In addition, for each PDAParam instance, leaders are required to: <del> Ensure that, for each report, all aggregator shares are either included or not in a given batch; </del> Implement and store state for the form of inter- and intra-batch replay mitigation in anti-replay; and

I also deleted a bunch of the (outdated) system design text. I'm sure this can be simplified, but I think this captures the basic assumptions (at least in my mental model).
Indeed, the text doesn't require any specific mitigation, and I don't see why it should. Aggregators could do the thing described in the appendix, or they could keep a huge list of all reports seen thus far. There could even be some simpler variant in the future I don't think we lose anything by eliding the implementation details here.

In addition, for each PDAParam instance, leaders are required to:  Implement and store state for the form of inter- and intra-batch replay mitigation in anti-replay; and


to ensure that each report appears at most once in a batch.  (See anti-replay.)  "encrypted_input_shares" contains the encrypted input shares of each of the aggregators. status 200 and an empty body.  Malformed requests are handled as described in pa-error-common-aborts.  3.4. [TODO: Decide if and how the collector's request is authenticated.] corresponding to a unique client report.  Sub-requests are structured as follows: <del> The "time" and "jitter" fields have the same value as those in the report uploaded by the client.  Similarly, the "helper_share" field is the helper's encrypted input share as it appeared in the report. [OPEN ISSUE: We usually only need to send this in the first aggregate request.  Shall we exclude it in subsequent requests somehow?]  The remainder of the structure is dedicated to the protocol-specific request parameters. </del>  In order to provide replay protection, the leader is required to send aggregate sub-requests in ascending order, where the ordering on sub- 9. <del> TODO </del>  10.  References

One possible extension would be an opaque blob to carry client attestation information (for ), if desired. The current set is empty, but I suspect we'll need freedom to extend here as this gets used without totally changing the protocol version. If folks are generally supportive of this, it should probably land after , which touches and renames PDAUploadReq to PDAReport.
Both (1) and (2) are external to the protocol. The purpose of extensions is to allow whatever mechanism exists for addressing them to be bound to the report, as is done here. This is done in the change. This is not meant to close the attestation issue. It's meant to give us the mechanics to address it later.
Right you are. What threw me off was the following statement: The "then these extensions are required to be echoed..." makes it sound as if they're not echoed, which they are. I'm happy with this PR modulo fixing this statement.

to ensure that each report appears at most once in a batch.  (See anti-replay.) <ins> "extensions" is a list of extensions to be included in the Upload flow; see upload-extensions. </ins> "encrypted_input_shares" contains the encrypted input shares of each of the aggregators. status 200 and an empty body.  Malformed requests are handled as described in pa-error-common-aborts. <ins> 3.3.3. Each PAUploadReq carries a list of extensions that clients may use to convey additional, authenticated information in the report.  Each extension is a tag-length encoded value of the following form: "extension_type" indicates the type of extension, and "extension_data" contains information specific to the extension. </ins> 3.4. [TODO: Decide if and how the collector's request is authenticated.] corresponding to a unique client report.  Sub-requests are structured as follows:  <ins> The "time", "jitter", and "extensions" fields have the same value as those in the report uploaded by the client.  Similarly, the "helper_share" field is the helper's encrypted input share as it appeared in the report.  [OPEN ISSUE: We usually only need to send this in the first aggregate request.  Shall we exclude it in subsequent requests somehow?]  The remainder of the structure is dedicated to the protocol-specific request parameters. </ins> In order to provide replay protection, the leader is required to send aggregate sub-requests in ascending order, where the ordering on sub- 9.  <ins> 9.1. This document requests creation of a new registry for extensions to the Upload protocol.  This registry should contain the following columns: [TODO: define how we want to structure this registry when the time comes] </ins> 10.  References


instance, the collector might authenticate themselves by logging into a website that has some trust relationship with the leader.)] <del> [TODO: @chris-wood suggested we specify APIs for producing and consuming each of the messages in the protocol.  Specific PDA protocols would implement this API.] </del> *Error handling.* In this section, we will use the verbs "abort" and "alert with "[some error message]"" to describe how protocol participants react to various error conditions.  The behavior is leader must have obtained the helper's encrypted output share (see pa-aggregate).  In general, the procedure by which the aggregators verify and aggregate reports depends on parameters carried by the <del> collect request.  This procedure is described below in pa-aggregate. </del>  3.4.1. <del> [TODO: Decide whether to specify things in terms of functions. @ekr pointed out that it would be clearer to just talk about protocol messages.] The collect protocol is an iterative procedure driven by the collector and parameterized by a PDAParam.  At a high level, it proceeds as follows.  First, the collector initializes local per- protocol state using the corresponding PDAParam.  This state object has the following member functions: CreateRequest(): Creates a PDACollectReq object, defined below, that is sent to the leader to complete one iteration of the protocol.  Along with any protocol-specific parameters, the message specifies a time interval "[batch_start, batch_end)" that determines the batch of reports to be aggregated.  It must be that "batch_end - batch_start >= PDAParam.batch_window" and "batch_start" and "batch_end" are multiples of "PDAParam.batch_window". Update(resp: PDACollectResp): Consumes an opaque PDACollectResp object, defined below, that is received from the leader in response to a PDACollectReq. Finished(): Returns a boolean indicating indicating whether or not the collection procedure is complete.  This function returns true when the collect iteration is complete. Output(): Returns the aggregate output corresponding to the protocol. </del>  <del> The collect procedure for a given PDAParam structure "param" is then driven with the following algorithm: </del>  [OPEN ISSUE: Describe how intra-protocol errors yield collect errors (see issue#57).  For example, how does a leader respond to a collect following message: To respond to valid output share requests, the helper first checks <del> that "batch_start" and "batch_end" are multiples of "task.batch_window" and that "batch_end - batch_start >= task.batch_window".  Next, it extracts from its state the set of input shares that fall in the window "[batch_start, batch_end)".  If the size of the batch is less than "task.batch_size", then it aborts and alerts the leader with "insufficient data".  Otherwise, it computes its output share, which has the following structure: </del>  Next, it encrypts its output share under the collector's HPKE public key: "R2.time == R1.time" but "R2.jitter <= R1.jitter", then we say that "R2" _does not follow_ "R1". <del> To prevent replay attacks, it suffices for each aggregator to ensure that each report it consumes follows the previous one it consumed. To prevent the adversary from tampering with the ordering of reports, honest clients incorporate the ordering-sensitive parameters "(time, jitter)" into the AAD for HPKE encryption. Note that this strategy may result in dropping reports that happen to have the same timestamp and jitter value. </del>  8.8.

This partially addresses the problem of preventing inter-batch replay attacks described by NAME in . Along the way, clean up the description of collect requests so that it talks about protocol messages rather than API calls (as NAME suggested).
Similar to , it should not be possible for a share to be included in more than one batch. The timestamp currently gives us some way of ensuring that reports map to at most batch, but not a way of ensuring that reports aren't included two overlapping batch windows. It's not immediately clear if include a single report in two overlapping batch windows is a problem, or if a problem only arises when these windows are disjoint. We should probably clarify what are the inter-batch requirements here and what sort of replay prevention is required.
The aggregators (either the leader or helper) can prevent the collector from getting outputs from overlapping batches by remembering batch intervals. For example, suppose the leader responded successfully to a collect request for time interval . Then suppose that, some time later, the collector requests output shares for , where . The potential privacy violation occurs because the sets of reports in each batch are non-disjoint. To prevent this, the leader might respond to the second request with an error, or it might just include the reports in .
If aggregators are meant to use the report timestamp to protect against replay, then I think it needs to appear in the AEAD-ed message constructed by the client (i.e. ). Otherwise a leader could insert arbitrary timestamps into and trick helpers into exceeding privacy budgets or double counting inputs. Additionally, a batching client could insert arbitrary values into .
I created a PR that addresses this issue partially. What's left to do is allow multiple collect requests over the same batch, as required by the PDA protocol (e.g., Hits). I have an idea for how to do this, I'll follow up with a PR.
Closed by URL

