration data, measurements, telemetry, or inferences. Is the following definition necessary? Verifier Owner: An entity, such as an administrator, that is authorized to configure Appraisal Policy for Evidence in a Verifier Section 3: Consider changing the following sentence: From: " Each use case includes a description, and a summary of what an Attester and a Relying Party refer to in the use case." To: " Each use case includes a description followed by a summary of the Attester and a Relying Party roles." Section 3.1: Sentence 1: Consider changing from: "Network operators want a trustworthy report of identity and version of information of the hardware and software on the machines attached to their network, for purposes such as inventory, auditing, and/or logging." To: "Network operators want a trustworthy report that includes identity and version of information of the hardware and software on the machines attached to their network, for purposes such as inventory, audit, anomaly detection, record maintenance and/or trending reports (logging)." In the following sentence, "health" is fine, but did you consider the more commonly used, "hygiene"? >From the editor's version: "Typically, solutions start with a specific component (called a "Root of Trust") that provides device identity and protected storage for measurements. These components perform a series of measurements, and express this with Evidence as to the hardware and firmware/software that is running." Perhaps better stated as: "Typically, solutions start with a specific component (called a "Root of Trust") that provides device identity and protected storage for measurements. The system components perform a series of measurements that may be signed by the Root of Trust, considered as Evidence of the hardware, firmware, BIOS, software, etc. that is running." "express this with" is confusing and possibly misleading. This proposed phrasing allows for evidence to be broader than the series of measurements as it might include system or configuration information. It's not the RoT that does the measurements, but they do attest to it. Would the attester in this example be the root of trust of the device rather than the full system? Section 3.2: Perhaps change the wording from: "A device manufacturer wants to protect its intellectual property in terms of the ML model it developed and that runs in the devices that its customers purchased, and it wants to prevent attackers, potentially including the customer themselves, from seeing the details of the model." To: "A device manufacturer wants to protect its intellectual property. This is primarily the ML model it developed and runs in the devices purchased by its customers. The goals for the protection include preventing attackers, potentially the customer themselves, from seeing the details of the model." I'm confused by the phrasing of the rest of the section and am wondering if it can be improved. Current: "This typically works by having some protected environment in the device attest to some manufacturer service. If remote attestation succeeds, then the manufacturer service releases either the model, or a key to decrypt a model the Attester already has in encrypted form, to the requester. Attester: A device desiring to run an ML model to do inferencing Relying Party: A server or service holding ML models it desires to protect" I think it would help to talk about inferences in the written description. For the attester, if it's the whole system as opposed to a component, then then definition makes sense. I'm wondering if it is crisper when narrowed. RoT captures inferences of the ML modeling used as evidence. Does the relying party hold the ML model or knowledge of expected inferences? I'm happy to propose alternative text once I have more information to more fully understand the use case. Section 3.3:This one took a couple of reads to understand. While it is understandable, it could be more explicit to make it easier to get on first read. How about changing the following From: Attestation is desired to prevent leaking data to compromised devices. To: "An assessment of system hygiene is made against a set of policies to verify the state of a system using attestations for the system requesting data. Attestation is desired to prevent leaking data to compromised devices." Section 3.6 Nit: From: "One significant problem is malware that holds a device hostage and does not allow it to reboot to prevent updates to be applied. " To: "One significant problem is malware that holds a device hostage and does not allow it to reboot to prevent updates from being applied. Remote attestation aids in the verification process that may occur locally as well as it is less likely that the policy or verification processes have also been compromised if hosted on a separate system." The second sentence is suggested as this also occurs locally on systems today, but there is value in having this via remote attestation. I'll send the next batch when I get far enough through the document. I didn't want to hold up on these comments. Thank you for all your work on the document! Best regards, Kathleen

audit, anomaly detection, record maintenance and/or trending reports (logging).  The network operator may also want a policy by which full access is only granted to devices that meet some definition of  <ins> hygiene, and so wants to get claims about such information and verify </ins> their validity.  Remote attestation is desired to prevent vulnerable or compromised devices from getting access to the network and potentially harming others.


seeing the details of the model. This typically works by having some protected environment in the <del> device attest to some manufacturer service.  If remote attestation succeeds, then the manufacturer service releases either the model, or a key to decrypt a model the Attester already has in encrypted form, to the requester. </del>  A device desiring to run an ML model to do inferencing A "Trusted Application Manager (TAM)" server is responsible for managing the applications running in the TEE of a client device.  To do this, the TAM wants to assess the state of a TEE, or of <del> applications in the TEE, of a client device.  The TEE attests to the TAM, which can then decide whether the TEE is already in compliance with the TAM's latest policy, or if the TAM needs to uninstall, update, or install approved applications in the TEE to bring it back into compliance with the TAM's policy. </del>  A device with a trusted execution environment capable of running trusted applications that can be updated 7.  The scope of this document is scenarios for which a Relying Party trusts a Verifier that can appraise the trustworthiness of information about an Attester.  Such trust might come by the Relying Party trusting the Verifier (or its public key) directly, or might come by trusting an entity (e.g., a Certificate Authority) that is in <del> the Verifier's certificate chain.  The Relying Party might implicitly trust a Verifier (such as in the Verifying Relying Party combination).  Or, for a stronger level of security, the Relying Party might require that the Verifier itself provide information about itself that the Relying Party can use to assess the </del>  trustworthiness of the Verifier before accepting its Attestation Results. <del> The Endorser and Verifier Owner may need to trust the Verifier before giving the Endorsement and Appraisal Policy to it.  Such trust can also be established directly or indirectly, implicitly or explicitly. One explicit way to establish such trust may be the Verifier first acts as an Attester and creates Evidence about itself to be consumed by the Endorser and/or Verifier Owner as the Relying Parties.  If it is accepted as trustworthy, then they can provide Endorsements and Appraisal Policies that enable it to act as a Verifier. </del>  The Verifier trusts (or more specifically, the Verifier's security policy is written in a way that configures the Verifier to trust) a material and the Attesting Environment with equivalent strength protections. <del> In some scenarios, Evidence might contain sensitive information such as Personally Identifiable Information.  Thus, an Attester must trust entities to which it conveys Evidence, to not reveal sensitive data to unauthorized parties.  The Verifier might share this information with other authorized parties, according rules that it controls.  In the background-check model, this Evidence may also be revealed to Relying Party(s). </del>  8.