instance, the collector might authenticate themselves by logging into a website that has some trust relationship with the leader.)]  *Error handling.* In this section, we will use the verbs "abort" and "alert with "[some error message]"" to describe how protocol participants react to various error conditions.  The behavior is leader must have obtained the helper's encrypted output share (see pa-aggregate).  In general, the procedure by which the aggregators verify and aggregate reports depends on parameters carried by the  <ins> collect request. </ins> 3.4.1.  <ins> A collect request is associated with a PDA task.  Along with the task ID, the request includes a time interval that determines the batch of reports to be aggregated.  To make a collect request, the collector issues a POST request to "[leader]/collect", where "[leader]" is the leader's endpoint URL.  The body of the request is structured as follows: The batch window of the request is the interval "[batch_start, batch_end)".  A collect request is said to be valid if all of the following conditions hold (let "PDAParam" denote the parameters for the PDA task): The batch window of the request aligns with the size of the batch window for the task, i.e., "batch_start" and "batch_end" are multiples of "PDAParam.batch_window". </ins>  <ins> The batch window of the request is at least the minimum batch window for the task, i.e., "batch_end - batch_start >= PDAParam.batch_window". The batch window of the request does not overlap with the batch window of any previous request.  [TODO: Enforcing this condition breaks hits, which explicitly requires multiple collect requests on the same batch.  We'll need to fix this.] The leader responds to valid collect requests by first interacting with the helper as described in pa-aggregate.  Once it has obtained the helper's encrypted output share for the batch, it responds to the collector's request with the following message: </ins> [OPEN ISSUE: Describe how intra-protocol errors yield collect errors (see issue#57).  For example, how does a leader respond to a collect following message: To respond to valid output share requests, the helper first checks  <ins> that the request corresponds to a valid collect request.  Next, it extracts from its state the set of input shares that fall in the window "[batch_start, batch_end)".  If the size of the batch is less than "task.batch_size", then it aborts and alerts the leader with "insufficient data".  Otherwise, it computes its output share, which has the following structure: </ins> Next, it encrypts its output share under the collector's HPKE public key: "R2.time == R1.time" but "R2.jitter <= R1.jitter", then we say that "R2" _does not follow_ "R1".  <ins> To prevent replay attacks, each aggregator ensures that each report it consumes follows the previous one it consumed.  To prevent the adversary from tampering with the ordering of reports, honest clients incorporate the ordering-sensitive parameters "(time, jitter)" into the AAD for HPKE encryption.  Note that this strategy may result in dropping reports that happen to have the same timestamp and jitter value. Aggregators prevent the same report from being used in multiple batches by only consuming valid collect requests, as described in pa- collect. </ins> 8.8.


This document recognizes three general categories of Attesters. HSM-based: A Hardware Security Module (HSM) based cryptoprocessor <del> which continually hashes security measurements in a way which prevents an Attester from lying about measurements which have been extended into the Attesting Environment (e.g., TPM2.0.) </del>  Process-based: An individual process which has its runtime memory encrypted by an Attesting Environment in a way that no other sequence, a Verifier evaluates an Attester and returns signed Attestation Results back to this original Attester no less frequently than a well-known interval.  This interval may also be asynchronous, <del> based on the changing of certain Evidence as described in I- D.birkholz-rats-network-device-subscription. </del>  When a Relying Party is to receive information about the Attester's trustworthiness, the Attesting Environment assembles the minimal set

I want to wait until we have the new definitions being worked in the CCC nailed down. (They look like they are getting close.) Then we can just reference or copy these. Eric
WFM. I have raised to track this.
LGTM, I've left a note unrelated to the change, but close enough to maybe deserve being addressed in the same PR?

This document recognizes three general categories of Attesters. HSM-based: A Hardware Security Module (HSM) based cryptoprocessor  <ins> which hashes one or more streams of security measurements from an Attester within the Attesting Environment.  Maintenance of this hash enables detection of an Attester which is lying about the set of security measurements taken.  An example of a HSM is a TPM2.0 TPM2.0. </ins> Process-based: An individual process which has its runtime memory encrypted by an Attesting Environment in a way that no other sequence, a Verifier evaluates an Attester and returns signed Attestation Results back to this original Attester no less frequently than a well-known interval.  This interval may also be asynchronous,  <ins> based on the changing of certain Evidence as described in I-D.ietf- rats-network-device-subscription. </ins> When a Relying Party is to receive information about the Attester's trustworthiness, the Attesting Environment assembles the minimal set


HSM-based: A Hardware Security Module (HSM) based cryptoprocessor which hashes one or more streams of security measurements from an Attester within the Attesting Environment.  Maintenance of this <del> hash enables detection of an Attester which is lying about the set of security measurements taken.  An example of a HSM is a TPM2.0 </del>  TPM2.0. Process-based: An individual process which has its runtime memory The configuration includes or exposes known vulnerabilities.  The configuration is unsupportable as it exposes unacceptable security vulnerabilities. 3.1.2. A simplified Background-Check Model may exist in a very specific <del> case. This is where the Relying Party and Verifier functions are co- </del>  resident.  This model is appropriate when: Some hardware-based private key is used by an Attester while gap with Zero Trust.  The credentials used for authentication and admission control can be manipulated on the endpoint.  Attestation can fill this gap through the generation of a compound credential <del> called AR-augmented Evidence. This compound credential is rooted in the hardware based Attesting Environment of an endpoint, plus the trustworthiness of a Verifier. The overall solution is known as "Below Zero Trust" as the compound credential cannot be manipulated or spoofed by an administrator of an endpoint with root access.  This solution is not adversely impacted by the potential drawbacks with pure background-check described above. </del>  To kick-off the "Below Zero Trust" compound credential creation sequence, a Verifier evaluates an Attester and returns signed

Based on request from Yogesh for a new Configuration encoded claim.
Thanks Eric! As you may have guessed, we have an immediate use for this 36 :-)

HSM-based: A Hardware Security Module (HSM) based cryptoprocessor which hashes one or more streams of security measurements from an Attester within the Attesting Environment.  Maintenance of this  <ins> hash enables detection of an Attester which is not reporting the exact set of security measurements (such as log entries) taken within the Attesting Environment.  An example of a HSM is a TPM2.0 </ins> TPM2.0. Process-based: An individual process which has its runtime memory The configuration includes or exposes known vulnerabilities. <ins> Elements of the configuration relevant to security are unavailable to the Verifier. </ins> The configuration is unsupportable as it exposes unacceptable security vulnerabilities. 3.1.2. A simplified Background-Check Model may exist in a very specific  <ins> case.  This is where the Relying Party and Verifier functions are co- </ins> resident.  This model is appropriate when: Some hardware-based private key is used by an Attester while gap with Zero Trust.  The credentials used for authentication and admission control can be manipulated on the endpoint.  Attestation can fill this gap through the generation of a compound credential  <ins> called AR-augmented Evidence.  This compound credential is rooted in the hardware based Attesting Environment of an endpoint, plus the trustworthiness of a Verifier.  The overall solution is known as "Below Zero Trust" as the compound credential cannot be manipulated or spoofed by an administrator of an endpoint with root access.  This solution is not adversely impacted by the potential drawbacks with pure background-check described above. </ins> To kick-off the "Below Zero Trust" compound credential creation sequence, a Verifier evaluates an Attester and returns signed


Trustworthiness Claims being relied upon from the Verifier considered the chain of trust for the Attesting Environment. <del> There are two categorizations Verifier identities defined in this document. </del>  verifier build: a unique instance of a software build running as a Verifier.

"There are two categorizations Verifier identities defined in this document" does not read awesomely. I am putting forward a (maybe even worse) alternative. Feel free to English-ise it.
Looks like an improvement

Trustworthiness Claims being relied upon from the Verifier considered the chain of trust for the Attesting Environment.  <ins> There are two categorizations of Verifier identities defined in this document: </ins> verifier build: a unique instance of a software build running as a Verifier.


any distinction between a Trustworthiness Claim with enumeration '0', and no Trustworthiness Claim being provided. <del> Value 1: The Evidence received contains unexpected elements which the Verifier is unable to parse.  An example might be that the wrong type of Evidence has been delivered. </del>  Value -1: A verifier malfunction occurred during the Verifier's appraisal processing. No assertion <del> Verifer cannot parse unexpected Evidence. </del>  Verifier malfunction

Include changes from Sergei's semantic musings.
a little late, but this is an easy oneLGTM, I have inlined an editorial suggestion.

any distinction between a Trustworthiness Claim with enumeration '0', and no Trustworthiness Claim being provided.  <ins> Value 1: The Evidence received contains unknown elements which the Verifier is unable to evaluate.  An example might be that the wrong type of Evidence has been delivered.  Another case is that of Evidence coming from a composite Attester: a Verifier may only understand only part of it and leave as "unknown" the Trustworthiness claims related to features it can't appraise. </ins> Value -1: A verifier malfunction occurred during the Verifier's appraisal processing. No assertion  <ins> Evidence contains unknown elements which inhibit Verifer evaluation. </ins> Verifier malfunction


An Attester Identity MAY be a unique identity, it MAY be included in a zero-knowledge proof (ZKP), or it MAY be part of a group <del> signature, or it MAY be a randomised DAA credential. </del>  <del> Attestation Evidence MUST be correct and authentic. </del>  In order to provide proofs of authenticity, Attestation Evidence SHOULD be cryptographically associated with an identity document <del> (e.g. an PKIX certificate or trusted key material, or a randomised DAA credential), or SHOULD include a correct and unambiguous and stable reference to an accessible identity document. </del>  An Authentication Secret MUST be available exclusively to an Attester's Attesting Environment. not named Reference Claims in the RATS arch?] Reference Claims are used to appraise the Claims received from an <del> Attester via appraisal by direct comparison.  For example, Reference Claims MAY be Reference Integrity Measurements (RIM) or assertions that are implicitly trusted because they are signed by a trusted authority (see Endorsements in I-D.ietf-rats- architecture).  Reference Claims typically represent (trusted) Claim sets about an Attester's intended platform operational state. </del>  _optional_ An Attestation Result is produced by the Verifier as the output of the appraisal of Evidence.  Attestation Results include condensed assertions about integrity or other characteristics of the <del> corresponding Attester that are digestable by Relying Parties. </del>  7. 9.6. The CHARRA project and all corresponding code and data maintained on <del> github are provided under the BSD 3-Clause "New" or "Revised" </del>  license. 9.7. The implementation requires the use of the official Trusted Computing Group (TCG) open-source Trusted Software Stack (TSS) for the Trusted Platform Module (TPM) 2.0.  The corresponding code and data is also <del> maintained on github and the project resources can be located via: </del>  https://github.com/tpm2-software/tpm2-tss/ The implementation uses the Constrained Application Protocol RFC7252