Diffs look longer than they really are just because text was moved around due to the ordering point raised on the design team call. Also, I found that "Verifying Relying Party" was used in this section without actually being defined so I defined it in context in that sentence (line 686). Also added subsection headings for each role to make it easier to read and refer to. The "recursion" aspect is dealt with by example in the new text starting at line 692, which was the simplest way I could find to do it, where I found that trying to use the term "recurse" or similar just made it harder for me to understand. Other places just refer back to that example. Signed-off-by: Dave Thaler

seeing the details of the model. This typically works by having some protected environment in the  <ins> device go through a remote attestation with some manufacturer service that can assess its trustworthiness.  If remote attestation succeeds, then the manufacturer service releases either the model, or a key to decrypt a model the Attester already has in encrypted form, to the requester. </ins> A device desiring to run an ML model to do inferencing A "Trusted Application Manager (TAM)" server is responsible for managing the applications running in the TEE of a client device.  To do this, the TAM wants to assess the state of a TEE, or of  <ins> applications in the TEE, of a client device.  The TEE conducts a remote attestation procedure with the TAM, which can then decide whether the TEE is already in compliance with the TAM's latest policy, or if the TAM needs to uninstall, update, or install approved applications in the TEE to bring it back into compliance with the TAM's policy. </ins> A device with a trusted execution environment capable of running trusted applications that can be updated 7. <ins> 7.1. </ins> The scope of this document is scenarios for which a Relying Party trusts a Verifier that can appraise the trustworthiness of information about an Attester.  Such trust might come by the Relying Party trusting the Verifier (or its public key) directly, or might come by trusting an entity (e.g., a Certificate Authority) that is in  <ins> the Verifier's certificate chain. The Relying Party might implicitly trust a Verifier, such as in a Verifier/Relying Party combination where the Verifier and Relying Party roles are combined.  Or, for a stronger level of security, the Relying Party might require that the Verifier first provide information about itself that the Relying Party can use to assess the </ins> trustworthiness of the Verifier before accepting its Attestation Results.  <ins> For example, one explicit way for a Relying Party "A" to establish such trust in a Verifier "B", would be for B to first act as an Attester where A acts as a combined Verifier/Relying Party.  If A then accepts B as trustworthy, it can choose to accept B as a Verifier for other Attesters. Similarly, the Relying Party also needs to trust the Relying Party Owner for providing its Appraisal Policy for Attestation Results, and in some scenarios the Relying Party might even require that the Relying Party Owner go through a remote attestation procedure with it before the Relying Party will accept an updated policy.  This can be done similarly to how a Relying Party could establish trust in a Verifier as discussed above. 7.2. In some scenarios, Evidence might contain sensitive information such as Personally Identifiable Information.  Thus, an Attester must trust entities to which it conveys Evidence, to not reveal sensitive data to unauthorized parties.  The Verifier might share this information with other authorized parties, according to rules that it controls. In the background-check model, this Evidence may also be revealed to Relying Party(s). In some cases where Evidence contains sensitive information, an Attester might even require that a Verifier first go through a remote attestation procedure with it before the Attester will send the sensitive Evidence.  This can be done by having the Attester first act as a Verifier/Relying Party, and the Verifier act as its own Attester, as discussed above. 7.3. The Relying Party Owner might also require that the Relying Party first act as an Attester, providing Evidence that the Owner can appraise, before the Owner would give the Relying Party an updated policy that might contain sensitive information.  In such a case, mutual attestation might be needed, in which case typically one side's Evidence must be considered safe to share with an untrusted entity, in order to bootstrap the sequence. 7.4. </ins> The Verifier trusts (or more specifically, the Verifier's security policy is written in a way that configures the Verifier to trust) a material and the Attesting Environment with equivalent strength protections.  <ins> 7.5. In some scenarios, the Endorser and Verifier Owner may need to trust the Verifier before giving the Endorsement and Appraisal Policy to it.  This can be done similarly to how a Relying Party might establish trust in a Verifier as discussed above, and in such a case, mutual attestation might even be needed as discussed in rpowner- trust. </ins> 8.


1. <del> 2. </del>  <del> The document defines the term "Remote Attestation" as follows: A process by which one entity (the "Attester") provides evidence about its identity and state to another remote entity (the "Relying Party"), which then assesses the Attester's trustworthiness for the Relying Party's own purposes. </del>  <del> This document then uses the following terms: </del>  Appraisal Policy for Evidence: A set of rules that direct how a verifier evaluates the validity of information about an Attester. authorized to configure Appraisal Policy for Evidence in a Verifier. <del> [EDITORIAL NOTE] The term Attestation and Remote Attestation are not defined in this document, at this time.  This document will include pointers to industry uses of the terms, in an attempt to gain consensus around the term, and be consistent with the charter text defining this term. </del> 3. 4.

Removed incorrect text that said Remote Attestation was not defined in the doc. Moved Remote Attestation paragraph to the introduction section where I think it will (eventually) make sense in the context of introduction text. Signed-off-by: Dave Thaler
See comments in URL this term gets re-introduced here, without any annotation. The appraisal policy are the rules on how to test the evidence. Here, "Attestation" is the creation of the evidence Often people use the term "Attestation" to refer to the whole process. Suggestion that we should define this term somewhere, but maybe "Remote Attestation"? NAME FIDO has NONE-Attestation-Type, where there is no assessment. TCG would call this Implicit Attestation. URL NAME Let's take this to the WG, and maybe we can not get consensus on this term. NAME Charter says: "Remote attestation procedures (RATS) enable relying parties to establish a level of confidence in the trustworthiness of remote system components through the creation of attestation evidence by remote system components and a processing chain towards the relying party."
PR added a paragraph defining Remote Attestation, and PR does some additional cleanup.
Can we close this issue now that PR and PR are merged?
yes

1.  <ins> Remote Attestation, as used in this document, is a process by which one entity (the "Attester") provides evidence about its identity and state to another remote entity (the "Relying Party"), which then assesses the Attester's trustworthiness for the Relying Party's own purposes. </ins>  <ins> 2. </ins>  <ins> This document uses the following terms: </ins> Appraisal Policy for Evidence: A set of rules that direct how a verifier evaluates the validity of information about an Attester. authorized to configure Appraisal Policy for Evidence in a Verifier.  3. 4.


4.3. <del> By definition, the Attester role takes on the duty to create Evidence.  The fact that an Attester role is composed of environments that can be nested or staged adds complexity to the architectural layout of how an Attester can be composed and therefore has to conduct the Claims collection in order to create believable attestation Evidence. </del>  layered depicts an example of a device that includes (A) a BIOS stored in read-only memory in this example, (B) an updatable measured and signed by the BIOS, plus a set of Claims about the kernel as measured and signed by the bootloader. <del> This example could be extended further by, say, making the kernel become another Attesting Environment for an application as another Target Environment, resulting in a third set of Claims in the </del>  Evidence pertaining to that application. The essence of this example is a cascade of staged environments.

URL Greetings! I got as far as I could with time constraints through the rest of the document. There are a few sections I'll likely go back over again as I was short on time when reviewing them, but do hope this is helpful towards improving the document. This review is from the editors revision on github that I started my review earlier int he week. Section 4.2: I find the following grouping a bit confusing: "Places that Attesting Environments can exist include Trusted Execution Environments (TEE), embedded Secure Elements (eSE), and BIOS firmware." This has an attesting environment as a processor, an element, and as compiled code. That doesn't seem right, especially when you refer to the attesting environment as a "place". Do you mean where BIOS is executed perhaps? I would expect a TEE and maybe other components where security functions are offloaded, which is in some cases to a processor other than a TEE like a GPU (I'm not making a recommendation to do that here, just stating what is happening in ecosystems that exist). The following text is a little confusing, in particular, the last sentence: "An execution environment may not, by default, be capable of claims collection for a given Target Environment. Attesting Environments are designed specifically with claims collection in mind." If the attesting environment is a place, TEEs and other processors were not necessarily designed with claims in mind. If you can help to explain an attesting environment better, I can help to phrase it more clearly to convey the intended set of points as I think there are several. Section 4.3 Consider changing from: "By definition, the Attester role takes on the duty to create Evidence." To: "By definition, the Attester role creates Evidence." The following sentence is a run on and I think some additional information will help provide clarity. I don't think it's the role that is composed of nest environments. Current: "The fact that an Attester role is composed of environments that can be nested or staged adds complexity to the architectural layout of how an Attester can be composed and therefore has to conduct the Claims collection in order to create believable attestation Evidence." How about: "An Attester may be one or more nested or staged environments, adding complexity to the architectural structure. The unifying component is the root of trust and the nested, staged, or chained attestations produced. The nested or chained structure should include claims, collected by the attester to aid in the assurance or believability of the attestation Evidence." The following sentence should be broken into two: "This example could be extended further by, say, making the kernel become another Attesting Environment for an application as another Target Environment, resulting in a third set of Claims in the Evidence pertaining to that application." Proposed: "This example could be extended further by making the kernel become another Attesting Environment for an application as another Target Environment. This results in a third set of Claims in the Evidence pertaining to that application." How about changing the following sentence from: "Among these routers, there is only one main router that connects to the Verifier. " To: "A multi-chassis router, provides a management point and is the only one that connects to the Verifier. " For the following sentence, trying to remove the use of a word twice in a row and convey the same intent. Old: "After collecting the Evidence of other Attesters, this inside Verifier verifies them using Endorsements and Appraisal Policies (obtained the same way as any other Verifier), to generate Attestation Results." Proposed: "After collecting the Evidence of other Attesters, this inside Verifier uses Endorsements and Appraisal Policies (obtained the same way as any other Verifier) in the verification process to generate Attestation Results." I may try another pass at section 4 to improve readability. Section 5, Consider breaking this into 2 sentences, from: "This section includes some reference models, but this is not intended to be a restrictive list, and other variations may exist." To: "This section includes some reference models. This is not intended to be a restrictive list, and other variations may exist." Section 5.1 Two result words together is not necessary. Change from: "The second way in which the process may fail is when the resulting Result is examined by the Relying Party, and based upon the Appraisal Policy, the result does not pass the policy. " To: "The second way in which the process may fail is when the Result is examined by the Relying Party, and based upon the Appraisal Policy, the result does not pass the policy. " I suggest making the last paragraph the second paragraph. It's easier to read than the others and provides an introduction to the model before you begin talking about how it might fail. ** I may come back to this section to provide wording suggestions. Section 5.2 I suggest moving the last paragraph to the first in this instance. It also provides a nice high-level overview. The current paragraph 1&2 flow well together, hence this order suggestion. The third paragraph is a really long way of stating that interoperability is required. Entities must be able to create, send, receive, and process data (hence the need for a standard). It's fine, but could be shorter. Section 5.3: OLD: "One variation of the background-check model is where the Relying Party and the Verifier on the same machine, and so there is no need for a protocol between the two." Proposed: "One variation of the background-check model is where the Relying Party and the Verifier are on the same machine, performing both functions together. In this case, there is no need for a protocol between the two." I think the addition is necessary or you could scratch your head wondering why no protocol is needed. If they are separate functions on the same system, you'd need some way for the relying party to access the results of the verifier. The next sentence could benefit from being made into several. OLD: "It is also worth pointing out that the choice of model is generally up to the Relying Party, and the same device may need to create Evidence for different Relying Parties and different use cases (e.g., a network infrastructure device to gain access to the network, and then a server holding confidential data to get access to that data). As such, both models may simultaneously be in use by the same device." If the server holds confidential data, why does it need to create evidence to access the data? I'm not following the second example as written, so my proposed text may not be as intended. Proposed: "It is also worth pointing out that the choice of model is generally up to the Relying Party. The same device may need to create Evidence for different Relying Parties and/or different use cases. For instance, a network infrastructure device may attest evidence to gain access to the network or a server holding confidential data may require attestations of evidence to gain access to the data. As such, both models may simultaneously be in use by the same device." Section 6: The first 3 sentences are fine, but if you wanted to reduce it, it could be one sentence. Current: "An entity in the RATS architecture includes at least one of the roles defined in this document. As a result, the entity can participate as a constituent of the RATS architecture. Additionally, an entity can aggregate more than one role into itself. " Proposed: "An entity in the RATS architecture includes at least one [or more] of the roles defined in this document. " Or more is redundant, so that really isn't necessary to convey the same point. Then the last sentence: I'd change it a little from: "In essence, an entity that combines more than one role also creates and consumes the corresponding conceptual messages as defined in this document." To: "In essence, an entity that combines more than one role may create and consume the corresponding conceptual messages as defined in this document." It might not, it could be the verifier and relying party. Section 5: Consider changing from: "That is, it might appraise the trustworthiness of an application component, or operating system component or service, under the assumption that information provided about it by the lower-layer hypervisor or firmware is true. " To: "That is, it might appraise the trustworthiness of an application component, operating system component, or service under the assumption that information provided about it by the lower-layer hypervisor or firmware is true. " Section 7: I'd say it's really a stronger level of assurance of security rather than a stronger level of security in the following: "A stronger level of security comes when information can be vouched for by hardware or by ROM code, especially if such hardware is physically resistant to hardware tampering. " Then with the following sentence, "The component that is implicitly trusted is often referred to as a Root of Trust." I think it would be worth mentioning that a hardware RoT is immutable and mutable RoTs in software are also possible, offering different levels for an assurance of trust/security. Section 9. Since ROLIE [RFC8322] has been added to SCAP2.0, it would be good to list that as an option since a lot of time and effort went into how to secure the exchange of formatted data for that protocol. Section 11. Privacy This is a good start. Remote attestation also provides a way to profile systems as well as the user behind that system. If attestation results go higher in the stack to include containers and applications, it could reveal even more about a system or user. The scope of access needs to be emphasized, including the administrators access to data (or restrictions). If there is a way to make inferences about attestations from their processing, that should be noted as well. Section 12: This will need to state an explicit requirement for transport encryption. In the introductory paragraph, the text is as follows: "Any solution that conveys information used for security purposes, whether such information is in the form of Evidence, Attestation Results, Endorsements, or Appraisal Policy, needs to support end-to-end integrity protection and replay attack prevention, and often also needs to support additional security protections. For example, additional means of authentication, confidentiality, integrity, replay, denial of service and privacy protection are needed in many use cases. " Proposed: "Any solution that conveys information used for security purposes, whether such information is in the form of Evidence, Attestation Results, Endorsements, or Appraisal Policy must support the security properties of confidentiality, integrity, and availability. A conveyance protocol includes the typical transport security considerations: o end-to-end encryption, o end-to-end integrity protection, o replay attack prevention, o denial of service protection, o authentication, o authorization, o fine grained access controls, and o logging in line with current threat models and zero trust architectures." Best regards, Kathleen