(Correct Evidence). (Application of Reference Values). (Wording: "github" -> "GitHub"). ("digestable" should be replaced with "processible"). Signed-off-by: Michael Eckel
In sections "9.6. License" and "9.7. Implementation Dependencies" the two mentions of "github" should be "GitHub".
Based on URL “Direct comparison” isn’t the correct expression, the comparison can have other rules.
I agree. So, we should remove the words "via appraisal by direct comparison."
Based on URL Is it appropriate to say “correct Evidence”? If saying so, I think it means that the Evidence satisfies the Attestation Policy for Evidence.
"I think it means that the Evidence satisfies the Attestation Policy for Evidence.": I agree. So, perhaps it is the best to just remove the words "correct and ", because this is about authenticity and not at all related to correctness. Correct me if I am wrong. Hi Henk, I've reviewed the reference interaction models I-D recently, I hope the comments below can help improve the draft before the IETF110 draft submission cut-off. Section 3 Disambiguation Comment > This section is talking about the disambiguation of terminology, so I suggest making it a sub-section of Section 2 Terminology. Examples of these types of co-located environments include: a Trusted Execution Environment (TEE), Baseboard Management Controllers (BMCs), as well as other physical or logical protected/isolated/shielded Computing Environments (e.g. embedded Secure Elements (eSE) or Trusted Platform Modules (TPM)). Comment > About "these types of co-located environments", The previous sentences are about the Verifier and Attester don't need to be remote. So "these" is weird here, because here is about the attesting environment and target environment. Section 5 Direct Anonymous Attestation Comment > I think it's better to move this section to the bottom of the draft. DAA doesn't introduce a new information elements, and only augments the scope/definition of Attester Identity and Authentication Secret IDs, describing it after the introduction of all the 3 basic interaction models would be better. Putting DAA in the middle makes me feel the basic interaction models rely upon DAA, but actually it's not. This document extends the duties of the Endorser role as defined by the RATS architecture with respect to the provision of these Attester Identity documents to Attesters. The existing duties of the Endorser role and the duties of a DAA Issuer are quite similar as illustrated in the following subsections. Comment > Without DAA, I think the Endorser also needs to provision the Attester Identity to Attesters. And as I understand, the DAA Issuer is a supply chain entity before the Attester being shipped, so it is the Endorser when DAA is used, right? If yes, then in the next sentence, the comparison between Endorser and DAA Issuer doesn't make sense to me. Section 5.1 Endorsers Comment > Does this section have difference with the definition of Endorser in architecture draft? If not, is it necessary to keep this section? Comment > This section only describes the Layered Attestation, but the scope of Endorsement is more than what's described here. Endorsement indicates the Attester's various capabilities such as Claims collection and Evidence signing. For other situations than Layered Attestation, the Endorser and Endorsement are also needed. So why only mention Layered Attestation here? I don't see any special relationship between DAA and Layered Attestation. Section 5.2 Endorsers for Direct Anonymous Attestation In order to enable the use of DAA, an Endorser role takes on the duties of a DAA Issuer in addition to its already defined duties. DAA Issuers offer zero-knowledge proofs based on public key certificates used for a group of Attesters [DAA]. Effectively, these certificates share the semantics of Endorsements, with the following exceptions: Comment > In the first sentence, I suggest saying that "a DAA Issuer takes on the role of an Endorser". o The associated private keys are used by the DAA Issuer to provide an Attester with a credential that it can use to convince the Verifier that its Evidence is valid. To keep their anonymity the Attester randomizes this credential each time that it is used. Comment > How to understand "Evidence is valid"? Does it mean the Evidence is sent from an authentic Attester and not tampered during the conveyance? Or does it mean the Evidence comes from a RoT and is trustable (although the Evidence can diverge from the Reference Values)? Comment > When saying "Attester randomizes this credential", how many credentials does an Attester have? 1) Can a DAA Issuer have multiple key pairs and use them for one Attester? 2) Can a DAA Issuer use one key pair to generate multiple credentials for one Attester? o A credential is conveyed from an Endorser to an Attester in combination with the conveyance of the public key certificates from Endorser to Verifier. Comment > Is there another way to convey the public key certificate, for example, can the public key certificates be conveyed from Endorser to Attester first and then from Attester to Verifier? The zero-knowledge proofs required cannot be created by an Attester alone - like the Endorsements of RoTs - and have to be created by a trustable third entity - like an Endorser. Due to that semantic overlap, the Endorser role is augmented via the definition of DAA duties as defined below. This augmentation enables the Endorser to convey trustable third party statements both to Verifier roles and Attester roles. Comment > For "the definition of DAA duties as defined below", what is the definition of DAA duties? Comment > In the last sentence, the Endorsement with its original definition is the third party statement for Verifier and Attester, isn't it? So, "augmentation" isn't the correct expression. Section 6 Normative Prerequisites Attester Identity: The provenance of Evidence with respect to a distinguishable Attesting Environment MUST be correct and unambiguous. Comment > The Attester Identity is to identify which Attester the Evidence comes from. But if the Attester has multiple Attesting Environments, what should be the Attester Identity? Comment > The TPM's AIK certificate is one kind of Attester Identity, right? Attestation Evidence Authenticity: Attestation Evidence MUST be correct and authentic. Comment > Is it appropriate to say "correct Evidence"? If saying so, I think it means that the Evidence satisfies the Attestation Policy for Evidence. Authentication Secret: An Authentication Secret MUST be available exclusively to an Attester's Attesting Environment. The Attester MUST protect Claims with that Authentication Secret, thereby proving the authenticity of the Claims included in Evidence. The Authentication Secret MUST be established before RATS can take place. Comment > Does the Authentication Secret represent the identity of the Attesting Environment? Comment > How to understand the Authentication Secret, and is it necessary all the time? For example, in our implementation, during the router booting up, the BIOS measures the BootLoader and records the measured hash value into the TPM, and the BootLoader measures the OS Kernel and records the measured hash value into the TPM as well. From the Layered Attestation perspective, I think (BIOS + TPM) is the Attesting Environment and (BootLoader + TPM) is also the Attesting Environment. But the Claims (measured hash values) aren't protected separately, and they finally becomes the Evidence (TPM Quote) and it's only protected by the TPM's AIK. So, what is the Authentication Secret? Section 7 Generic Information Elements Attester Identity ('attesterIdentity'): mandatory A statement about a distinguishable Attester made by an Endorser without accompanying evidence about its validity - used as proof of identity. Comment > Previous section says "Attester Identity" is about "a distinguishable Attesting Environment", and here says it's about "a distinguishable Attester". Comment > How to understand "without accompanying evidence about its validity"? Attester Identity ('attesterIdentity'): mandatory In DAA, the Attester's identity is not revealed to the verifier. The Attester is issued with a credential by the Endorser that is randomized and then used to anonymously confirm the validity of their evidence. The evidence is verified using the Endorser's public key. Comment > I think here means the DAA credential represents the Attester Identity. Comment > There is ambiguity of "that is randomized", does it mean randomized Endorser or randomized credential? Comment > For "confirm the validity of their evidence", what does "their" refer to? And what does "the validity of evidence" mean? Authentication Secret IDs ('authSecID'): mandatory A statement representing an identifier list that MUST be associated with corresponding Authentication Secrets used to protect Evidence. Comment > Previous section says "Authentication Secret" is used to protect Claims, but here says it's used to protect Evidence. Comment > As I understand, if Authentication Secret represents the identity of Attesting Environment, then it's not mandatory, at least in our implementation. Authentication Secret IDs ('authSecID'): mandatory In DAA, Authentication Secret IDs are represented by the Endorser (DAA issuer)'s public key that MUST be used to create DAA credentials for the corresponding Authentication Secrets used to protect Evidence. In DAA, an Authentication Secret ID does not identify a unique Attesting Environment but associated with a group of Attesting Environments. This is because an Attesting Environment should not be distinguishable and the DAA credential which represents the Attesting Environment is randomised each time it used. Comment > In my understanding, here says that the DAA credential identities the Attesting Environment. Compared with the description in the "Attester Identity" part, what does the DAA credential represent actually? Reference Claims ('refClaims') mandatory Reference Claims are components of Reference Values as defined in [I-D.ietf-rats-architecture]. [Editor's Note: Definition might become obsolete, if replaced by Reference Values. Is there a difference between Claims and Values here? Analogously, why is not named Reference Claims in the RATS arch?] Comment > I suggest using Reference Values to keep consistent with the RATS arch. Reference Claims are used to appraise the Claims received from an Attester via appraisal by direct comparison. Comment > "Direct comparison" isn't the correct expression, the comparison can have other rules. Claim Selection ('claimSelection'): optional A statement that represents a (sub-)set of Claims that can be created by an Attester. Claim Selections can act as filters that can specify the exact set of Claims to be included in Evidence. An Attester MAY decide whether or not to provide all Claims as requested via a Claim Selection. Comment > The "all Claims" may be ambiguous, I'd like to double check, does it refer to all Claims that the Attester can create or refer to all Claims requested in the Claim Selection? Section 8.1 Challenge/Response Remote Attestation Comment > In the sequence diagram, some elements in the bracket are not defined in the "Information Elements" section, such as targetEnvironment, collectedClaims, eventLog. Should these elements be defined? Section 9 Additional Application-Specific Requirements Depending on the use cases covered, there can be additional requirements. An exemplary subset is illustrated in this section. Comment > Here starts to talk about "additional requirements", but I wonder there is no other places in this draft talking about requirement, so what are the basic requirements? Regards & Thanks! Wei Pan

An Attester Identity MAY be a unique identity, it MAY be included in a zero-knowledge proof (ZKP), or it MAY be part of a group  <ins> signature, or it MAY be a randomized DAA credential. </ins>  <ins> Attestation Evidence MUST be authentic. </ins> In order to provide proofs of authenticity, Attestation Evidence SHOULD be cryptographically associated with an identity document  <ins> (e.g., a PKIX certificate or trusted key material, or a randomized DAA credential respectively), or SHOULD include a correct, unambiguous, and stable reference to an accessible identity document. </ins> An Authentication Secret MUST be available exclusively to an Attester's Attesting Environment. not named Reference Claims in the RATS arch?] Reference Claims are used to appraise the Claims received from an  <ins> Attester.  For example, Reference Claims MAY be Reference Integrity Measurements (RIM) or assertions that are implicitly trusted because they are signed by a trusted authority (see Endorsements in I-D.ietf-rats-architecture).  Reference Claims typically represent (trusted) Claim sets about an Attester's intended platform operational state. </ins> _optional_ An Attestation Result is produced by the Verifier as the output of the appraisal of Evidence.  Attestation Results include condensed assertions about integrity or other characteristics of the  <ins> corresponding Attester that are processible by Relying Parties. </ins> 7. 9.6. The CHARRA project and all corresponding code and data maintained on  <ins> GitHub are provided under the BSD 3-Clause "New" or "Revised" </ins> license. 9.7. The implementation requires the use of the official Trusted Computing Group (TCG) open-source Trusted Software Stack (TSS) for the Trusted Platform Module (TPM) 2.0.  The corresponding code and data is also  <ins> maintained on GitHub and the project resources can be located via: </ins> https://github.com/tpm2-software/tpm2-tss/ The implementation uses the Constrained Application Protocol RFC7252


Streaming Remote Attestation Each section starts with a sequence diagram illustrating the <del> interactions between Attester and Verifier.  While the interaction models presented focus on the conveyance of Evidence, the intention </del>  of this document is in support of future work that applies the presented models to the conveyance of other Conceptual Messages, namely Attestation Results, Endorsements, Reference Values, or Appraisal Policies. All interaction models have a strong focus on the use of a handle to <del> incorporate a type of proof of freshness.  The ways these handles are processed is the most prominent difference between the three interaction models. </del>  8.1. <del> This Challenge/Response Remote Attestation procedure is initiated by the Verifier, by sending a remote attestation request to the Attester.  A request includes a Handle, a list of Authentication Secret IDs, and a Claim Selection. </del>  In the Challenge/Response model, the handle is composed of qualifying <del> data in the form of a cryptographically strongly randomly generated, and therefore unpredictable, nonce.  The Verifier-generated nonce is intended to guarantee Evidence freshness. </del>  The list of Authentication Secret IDs selects the attestation keys with which the Attester is requested to sign the Attestation Evidence.  Each selected key is uniquely associated with an Attesting Environment of the Attester.  As a result, a single Authentication Secret ID identifies a single Attesting Environment. <del> Analogously, a particular set of Evidence originating from a particular Attesting Environments in a composite device can be </del>  requested via multiple Authentication Secret IDs.  Methods to acquire Authentication Secret IDs or mappings between Attesting Environments to Authentication Secret IDs are out-of-scope of this document. <del> The Claim Selection narrows down the set of Claims collected and used to create Evidence to those that the Verifier requires.  If the Claim Selection is omitted, then by default all Claims that are known and available on the Attester MUST be used to create corresponding Evidence.  For example when performing a boot integrity evaluation, a Verifier may only be requesting a particular subset of claims about the Attester, such as Evidence about BIOS and firmware the Attester booted up, and not include information about all currently running software. While it is crucial that Claims, the Handle, as well as the Attester </del>  Identity information MUST be cryptographically bound to the signature <del> of Evidence, they may be presented in an encrypted form. Cryptographic blinding MAY be used at this point.  For further reference see section security-and-privacy-considerations. </del>  <del> As soon as the Verifier receives signed Evidence, it validates the signature, the Attester Identity, as well as the Nonce, and appraises </del>  the Claims.  Appraisal procedures are application-specific and can be conducted via comparison of the Claims with corresponding Reference Claims, such as Reference Integrity Measurements.  The final output of the Verifier are Attestation Results.  Attestation Results <del> constitute new Claims Sets about an Attester's properties and characteristics that enables Relying Parties, for example, to assess an Attester's trustworthiness. </del>  8.2.  Uni-Directional Remote Attestation procedures can be initiated both by the Attester and by the Verifier.  Initiation by the Attester can result in unsolicited pushes of Evidence to the Verifier.  Initiation by the Verifier always results in solicited pushes to the Verifier. The Uni-Directional model uses the same information elements as the Challenge/Response model.  In the sequence diagram above, the Attester initiates the conveyance of Evidence (comparable with a RESTful POST operation or the emission of a beacon).  While a request <del> of evidence from the Verifier would result in a sequence diagram more </del>  similar to the Challenge/Response model (comparable with a RESTful <del> GET operation), the specific manner how handles are created and used always remains as the distinguishing quality of this model.  In the Uni-Directional model, handles are composed of trustable signed timestamps as shown in I-D.birkholz-rats-tuda, potentially including other qualifying data.  The handles are created by an external 3rd entity - the Handle Distributor - that includes a trustworthy source of time and takes on the role of a Time Stamping Authority (TSA, as initially defined in RFC3161).  Timstamps created from local clocks (absolute clocks using a global timescale, as well as relative clocks, such as tick-counters) of Attesters and Verifiers MUST be cryptographically bound to fresh Handles received from the Handle Distributor.  This binding provides a proof of synchronization that MUST be included in every evidence created.  Correspondingly, evidence created for conveyance via this model provides a proof that it was fresh at a certain point in time.  Effectively, this allows for series of evidence to be pushed to multiple Verifiers, simultaniously.  Methods to detect excessive time drift that would mandate a fresh Handle to be received by the Handle Distributor, as well as timing of handle distribution are out-of-scope of this document. </del>  8.3. Streaming Remote Attestation procedures require the setup of subscription state.  Setting up subscription state between a Verifier <del> and an Attester is conducted via a subscribe operation.  This subscribe operation is used to convey the handles required for Evidence generation.  Effectively, this allows for series of evidence to be pushed to a Verifier similar to the Uni-Directional model. While a Handle Distributor is not required in this model, it is also limited to bi-lateral subscription relationships, in which each Verifier has to create and provide its individual handle.  Handles provided by a specific subscribing Verifier MUST be used in Evidence generation for that specific Verifier.  The Streaming model uses the same information elements as the Challenge/Response and the Uni- </del>  Directional model.  Methods to detect excessive time drift that would mandate a refreshed Handle to be conveyed via another subscribe operation are out-of-scope of this document. Confidentiality of exchanged attestation information may be desirable.  This requirement usually is present when communication takes place over insecure channels, such as the public Internet.  In <del> such cases, TLS may be uses as a suitable communication protocol that preserves confidentiality.  In private networks, such as carrier management networks, it must be evaluated whether or not the transport medium is considered confidential. </del>  9.2. <del> In particular use cases mutual authentication may be desirable in </del>  such a way that a Verifier also needs to prove its identity to the Attester, instead of only the Attester proving its identity to the Verifier.

In all diagrams, valueGeneration should be replaced by produceClaims. The return type "claims" also indicates that claims are produced(/generated) somehow. Generated claims, e.g. could be Measured Boot data (TPM PCRs + the boot event log). BTW: I don't see a passage in the text that describes valueGeneration. See also .
Diagrams should be as close to UML as possible to improve understanding. That is (this applies to all diagrams): Actions should be verbs, not nouns ("generateValues" instead of "valueGeneration"). Returns of data should also be just arrows with data elements, i.e. nouns ("evidence --->" instead of "returnEvidence --->". Uni-Directional Remote Attestation: Handle Distributor should be at the top as an actor. It should be indicated that the "claimsDelta" value generation is a loop.
The text must be reworked. All above, the sequence in the diagram should be described entirely. This may also apply to the other models.
This should also be described in the text.