4.3.  <ins> By definition, the Attester role creates Evidence. An Attester may consist of one or more nested or staged environments, adding complexity to the architectural structure.  The unifying component is the Root of Trust and the nested, staged, or chained attestation Evidence produced.  The nested or chained structure includes Claims, collected by the Attester to aid in the assurance or believability of the attestation Evidence. </ins> layered depicts an example of a device that includes (A) a BIOS stored in read-only memory in this example, (B) an updatable measured and signed by the BIOS, plus a set of Claims about the kernel as measured and signed by the bootloader.  <ins> This example could be extended further by making the kernel become another Attesting Environment for an application as another Target Environment.  This would result in a third set of Claims in the </ins> Evidence pertaining to that application. The essence of this example is a cascade of staged environments.


Another example is a multi-chassis router composed of multiple single carrier-grade routers.  The multi-chassis router provides higher throughput by interconnecting multiple routers and can be logically <del> treated as one router for simpler management.  Among these routers, there is only one main router that connects to the Verifier.  Other </del>  routers are only connected to the main router by the network cables, and therefore they are managed and appraised via this main router's help.  So, in this case, the multi-chassis router is the Composite entity inside the lead Attester can also take on the role of a Verifier, and the outside entity of Verifier can take on the role of a Relying Party.  After collecting the Evidence of other Attesters, <del> this inside Verifier verifies them using Endorsements and Appraisal Policies (obtained the same way as any other Verifier), to generate Attestation Results.  The inside Verifier then conveys the Attestation Results of other Attesters, whether in the same conveyance protocol as the Evidence or not, to the outside Verifier. </del>  In this situation, the trust model described in trustmodel is also suitable for this inside Verifier.