Streaming Remote Attestation Each section starts with a sequence diagram illustrating the  <ins> interactions between Attester and Verifier.  While the presented interaction models focus on the conveyance of Evidence, the intention </ins> of this document is in support of future work that applies the presented models to the conveyance of other Conceptual Messages, namely Attestation Results, Endorsements, Reference Values, or Appraisal Policies. All interaction models have a strong focus on the use of a handle to  <ins> incorporate a type of proof of freshness and to prevent replay attacks.  The way these handles are processed is the most prominent difference between the three interaction models. </ins> 8.1.  <ins> The Attester boots up and thereby produces claims about its boot state and its operational state.  Event Logs accompany the produced claims by providing an event trail of security-critical events of a system.  Claims are produced by all attesting Environments of an Attester system. The Challenge/Response remote attestation procedure is initiated by the Verifier by sending a remote attestation request to the Attester. A request includes a Handle, a list of Authentication Secret IDs, and a Claim Selection. </ins> In the Challenge/Response model, the handle is composed of qualifying  <ins> data in the form of a practically infeasible to guess nonce, such as a cryptographically strong random number.  The Verifier-generated nonce is intended to guarantee Evidence freshness and to prevent replay attacks. </ins> The list of Authentication Secret IDs selects the attestation keys with which the Attester is requested to sign the Attestation Evidence.  Each selected key is uniquely associated with an Attesting Environment of the Attester.  As a result, a single Authentication Secret ID identifies a single Attesting Environment.  <ins> Correspondingly, a particular set of Evidence originating from a particular Attesting Environment in a composite device can be </ins> requested via multiple Authentication Secret IDs.  Methods to acquire Authentication Secret IDs or mappings between Attesting Environments to Authentication Secret IDs are out-of-scope of this document.  <ins> The Attester collects Claims based on the Claim Selection.  With the Claim Selection the Verifier defines the set of Claims it requires. Correspondingly, collected Claims can be a subset of the produced Claims.  This could be all available Claims, depending on the Claim Selection.  If the Claim Selection is omitted, then by default all Claims that are known and available on the Attester MUST be used to create corresponding Evidence.  For example, when performing a boot integrity evaluation, a Verifier may only be requesting a particular subset of claims about the Attester, such as Evidence about BIOS/UEFI and firmware that the Attester booted up, and not include information about all currently running software. With the Handle, the Authentication Secret IDs, and the collected Claims, the Attester produces signed Evidence.  That is, it digitally signs the Handle and the collected Claims with a cryptographic secret identified by the Authentication Secret ID.  This is done once per Attesting Environment which is identified by the particular Authentication Secret ID.  The Attester communicates the signed Evidence as well as all accompanying Event Logs back to the Verifier. While it is crucial that Claims, the Handle, and the Attester </ins> Identity information MUST be cryptographically bound to the signature  <ins> of Evidence, they MAY be presented obfuscated, encrypted, or cryptographically blinded.  For further reference see section security-and-privacy-considerations. </ins>  <ins> As soon as the Verifier receives the signed Evidence and Event Logs, it appraises the Evidence.  For this purpose, it validates the signature, the Attester Identity, and the Handle, and then appraises </ins> the Claims.  Appraisal procedures are application-specific and can be conducted via comparison of the Claims with corresponding Reference Claims, such as Reference Integrity Measurements.  The final output of the Verifier are Attestation Results.  Attestation Results  <ins> constitute new Claim Sets about the properties and characteristics of an Attester, which enables Relying Parties, for example, to assess an Attester's trustworthiness. </ins> 8.2. <ins> TODO: Describe Deltas </ins> Uni-Directional Remote Attestation procedures can be initiated both by the Attester and by the Verifier.  Initiation by the Attester can result in unsolicited pushes of Evidence to the Verifier.  Initiation by the Verifier always results in solicited pushes to the Verifier. The Uni-Directional model uses the same information elements as the Challenge/Response model.  In the sequence diagram above, the Attester initiates the conveyance of Evidence (comparable with a RESTful POST operation or the emission of a beacon).  While a request  <ins> of Evidence from the Verifier would result in a sequence diagram more </ins> similar to the Challenge/Response model (comparable with a RESTful  <ins> GET operation).  The specific manner how Handles are created and used always remains as the distinguishing quality of this model. In the Uni-Directional model, handles are composed of cryptographically signed trusted timestamps as shown in I-D.birkholz- rats-tuda, potentially including other qualifying data.  The Handles are created by an external 3rd entity - the Handle Distributor - which includes a trustworthy source of time, and takes on the role of a Time Stamping Authority (TSA, as initially defined in RFC3161). Timestamps created from local clocks (absolute clocks using a global timescale, as well as relative clocks, such as tick-counters) of Attesters and Verifiers MUST be cryptographically bound to fresh Handles received from the Handle Distributor.  This binding provides a proof of synchronization that MUST be included in all produced Evidence.  Correspondingly, conveyed Evidence in this model provides a proof that it was fresh at a certain point in time. While periodically pushing Evidence to the Verifier, the Attester only needs to generate and convey evidence generated from Claim values that have changed and new Event Logs entries since the previous conveyance.  This updates reflecting the differences are called "delta" in the sequence diagram above. Effectively, the Uni-Directional model allows for a series of Evidence to be pushed to multiple Verifiers simultaneously.  Methods to detect excessive time drift that would mandate a fresh Handle to be received by the Handle Distributor as well as timing of Handle distribution are out-of-scope of this document. </ins> 8.3. Streaming Remote Attestation procedures require the setup of subscription state.  Setting up subscription state between a Verifier  <ins> and an Attester is conducted via a subscribe operation.  The subscribe operation is used to convey required Handles for producing Evidence.  Effectively, this allows for a series of Evidence to be pushed to a Verifier, similar to the Uni-Directional model.  While a Handle Distributor is not required in this model, it is also limited to bi-lateral subscription relationships in which each Verifier has to create and provide its individual Handle.  Handles provided by a specific subscribing Verifier MUST be used in Evidence generation for that specific Verifier.  The Streaming model uses the same information elements as the Challenge/Response and the Uni- </ins> Directional model.  Methods to detect excessive time drift that would mandate a refreshed Handle to be conveyed via another subscribe operation are out-of-scope of this document. Confidentiality of exchanged attestation information may be desirable.  This requirement usually is present when communication takes place over insecure channels, such as the public Internet.  In  <ins> such cases, TLS may be used as a suitable communication protocol which provides confidentiality protection.  In private networks, such as carrier management networks, it must be evaluated whether or not the transport medium is considered confidential. </ins> 9.2.  <ins> In particular use cases, mutual authentication may be desirable in </ins> such a way that a Verifier also needs to prove its identity to the Attester, instead of only the Attester proving its identity to the Verifier.


A statement representing an identifier list that MUST be associated with corresponding Authentication Secrets used to <del> protect Evidence. </del>  Each Authentication Secret is uniquely associated with a distinguishable Attesting Environment.  Consequently, an