URL
NAME Lear. Greetings! I got as far as I could with time constraints through the rest of the document. There are a few sections I'll likely go back over again as I was short on time when reviewing them, but do hope this is helpful towards improving the document. This review is from the editors revision on github that I started my review earlier int he week. Section 4.2: I find the following grouping a bit confusing: "Places that Attesting Environments can exist include Trusted Execution Environments (TEE), embedded Secure Elements (eSE), and BIOS firmware." This has an attesting environment as a processor, an element, and as compiled code. That doesn't seem right, especially when you refer to the attesting environment as a "place". Do you mean where BIOS is executed perhaps? I would expect a TEE and maybe other components where security functions are offloaded, which is in some cases to a processor other than a TEE like a GPU (I'm not making a recommendation to do that here, just stating what is happening in ecosystems that exist). The following text is a little confusing, in particular, the last sentence: "An execution environment may not, by default, be capable of claims collection for a given Target Environment. Attesting Environments are designed specifically with claims collection in mind." If the attesting environment is a place, TEEs and other processors were not necessarily designed with claims in mind. If you can help to explain an attesting environment better, I can help to phrase it more clearly to convey the intended set of points as I think there are several. Section 4.3 Consider changing from: "By definition, the Attester role takes on the duty to create Evidence." To: "By definition, the Attester role creates Evidence." The following sentence is a run on and I think some additional information will help provide clarity. I don't think it's the role that is composed of nest environments. Current: "The fact that an Attester role is composed of environments that can be nested or staged adds complexity to the architectural layout of how an Attester can be composed and therefore has to conduct the Claims collection in order to create believable attestation Evidence." How about: "An Attester may be one or more nested or staged environments, adding complexity to the architectural structure. The unifying component is the root of trust and the nested, staged, or chained attestations produced. The nested or chained structure should include claims, collected by the attester to aid in the assurance or believability of the attestation Evidence." The following sentence should be broken into two: "This example could be extended further by, say, making the kernel become another Attesting Environment for an application as another Target Environment, resulting in a third set of Claims in the Evidence pertaining to that application." Proposed: "This example could be extended further by making the kernel become another Attesting Environment for an application as another Target Environment. This results in a third set of Claims in the Evidence pertaining to that application." How about changing the following sentence from: "Among these routers, there is only one main router that connects to the Verifier. " To: "A multi-chassis router, provides a management point and is the only one that connects to the Verifier. " For the following sentence, trying to remove the use of a word twice in a row and convey the same intent. Old: "After collecting the Evidence of other Attesters, this inside Verifier verifies them using Endorsements and Appraisal Policies (obtained the same way as any other Verifier), to generate Attestation Results." Proposed: "After collecting the Evidence of other Attesters, this inside Verifier uses Endorsements and Appraisal Policies (obtained the same way as any other Verifier) in the verification process to generate Attestation Results." I may try another pass at section 4 to improve readability. Section 5, Consider breaking this into 2 sentences, from: "This section includes some reference models, but this is not intended to be a restrictive list, and other variations may exist." To: "This section includes some reference models. This is not intended to be a restrictive list, and other variations may exist." Section 5.1 Two result words together is not necessary. Change from: "The second way in which the process may fail is when the resulting Result is examined by the Relying Party, and based upon the Appraisal Policy, the result does not pass the policy. " To: "The second way in which the process may fail is when the Result is examined by the Relying Party, and based upon the Appraisal Policy, the result does not pass the policy. " I suggest making the last paragraph the second paragraph. It's easier to read than the others and provides an introduction to the model before you begin talking about how it might fail. ** I may come back to this section to provide wording suggestions. Section 5.2 I suggest moving the last paragraph to the first in this instance. It also provides a nice high-level overview. The current paragraph 1&2 flow well together, hence this order suggestion. The third paragraph is a really long way of stating that interoperability is required. Entities must be able to create, send, receive, and process data (hence the need for a standard). It's fine, but could be shorter. Section 5.3: OLD: "One variation of the background-check model is where the Relying Party and the Verifier on the same machine, and so there is no need for a protocol between the two." Proposed: "One variation of the background-check model is where the Relying Party and the Verifier are on the same machine, performing both functions together. In this case, there is no need for a protocol between the two." I think the addition is necessary or you could scratch your head wondering why no protocol is needed. If they are separate functions on the same system, you'd need some way for the relying party to access the results of the verifier. The next sentence could benefit from being made into several. OLD: "It is also worth pointing out that the choice of model is generally up to the Relying Party, and the same device may need to create Evidence for different Relying Parties and different use cases (e.g., a network infrastructure device to gain access to the network, and then a server holding confidential data to get access to that data). As such, both models may simultaneously be in use by the same device." If the server holds confidential data, why does it need to create evidence to access the data? I'm not following the second example as written, so my proposed text may not be as intended. Proposed: "It is also worth pointing out that the choice of model is generally up to the Relying Party. The same device may need to create Evidence for different Relying Parties and/or different use cases. For instance, a network infrastructure device may attest evidence to gain access to the network or a server holding confidential data may require attestations of evidence to gain access to the data. As such, both models may simultaneously be in use by the same device." Section 6: The first 3 sentences are fine, but if you wanted to reduce it, it could be one sentence. Current: "An entity in the RATS architecture includes at least one of the roles defined in this document. As a result, the entity can participate as a constituent of the RATS architecture. Additionally, an entity can aggregate more than one role into itself. " Proposed: "An entity in the RATS architecture includes at least one [or more] of the roles defined in this document. " Or more is redundant, so that really isn't necessary to convey the same point. Then the last sentence: I'd change it a little from: "In essence, an entity that combines more than one role also creates and consumes the corresponding conceptual messages as defined in this document." To: "In essence, an entity that combines more than one role may create and consume the corresponding conceptual messages as defined in this document." It might not, it could be the verifier and relying party. Section 5: Consider changing from: "That is, it might appraise the trustworthiness of an application component, or operating system component or service, under the assumption that information provided about it by the lower-layer hypervisor or firmware is true. " To: "That is, it might appraise the trustworthiness of an application component, operating system component, or service under the assumption that information provided about it by the lower-layer hypervisor or firmware is true. " Section 7: I'd say it's really a stronger level of assurance of security rather than a stronger level of security in the following: "A stronger level of security comes when information can be vouched for by hardware or by ROM code, especially if such hardware is physically resistant to hardware tampering. " Then with the following sentence, "The component that is implicitly trusted is often referred to as a Root of Trust." I think it would be worth mentioning that a hardware RoT is immutable and mutable RoTs in software are also possible, offering different levels for an assurance of trust/security. Section 9. Since ROLIE [RFC8322] has been added to SCAP2.0, it would be good to list that as an option since a lot of time and effort went into how to secure the exchange of formatted data for that protocol. Section 11. Privacy This is a good start. Remote attestation also provides a way to profile systems as well as the user behind that system. If attestation results go higher in the stack to include containers and applications, it could reveal even more about a system or user. The scope of access needs to be emphasized, including the administrators access to data (or restrictions). If there is a way to make inferences about attestations from their processing, that should be noted as well. Section 12: This will need to state an explicit requirement for transport encryption. In the introductory paragraph, the text is as follows: "Any solution that conveys information used for security purposes, whether such information is in the form of Evidence, Attestation Results, Endorsements, or Appraisal Policy, needs to support end-to-end integrity protection and replay attack prevention, and often also needs to support additional security protections. For example, additional means of authentication, confidentiality, integrity, replay, denial of service and privacy protection are needed in many use cases. " Proposed: "Any solution that conveys information used for security purposes, whether such information is in the form of Evidence, Attestation Results, Endorsements, or Appraisal Policy must support the security properties of confidentiality, integrity, and availability. A conveyance protocol includes the typical transport security considerations: o end-to-end encryption, o end-to-end integrity protection, o replay attack prevention, o denial of service protection, o authentication, o authorization, o fine grained access controls, and o logging in line with current threat models and zero trust architectures." Best regards, Kathleen

Another example is a multi-chassis router composed of multiple single carrier-grade routers.  The multi-chassis router provides higher throughput by interconnecting multiple routers and can be logically  <ins> treated as one router for simpler management.  A multi-chassis router provides a management point that connects to the Verifier.  Other </ins> routers are only connected to the main router by the network cables, and therefore they are managed and appraised via this main router's help.  So, in this case, the multi-chassis router is the Composite entity inside the lead Attester can also take on the role of a Verifier, and the outside entity of Verifier can take on the role of a Relying Party.  After collecting the Evidence of other Attesters,  <ins> this inside Verifier uses Endorsements and Appraisal Policies (obtained the same way as any other Verifier) in the verification process to generate Attestation Results.  The inside Verifier then conveys the Attestation Results of other Attesters, whether in the same conveyance protocol as the Evidence or not, to the outside Verifier. </ins> In this situation, the trust model described in trustmodel is also suitable for this inside Verifier.


Verifier, and a Relying Party.  The Attester conveys its Evidence to the Verifier for appraisal, and the Relying Party gets the Attestation Result from the Verifier.  There are multiple other <del> possible models.  This section includes some reference models, but this is not intended to be a restrictive list, and other variations may exist. </del>  5.1.  In this model, an Attester conveys Evidence to a Verifier, which compares the Evidence against its Appraisal Policy.  The Verifier then gives back an Attestation Result.  If the Attestation Result was There are three ways in which the process may fail.  First, the Verifier may refuse to issue the Attestation Result due to some error in processing, or some missing input to the Verifier.  The second way <del> in which the process may fail is when the resulting Attestation Result is examined by the Relying Party, and based upon the Appraisal Policy, the result does not pass the policy.  The third way is when the Verifier is unreachable. </del>  Since the resource access protocol between the Attester and Relying Party includes an Attestation Result, in this model the details of Result.  The format of the Evidence on the other hand is only constrained by the Attester-Verifier remote attestation protocol. <del> The passport model is so named because of its resemblance to how nations issue passports to their citizens.  The nature of the Evidence that an individual needs to provide to its local authority is specific to the country involved.  The citizen retains control of the resulting passport document and presents it to other entities when it needs to assert a citizenship or identity claim, such as an airport immigration desk.  The passport is considered sufficient because it vouches for the citizenship and identity claims, and it is issued by a trusted authority.  Thus, in this immigration desk analogy, the passport issuing agency is a Verifier, the passport is an Attestation Result, and the immigration desk is a Relying Party. </del> 5.2.  In this model, an Attester conveys Evidence to a Relying Party, which simply passes it on to a Verifier.  The Verifier then compares the Evidence against its Appraisal Policy, and returns an Attestation surface area of the Relying Party, especially if the Relying Party is a constrained node. <del> The background-check model is so named because of the resemblance of how employers and volunteer organizations perform background checks. When a prospective employee provides claims about education or previous experience, the employer will contact the respective institutions or former employers to validate the claim.  Volunteer organizations often perform police background checks on volunteers in order to determine the volunteer's trustworthiness.  Thus, in this analogy, a prospective volunteer is an Attester, the organization is the Relying Party, and a former employer or government agency that issues a report is a Verifier. </del> 5.3. One variation of the background-check model is where the Relying <del> Party and the Verifier on the same machine, and so there is no need for a protocol between the two. </del>  It is also worth pointing out that the choice of model is generally <del> up to the Relying Party, and the same device may need to create Evidence for different Relying Parties and different use cases (e.g., a network infrastructure device to gain access to the network, and then a server holding confidential data to get access to that data). As such, both models may simultaneously be in use by the same device. </del>  combination shows another example of a combination where Relying Party 1 uses the passport model, whereas Relying Party 2 uses an

Verifier, and a Relying Party.  The Attester conveys its Evidence to the Verifier for appraisal, and the Relying Party gets the Attestation Result from the Verifier.  There are multiple other  <ins> possible models.  This section includes some reference models.  This is not intended to be a restrictive list, and other variations may exist. </ins> 5.1. <ins> The passport model is so named because of its resemblance to how nations issue passports to their citizens.  The nature of the Evidence that an individual needs to provide to its local authority is specific to the country involved.  The citizen retains control of the resulting passport document and presents it to other entities when it needs to assert a citizenship or identity claim, such as an airport immigration desk.  The passport is considered sufficient because it vouches for the citizenship and identity claims, and it is issued by a trusted authority.  Thus, in this immigration desk analogy, the passport issuing agency is a Verifier, the passport is an Attestation Result, and the immigration desk is a Relying Party. </ins> In this model, an Attester conveys Evidence to a Verifier, which compares the Evidence against its Appraisal Policy.  The Verifier then gives back an Attestation Result.  If the Attestation Result was There are three ways in which the process may fail.  First, the Verifier may refuse to issue the Attestation Result due to some error in processing, or some missing input to the Verifier.  The second way  <ins> in which the process may fail is when the Attestation Result is examined by the Relying Party, and based upon the Appraisal Policy, the result does not pass the policy.  The third way is when the Verifier is unreachable. </ins> Since the resource access protocol between the Attester and Relying Party includes an Attestation Result, in this model the details of Result.  The format of the Evidence on the other hand is only constrained by the Attester-Verifier remote attestation protocol.  5.2. <ins> The background-check model is so named because of the resemblance of how employers and volunteer organizations perform background checks. When a prospective employee provides claims about education or previous experience, the employer will contact the respective institutions or former employers to validate the claim.  Volunteer organizations often perform police background checks on volunteers in order to determine the volunteer's trustworthiness.  Thus, in this analogy, a prospective volunteer is an Attester, the organization is the Relying Party, and a former employer or government agency that issues a report is a Verifier. </ins> In this model, an Attester conveys Evidence to a Relying Party, which simply passes it on to a Verifier.  The Verifier then compares the Evidence against its Appraisal Policy, and returns an Attestation surface area of the Relying Party, especially if the Relying Party is a constrained node.  5.3. One variation of the background-check model is where the Relying  <ins> Party and the Verifier are on the same machine, performing both functions together.  In this case, there is no need for a protocol between the two. </ins> It is also worth pointing out that the choice of model is generally  <ins> up to the Relying Party.  The same device may need to create Evidence for different Relying Parties and/or different use cases.  For instance, it would provide Evidence to a network infrastructure device to gain access to the network, and to a server holding confidential data to gain access to that data.  As such, both models may simultaneously be in use by the same device. </ins> combination shows another example of a combination where Relying Party 1 uses the passport model, whereas Relying Party 2 uses an


solutions with weaker security, a Verifier might be configured to implicitly trust firmware or even software (e.g., a hypervisor). That is, it might appraise the trustworthiness of an application <del> component, or operating system component or service, under the </del>  assumption that information provided about it by the lower-layer <del> hypervisor or firmware is true.  A stronger level of security comes when information can be vouched for by hardware or by ROM code, especially if such hardware is physically resistant to hardware tampering.  The component that is implicitly trusted is often referred to as a Root of Trust. </del>  A conveyance protocol that provides authentication and integrity protection can be used to convey unprotected Evidence, assuming the

solutions with weaker security, a Verifier might be configured to implicitly trust firmware or even software (e.g., a hypervisor). That is, it might appraise the trustworthiness of an application  <ins> component, operating system component, or service under the </ins> assumption that information provided about it by the lower-layer  <ins> hypervisor or firmware is true.  A stronger level of assurance of security comes when information can be vouched for by hardware or by ROM code, especially if such hardware is physically resistant to hardware tampering.  The component that is implicitly trusted is often referred to as a Root of Trust. </ins> A conveyance protocol that provides authentication and integrity protection can be used to convey unprotected Evidence, assuming the


Any solution that conveys information used for security purposes, whether such information is in the form of Evidence, Attestation <del> Results, Endorsements, or Appraisal Policy, needs to support end-to- end integrity protection and replay attack prevention, and often also needs to support additional security protections.  For example, additional means of authentication, confidentiality, integrity, replay, denial of service and privacy protection are needed in many use cases.  freshness discusses ways in which freshness can be used in this architecture to protect against replay attacks. </del>  To assess the security provided by a particular Appraisal Policy, it is important to understand the strength of the Root of Trust, e.g.,