Also Signed-off-by: Michael Eckel
Based on URL Previous section says “Authentication Secret” is used to protect Claims, but here says it’s used to protect Evidence.
As I understand, if Authentication Secret represents the identity of Attesting Environment, then it’s not mandatory, at least in our implementation.
TL;DR: “Authentication Secret” protects evidence (i.e. a TPM Quote) and must be mandatory. Please also have a look at my comment URL Feel free to correct me. :-)
Based on URL Does the Authentication Secret represent the identity of the Attesting Environment?
How to understand the Authentication Secret, and is it necessary all the time? For example, in our implementation, during the router booting up, the BIOS measures the BootLoader and records the measured hash value into the TPM, and the BootLoader measures the OS Kernel and records the measured hash value into the TPM as well. From the Layered Attestation perspective, I think (BIOS + TPM) is the Attesting Environment and (BootLoader + TPM) is also the Attesting Environment. But the Claims (measured hash values) aren’t protected separately, and they finally becomes the Evidence (TPM Quote) and it’s only protected by the TPM’s AIK. So, what is the Authentication Secret?
This comment also addresses . TL;DR: A TPM AIK is an Authentication Secret. In the first draft, I named this element just "Secret". And yes, an AIK (Attestation Identity Key) in TPM 1.2 terminology, or AK (Attestation Key) in TPM 2.0 terminology, can be such a "Secret". The "Secret ID" basically is a key identifier/ID, e.g., the fingerprint/hash of such a key or the public part of the AK. The TPM FAPI uses key paths, such as "HS/SRK/RSASignKey". These are also valid key/secret identifiers/IDs. There is no official (unique) way of identifying keys, except for the FAPI key -- but: You need to use the FAPI for that purpose which is not available on embedded devices with no OS (because it needs at least a filesystem). In summary, it can be stated that "Secret IDs" are application-specific. Now, what is the matter with "Authentication Secret" and "Authentication Secret ID"? In a later draft I replaced "Secret (ID)" with "Authentication Secret (ID)" intentionally, after talking to a crypto colleague. "Authentication Secret" is more specific than just "secret". And, in fact, its purpose is to provide authentication, i.e. evidence must provide the security property of "authentication", so that one knows it originates from a valid/specific source, e.g. TPM. This can also be some kind of group key (or DAA key). "Authentication Secret": This element must be present in the attesting environment as it signs evidence (and a digital signature provides integrity and authentication). "Authentication Secret ID(s)": This element must be mandatory as it identifies the "Authentication Secret(s)".
In our implementation, during the router booting up, the BIOS measures the BootLoader and records the measured hash value into the TPM, then the BootLoader measures the OS Kernel and records the measured hash value into the TPM as well. Based on our implementation, I can see some inconsistencies from two different aspects: According to the definition of Layered Attestation, I think the Attesting Environments are BIOS and Bootloader. But, according to the definition of "Authentication Secret", because the TPM's AIK/AK signs Evidence so the TPM's AIK/AK is the Authentication Secret, and because "Each Authentication Secret is uniquely associated with a distinguishable Attesting Environment" so the TPM should be the Attesting Environment. So, which one is correct?
After talking with Wei I came to realize (again) that the use of a TPM creates this "interesting" setup of the two layers of Attesting Environments: Both the first layer that is the BIOS and the second layer that is the Bootloader share an Attesting Envirment component that is the TPM. In acronyms, the BIOS 's claim collection capability and the TPM that is an RTS and RTR compose the first Attesting Environment. The Bootloader's claim collection capability in combination with the identical TPM compose the seceond Attesting Environment. As a result, I agree that the sentence "Each Authentication Secret is uniquely associated with a distinguishable Attesting Environment" does not really allow for that scnerario and needs some help.
fixed in Hi Henk, I've reviewed the reference interaction models I-D recently, I hope the comments below can help improve the draft before the IETF110 draft submission cut-off. Section 3 Disambiguation Comment > This section is talking about the disambiguation of terminology, so I suggest making it a sub-section of Section 2 Terminology. Examples of these types of co-located environments include: a Trusted Execution Environment (TEE), Baseboard Management Controllers (BMCs), as well as other physical or logical protected/isolated/shielded Computing Environments (e.g. embedded Secure Elements (eSE) or Trusted Platform Modules (TPM)). Comment > About "these types of co-located environments", The previous sentences are about the Verifier and Attester don't need to be remote. So "these" is weird here, because here is about the attesting environment and target environment. Section 5 Direct Anonymous Attestation Comment > I think it's better to move this section to the bottom of the draft. DAA doesn't introduce a new information elements, and only augments the scope/definition of Attester Identity and Authentication Secret IDs, describing it after the introduction of all the 3 basic interaction models would be better. Putting DAA in the middle makes me feel the basic interaction models rely upon DAA, but actually it's not. This document extends the duties of the Endorser role as defined by the RATS architecture with respect to the provision of these Attester Identity documents to Attesters. The existing duties of the Endorser role and the duties of a DAA Issuer are quite similar as illustrated in the following subsections. Comment > Without DAA, I think the Endorser also needs to provision the Attester Identity to Attesters. And as I understand, the DAA Issuer is a supply chain entity before the Attester being shipped, so it is the Endorser when DAA is used, right? If yes, then in the next sentence, the comparison between Endorser and DAA Issuer doesn't make sense to me. Section 5.1 Endorsers Comment > Does this section have difference with the definition of Endorser in architecture draft? If not, is it necessary to keep this section? Comment > This section only describes the Layered Attestation, but the scope of Endorsement is more than what's described here. Endorsement indicates the Attester's various capabilities such as Claims collection and Evidence signing. For other situations than Layered Attestation, the Endorser and Endorsement are also needed. So why only mention Layered Attestation here? I don't see any special relationship between DAA and Layered Attestation. Section 5.2 Endorsers for Direct Anonymous Attestation In order to enable the use of DAA, an Endorser role takes on the duties of a DAA Issuer in addition to its already defined duties. DAA Issuers offer zero-knowledge proofs based on public key certificates used for a group of Attesters [DAA]. Effectively, these certificates share the semantics of Endorsements, with the following exceptions: Comment > In the first sentence, I suggest saying that "a DAA Issuer takes on the role of an Endorser". o The associated private keys are used by the DAA Issuer to provide an Attester with a credential that it can use to convince the Verifier that its Evidence is valid. To keep their anonymity the Attester randomizes this credential each time that it is used. Comment > How to understand "Evidence is valid"? Does it mean the Evidence is sent from an authentic Attester and not tampered during the conveyance? Or does it mean the Evidence comes from a RoT and is trustable (although the Evidence can diverge from the Reference Values)? Comment > When saying "Attester randomizes this credential", how many credentials does an Attester have? 1) Can a DAA Issuer have multiple key pairs and use them for one Attester? 2) Can a DAA Issuer use one key pair to generate multiple credentials for one Attester? o A credential is conveyed from an Endorser to an Attester in combination with the conveyance of the public key certificates from Endorser to Verifier. Comment > Is there another way to convey the public key certificate, for example, can the public key certificates be conveyed from Endorser to Attester first and then from Attester to Verifier? The zero-knowledge proofs required cannot be created by an Attester alone - like the Endorsements of RoTs - and have to be created by a trustable third entity - like an Endorser. Due to that semantic overlap, the Endorser role is augmented via the definition of DAA duties as defined below. This augmentation enables the Endorser to convey trustable third party statements both to Verifier roles and Attester roles. Comment > For "the definition of DAA duties as defined below", what is the definition of DAA duties? Comment > In the last sentence, the Endorsement with its original definition is the third party statement for Verifier and Attester, isn't it? So, "augmentation" isn't the correct expression. Section 6 Normative Prerequisites Attester Identity: The provenance of Evidence with respect to a distinguishable Attesting Environment MUST be correct and unambiguous. Comment > The Attester Identity is to identify which Attester the Evidence comes from. But if the Attester has multiple Attesting Environments, what should be the Attester Identity? Comment > The TPM's AIK certificate is one kind of Attester Identity, right? Attestation Evidence Authenticity: Attestation Evidence MUST be correct and authentic. Comment > Is it appropriate to say "correct Evidence"? If saying so, I think it means that the Evidence satisfies the Attestation Policy for Evidence. Authentication Secret: An Authentication Secret MUST be available exclusively to an Attester's Attesting Environment. The Attester MUST protect Claims with that Authentication Secret, thereby proving the authenticity of the Claims included in Evidence. The Authentication Secret MUST be established before RATS can take place. Comment > Does the Authentication Secret represent the identity of the Attesting Environment? Comment > How to understand the Authentication Secret, and is it necessary all the time? For example, in our implementation, during the router booting up, the BIOS measures the BootLoader and records the measured hash value into the TPM, and the BootLoader measures the OS Kernel and records the measured hash value into the TPM as well. From the Layered Attestation perspective, I think (BIOS + TPM) is the Attesting Environment and (BootLoader + TPM) is also the Attesting Environment. But the Claims (measured hash values) aren't protected separately, and they finally becomes the Evidence (TPM Quote) and it's only protected by the TPM's AIK. So, what is the Authentication Secret? Section 7 Generic Information Elements Attester Identity ('attesterIdentity'): mandatory A statement about a distinguishable Attester made by an Endorser without accompanying evidence about its validity - used as proof of identity. Comment > Previous section says "Attester Identity" is about "a distinguishable Attesting Environment", and here says it's about "a distinguishable Attester". Comment > How to understand "without accompanying evidence about its validity"? Attester Identity ('attesterIdentity'): mandatory In DAA, the Attester's identity is not revealed to the verifier. The Attester is issued with a credential by the Endorser that is randomized and then used to anonymously confirm the validity of their evidence. The evidence is verified using the Endorser's public key. Comment > I think here means the DAA credential represents the Attester Identity. Comment > There is ambiguity of "that is randomized", does it mean randomized Endorser or randomized credential? Comment > For "confirm the validity of their evidence", what does "their" refer to? And what does "the validity of evidence" mean? Authentication Secret IDs ('authSecID'): mandatory A statement representing an identifier list that MUST be associated with corresponding Authentication Secrets used to protect Evidence. Comment > Previous section says "Authentication Secret" is used to protect Claims, but here says it's used to protect Evidence. Comment > As I understand, if Authentication Secret represents the identity of Attesting Environment, then it's not mandatory, at least in our implementation. Authentication Secret IDs ('authSecID'): mandatory In DAA, Authentication Secret IDs are represented by the Endorser (DAA issuer)'s public key that MUST be used to create DAA credentials for the corresponding Authentication Secrets used to protect Evidence. In DAA, an Authentication Secret ID does not identify a unique Attesting Environment but associated with a group of Attesting Environments. This is because an Attesting Environment should not be distinguishable and the DAA credential which represents the Attesting Environment is randomised each time it used. Comment > In my understanding, here says that the DAA credential identities the Attesting Environment. Compared with the description in the "Attester Identity" part, what does the DAA credential represent actually? Reference Claims ('refClaims') mandatory Reference Claims are components of Reference Values as defined in [I-D.ietf-rats-architecture]. [Editor's Note: Definition might become obsolete, if replaced by Reference Values. Is there a difference between Claims and Values here? Analogously, why is not named Reference Claims in the RATS arch?] Comment > I suggest using Reference Values to keep consistent with the RATS arch. Reference Claims are used to appraise the Claims received from an Attester via appraisal by direct comparison. Comment > "Direct comparison" isn't the correct expression, the comparison can have other rules. Claim Selection ('claimSelection'): optional A statement that represents a (sub-)set of Claims that can be created by an Attester. Claim Selections can act as filters that can specify the exact set of Claims to be included in Evidence. An Attester MAY decide whether or not to provide all Claims as requested via a Claim Selection. Comment > The "all Claims" may be ambiguous, I'd like to double check, does it refer to all Claims that the Attester can create or refer to all Claims requested in the Claim Selection? Section 8.1 Challenge/Response Remote Attestation Comment > In the sequence diagram, some elements in the bracket are not defined in the "Information Elements" section, such as targetEnvironment, collectedClaims, eventLog. Should these elements be defined? Section 9 Additional Application-Specific Requirements Depending on the use cases covered, there can be additional requirements. An exemplary subset is illustrated in this section. Comment > Here starts to talk about "additional requirements", but I wonder there is no other places in this draft talking about requirement, so what are the basic requirements? Regards & Thanks! Wei Pan