URL
Try to revise this entirely, as it seems to change the set of requirements on conveyance. There are definitely problems in the old text. Greetings! I got as far as I could with time constraints through the rest of the document. There are a few sections I'll likely go back over again as I was short on time when reviewing them, but do hope this is helpful towards improving the document. This review is from the editors revision on github that I started my review earlier int he week. Section 4.2: I find the following grouping a bit confusing: "Places that Attesting Environments can exist include Trusted Execution Environments (TEE), embedded Secure Elements (eSE), and BIOS firmware." This has an attesting environment as a processor, an element, and as compiled code. That doesn't seem right, especially when you refer to the attesting environment as a "place". Do you mean where BIOS is executed perhaps? I would expect a TEE and maybe other components where security functions are offloaded, which is in some cases to a processor other than a TEE like a GPU (I'm not making a recommendation to do that here, just stating what is happening in ecosystems that exist). The following text is a little confusing, in particular, the last sentence: "An execution environment may not, by default, be capable of claims collection for a given Target Environment. Attesting Environments are designed specifically with claims collection in mind." If the attesting environment is a place, TEEs and other processors were not necessarily designed with claims in mind. If you can help to explain an attesting environment better, I can help to phrase it more clearly to convey the intended set of points as I think there are several. Section 4.3 Consider changing from: "By definition, the Attester role takes on the duty to create Evidence." To: "By definition, the Attester role creates Evidence." The following sentence is a run on and I think some additional information will help provide clarity. I don't think it's the role that is composed of nest environments. Current: "The fact that an Attester role is composed of environments that can be nested or staged adds complexity to the architectural layout of how an Attester can be composed and therefore has to conduct the Claims collection in order to create believable attestation Evidence." How about: "An Attester may be one or more nested or staged environments, adding complexity to the architectural structure. The unifying component is the root of trust and the nested, staged, or chained attestations produced. The nested or chained structure should include claims, collected by the attester to aid in the assurance or believability of the attestation Evidence." The following sentence should be broken into two: "This example could be extended further by, say, making the kernel become another Attesting Environment for an application as another Target Environment, resulting in a third set of Claims in the Evidence pertaining to that application." Proposed: "This example could be extended further by making the kernel become another Attesting Environment for an application as another Target Environment. This results in a third set of Claims in the Evidence pertaining to that application." How about changing the following sentence from: "Among these routers, there is only one main router that connects to the Verifier. " To: "A multi-chassis router, provides a management point and is the only one that connects to the Verifier. " For the following sentence, trying to remove the use of a word twice in a row and convey the same intent. Old: "After collecting the Evidence of other Attesters, this inside Verifier verifies them using Endorsements and Appraisal Policies (obtained the same way as any other Verifier), to generate Attestation Results." Proposed: "After collecting the Evidence of other Attesters, this inside Verifier uses Endorsements and Appraisal Policies (obtained the same way as any other Verifier) in the verification process to generate Attestation Results." I may try another pass at section 4 to improve readability. Section 5, Consider breaking this into 2 sentences, from: "This section includes some reference models, but this is not intended to be a restrictive list, and other variations may exist." To: "This section includes some reference models. This is not intended to be a restrictive list, and other variations may exist." Section 5.1 Two result words together is not necessary. Change from: "The second way in which the process may fail is when the resulting Result is examined by the Relying Party, and based upon the Appraisal Policy, the result does not pass the policy. " To: "The second way in which the process may fail is when the Result is examined by the Relying Party, and based upon the Appraisal Policy, the result does not pass the policy. " I suggest making the last paragraph the second paragraph. It's easier to read than the others and provides an introduction to the model before you begin talking about how it might fail. ** I may come back to this section to provide wording suggestions. Section 5.2 I suggest moving the last paragraph to the first in this instance. It also provides a nice high-level overview. The current paragraph 1&2 flow well together, hence this order suggestion. The third paragraph is a really long way of stating that interoperability is required. Entities must be able to create, send, receive, and process data (hence the need for a standard). It's fine, but could be shorter. Section 5.3: OLD: "One variation of the background-check model is where the Relying Party and the Verifier on the same machine, and so there is no need for a protocol between the two." Proposed: "One variation of the background-check model is where the Relying Party and the Verifier are on the same machine, performing both functions together. In this case, there is no need for a protocol between the two." I think the addition is necessary or you could scratch your head wondering why no protocol is needed. If they are separate functions on the same system, you'd need some way for the relying party to access the results of the verifier. The next sentence could benefit from being made into several. OLD: "It is also worth pointing out that the choice of model is generally up to the Relying Party, and the same device may need to create Evidence for different Relying Parties and different use cases (e.g., a network infrastructure device to gain access to the network, and then a server holding confidential data to get access to that data). As such, both models may simultaneously be in use by the same device." If the server holds confidential data, why does it need to create evidence to access the data? I'm not following the second example as written, so my proposed text may not be as intended. Proposed: "It is also worth pointing out that the choice of model is generally up to the Relying Party. The same device may need to create Evidence for different Relying Parties and/or different use cases. For instance, a network infrastructure device may attest evidence to gain access to the network or a server holding confidential data may require attestations of evidence to gain access to the data. As such, both models may simultaneously be in use by the same device." Section 6: The first 3 sentences are fine, but if you wanted to reduce it, it could be one sentence. Current: "An entity in the RATS architecture includes at least one of the roles defined in this document. As a result, the entity can participate as a constituent of the RATS architecture. Additionally, an entity can aggregate more than one role into itself. " Proposed: "An entity in the RATS architecture includes at least one [or more] of the roles defined in this document. " Or more is redundant, so that really isn't necessary to convey the same point. Then the last sentence: I'd change it a little from: "In essence, an entity that combines more than one role also creates and consumes the corresponding conceptual messages as defined in this document." To: "In essence, an entity that combines more than one role may create and consume the corresponding conceptual messages as defined in this document." It might not, it could be the verifier and relying party. Section 5: Consider changing from: "That is, it might appraise the trustworthiness of an application component, or operating system component or service, under the assumption that information provided about it by the lower-layer hypervisor or firmware is true. " To: "That is, it might appraise the trustworthiness of an application component, operating system component, or service under the assumption that information provided about it by the lower-layer hypervisor or firmware is true. " Section 7: I'd say it's really a stronger level of assurance of security rather than a stronger level of security in the following: "A stronger level of security comes when information can be vouched for by hardware or by ROM code, especially if such hardware is physically resistant to hardware tampering. " Then with the following sentence, "The component that is implicitly trusted is often referred to as a Root of Trust." I think it would be worth mentioning that a hardware RoT is immutable and mutable RoTs in software are also possible, offering different levels for an assurance of trust/security. Section 9. Since ROLIE [RFC8322] has been added to SCAP2.0, it would be good to list that as an option since a lot of time and effort went into how to secure the exchange of formatted data for that protocol. Section 11. Privacy This is a good start. Remote attestation also provides a way to profile systems as well as the user behind that system. If attestation results go higher in the stack to include containers and applications, it could reveal even more about a system or user. The scope of access needs to be emphasized, including the administrators access to data (or restrictions). If there is a way to make inferences about attestations from their processing, that should be noted as well. Section 12: This will need to state an explicit requirement for transport encryption. In the introductory paragraph, the text is as follows: "Any solution that conveys information used for security purposes, whether such information is in the form of Evidence, Attestation Results, Endorsements, or Appraisal Policy, needs to support end-to-end integrity protection and replay attack prevention, and often also needs to support additional security protections. For example, additional means of authentication, confidentiality, integrity, replay, denial of service and privacy protection are needed in many use cases. " Proposed: "Any solution that conveys information used for security purposes, whether such information is in the form of Evidence, Attestation Results, Endorsements, or Appraisal Policy must support the security properties of confidentiality, integrity, and availability. A conveyance protocol includes the typical transport security considerations: o end-to-end encryption, o end-to-end integrity protection, o replay attack prevention, o denial of service protection, o authentication, o authorization, o fine grained access controls, and o logging in line with current threat models and zero trust architectures." Best regards, Kathleen

Any solution that conveys information used for security purposes, whether such information is in the form of Evidence, Attestation  <ins> Results, Endorsements, or Appraisal Policy must support end-to-end integrity protection and replay attack prevention, and often also needs to support additional security properties, including: end-to-end encryption, denial of service protection, authentication, auditing, fine grained access controls, and logging. freshness discusses ways in which freshness can be used in this architecture to protect against replay attacks. </ins> To assess the security provided by a particular Appraisal Policy, it is important to understand the strength of the Root of Trust, e.g.,


15.4. The following example illustrates a hypothetical Background-Check <del> Model solution that uses centrally generated identifiers for explicit time-keeping (referred to as "handle" in this example).  Handles can be qualifying data, such as nonces or signed timestamps.  In this example, centrally generated signed timestamps and - and synchronized clocks between all entities - are distributed in periodic intervals as handles.  If the Attester lacks a source of time based on an absolute timescale, a relative source of time, such as a tick counter can be used, alternatively.  In this example, evidence generation is not triggered at value generation, but at events at which the Attesting Environment becomes of changes to the Target Environment. In comparison with example 1, the time considerations in this example go into more detail with respect to the life-cycle of Claims and Evidence.  While the goal is to create up-to-date and recent Evidence as soon as possible, typically there is a latency between value generation and Attester awareness. At time(AA) the Attesting Environment is able to trigger an event (e.g. based on an Event-Condition-Action model) to create attestation Evidence that is as recent as possible.  In essence, at time(AA) the Attesting Environment is aware of new values that where generated at time(VG) and corresponding Claim values are collected immediately. Consecutively, Evidence based on relevant "old" Claims and the just collected "new" Claims is generated at time(EG).  In essence, the Claims used to generate the Evidence are generated at various time(VG) before time(AA). In order to create attestation Evidence at at time(AA), the Attester requires a fresh (i.e. not expired) centrally generated handle that has been distributed to all involved entities. In general, The duration a handle remains fresh depends on the content-type of the handle.  If it is a (relative or absolute) timestamp, clocks synchronized with a shared and trustworthy source of time are required.  If another value type is used as a handle, the reception time of the handle time(HD) provides an epoch (relative time of zero) for measuring the duration of validity (similar to a heart-beat timeout).  From the point of view of a Verifier, validity of Evidence is only given if the handle used in Evidence satisfies delta(time(HD),time(EG))distribution-interval. In this usage scenario, time(VG), time(AA), and time(EG) are tightly coupled.  Also, the absolute point in time at which a handle is received by all three entities is assumed to be close to identical. 15.5. The following example illustrates a hypothetical Background-Check </del> Model solution that uses nonces and thus does not require that any clocks are synchronized.  In this example solution, a nonce is generated by a Verifier at the request of a Relying Party, when the

This puts the timestamp example back in and removes the problematic handle example until it is fixed up and has a citable reference. It can be put back in after that if desired. Signed-off-by: Dave Thaler
PR and PR merged text that I had, and continue to have, problems with. A summary of the problems follows: 1) It includes events (CC, RP) that are not used in any checks in the text. I had pointed this out before when the PR was generated, but the PR was merged without addressing this comment. 2) The section about using timestamps with synchronized clocks was removed and replaced with a section that talks about a different mechanism (handles) that is not in any RFC or WG document. I believe that such replacement is inappropriate. If the WG adopts a document that talks about a handle distribution mechanism, then a section can be added. Or if there is a standard from another org that can be referenced then it's fine to add one in that case too. But I think it should not replace the section discussing the well known technique of synchronized clocks (e.g., using secure NTP, or PTP (IEEE 1588-2002) or whatever other standard mechanism). 3) time(HD) is problematic as phrased since all the other events are times as seen by a single entity, whereas time(HD) does not clearly say whose perspective (i.e., whose clock) it is from... is it the distributor's? Text is unclear. 4) It talks about nonces in a timestamp section, which I think causes confusion since there's already a separately section about nonces and this section is labeled to be scoped to timestamps. Addressing might address this naturally, if it uses a different section title. 5) There are some editorial typos, such as capital "The" in the middle of a sentence, etc. 6) I have no idea what "delta(time(HD),time(EG))distribution-interval" is supposed to mean. Normally I would expect an equality for any condition to be evaluated, but I have no idea what this check is. 7) time(HD) and time(EG) are according to different clocks (if my guess about point 3 above is right) and so the delta is not directly comparable. I'm not sure how point 6 accounts for this. 8) The phrase "A nonce not predictable to an Attester (recentness & uniqueness) is sent to an Attester" has "(recentness & uniqueness)" which doesn't read well (sounds like bad grammar) to me, and is not explained.
Hopefully PR now addresses this issue.
PR reverts the text, leaving the work in progress in PR
fixed by .
This action seems to be redundant to and I think one of your comments actually says so? Now I am confused. What does cover that not already cover? What exactly is the problematic example here? How is it resolved differently? I have the feeling I am missing something very obvious here :-) [edit] Ah! I think there were problematic git dependencies that inhibited separate handling of the original example 3 in , easily. Therefore, ? If that is the case, thanks! probably has to take that change into account now.

15.4. The following example illustrates a hypothetical Background-Check  Model solution that uses nonces and thus does not require that any clocks are synchronized.  In this example solution, a nonce is generated by a Verifier at the request of a Relying Party, when the


mechanism. A second approach places the onus of timekeeping solely on the <del> appraising entity, e.g., the Verifier (for Evidence), or the Relying </del>  Party (for Attestation Results), and might be suitable, for example, in case the Attester does not have a reliable clock or time synchronisation is otherwise impaired.  In this approach, a non-

Thomas suggests: The current paragraph looks wrong to me. When it says: [...] solely on the appraising entity, e.g., the Verifier (for Evidence), or the Relying Party (for Attestation Results),` should instead say: [...] solely on the remote attestation protocol initiator, e.g., the Relying Party (for Evidence or Attestation Results) and the Attester (for Attestation Results).

mechanism. A second approach places the onus of timekeeping solely on the  <ins> appraising entity, i.e., the Verifier (for Evidence), or the Relying </ins> Party (for Attestation Results), and might be suitable, for example, in case the Attester does not have a reliable clock or time synchronisation is otherwise impaired.  In this approach, a non-