A statement representing an identifier list that MUST be associated with corresponding Authentication Secrets used to  <ins> protect Claims included in Evidence. </ins> Each Authentication Secret is uniquely associated with a distinguishable Attesting Environment.  Consequently, an


_optional_ <del> A statement that represents a (sub-)set of Claims that can be created by an Attester. </del>  <del> Claim Selections can act as filters that can specify the exact set of Claims to be included in Evidence.  An Attester MAY decide whether or not to provide all Claims as requested via a Claim Selection. </del>  _mandatory_

Issue: The “all Claims” may be ambiguous, I’d like to double check, does it refer to all Claims that the Attester can create or refer to all Claims requested in the Claim Selection? Solution in this commit: Made it clear. Signed-off-by: Michael Eckel
Based on URL The “all Claims” may be ambiguous, I’d like to double check, does it refer to all Claims that the Attester can create or refer to all Claims requested in the Claim Selection?
If understand correctly, the message here is that an Attester can decide to provide less Claims than specified in the Claims Selection, which appears viable to me and is used in practice, too. I will adapt the text accordingly. Hi Henk, I've reviewed the reference interaction models I-D recently, I hope the comments below can help improve the draft before the IETF110 draft submission cut-off. Section 3 Disambiguation Comment > This section is talking about the disambiguation of terminology, so I suggest making it a sub-section of Section 2 Terminology. Examples of these types of co-located environments include: a Trusted Execution Environment (TEE), Baseboard Management Controllers (BMCs), as well as other physical or logical protected/isolated/shielded Computing Environments (e.g. embedded Secure Elements (eSE) or Trusted Platform Modules (TPM)). Comment > About "these types of co-located environments", The previous sentences are about the Verifier and Attester don't need to be remote. So "these" is weird here, because here is about the attesting environment and target environment. Section 5 Direct Anonymous Attestation Comment > I think it's better to move this section to the bottom of the draft. DAA doesn't introduce a new information elements, and only augments the scope/definition of Attester Identity and Authentication Secret IDs, describing it after the introduction of all the 3 basic interaction models would be better. Putting DAA in the middle makes me feel the basic interaction models rely upon DAA, but actually it's not. This document extends the duties of the Endorser role as defined by the RATS architecture with respect to the provision of these Attester Identity documents to Attesters. The existing duties of the Endorser role and the duties of a DAA Issuer are quite similar as illustrated in the following subsections. Comment > Without DAA, I think the Endorser also needs to provision the Attester Identity to Attesters. And as I understand, the DAA Issuer is a supply chain entity before the Attester being shipped, so it is the Endorser when DAA is used, right? If yes, then in the next sentence, the comparison between Endorser and DAA Issuer doesn't make sense to me. Section 5.1 Endorsers Comment > Does this section have difference with the definition of Endorser in architecture draft? If not, is it necessary to keep this section? Comment > This section only describes the Layered Attestation, but the scope of Endorsement is more than what's described here. Endorsement indicates the Attester's various capabilities such as Claims collection and Evidence signing. For other situations than Layered Attestation, the Endorser and Endorsement are also needed. So why only mention Layered Attestation here? I don't see any special relationship between DAA and Layered Attestation. Section 5.2 Endorsers for Direct Anonymous Attestation In order to enable the use of DAA, an Endorser role takes on the duties of a DAA Issuer in addition to its already defined duties. DAA Issuers offer zero-knowledge proofs based on public key certificates used for a group of Attesters [DAA]. Effectively, these certificates share the semantics of Endorsements, with the following exceptions: Comment > In the first sentence, I suggest saying that "a DAA Issuer takes on the role of an Endorser". o The associated private keys are used by the DAA Issuer to provide an Attester with a credential that it can use to convince the Verifier that its Evidence is valid. To keep their anonymity the Attester randomizes this credential each time that it is used. Comment > How to understand "Evidence is valid"? Does it mean the Evidence is sent from an authentic Attester and not tampered during the conveyance? Or does it mean the Evidence comes from a RoT and is trustable (although the Evidence can diverge from the Reference Values)? Comment > When saying "Attester randomizes this credential", how many credentials does an Attester have? 1) Can a DAA Issuer have multiple key pairs and use them for one Attester? 2) Can a DAA Issuer use one key pair to generate multiple credentials for one Attester? o A credential is conveyed from an Endorser to an Attester in combination with the conveyance of the public key certificates from Endorser to Verifier. Comment > Is there another way to convey the public key certificate, for example, can the public key certificates be conveyed from Endorser to Attester first and then from Attester to Verifier? The zero-knowledge proofs required cannot be created by an Attester alone - like the Endorsements of RoTs - and have to be created by a trustable third entity - like an Endorser. Due to that semantic overlap, the Endorser role is augmented via the definition of DAA duties as defined below. This augmentation enables the Endorser to convey trustable third party statements both to Verifier roles and Attester roles. Comment > For "the definition of DAA duties as defined below", what is the definition of DAA duties? Comment > In the last sentence, the Endorsement with its original definition is the third party statement for Verifier and Attester, isn't it? So, "augmentation" isn't the correct expression. Section 6 Normative Prerequisites Attester Identity: The provenance of Evidence with respect to a distinguishable Attesting Environment MUST be correct and unambiguous. Comment > The Attester Identity is to identify which Attester the Evidence comes from. But if the Attester has multiple Attesting Environments, what should be the Attester Identity? Comment > The TPM's AIK certificate is one kind of Attester Identity, right? Attestation Evidence Authenticity: Attestation Evidence MUST be correct and authentic. Comment > Is it appropriate to say "correct Evidence"? If saying so, I think it means that the Evidence satisfies the Attestation Policy for Evidence. Authentication Secret: An Authentication Secret MUST be available exclusively to an Attester's Attesting Environment. The Attester MUST protect Claims with that Authentication Secret, thereby proving the authenticity of the Claims included in Evidence. The Authentication Secret MUST be established before RATS can take place. Comment > Does the Authentication Secret represent the identity of the Attesting Environment? Comment > How to understand the Authentication Secret, and is it necessary all the time? For example, in our implementation, during the router booting up, the BIOS measures the BootLoader and records the measured hash value into the TPM, and the BootLoader measures the OS Kernel and records the measured hash value into the TPM as well. From the Layered Attestation perspective, I think (BIOS + TPM) is the Attesting Environment and (BootLoader + TPM) is also the Attesting Environment. But the Claims (measured hash values) aren't protected separately, and they finally becomes the Evidence (TPM Quote) and it's only protected by the TPM's AIK. So, what is the Authentication Secret? Section 7 Generic Information Elements Attester Identity ('attesterIdentity'): mandatory A statement about a distinguishable Attester made by an Endorser without accompanying evidence about its validity - used as proof of identity. Comment > Previous section says "Attester Identity" is about "a distinguishable Attesting Environment", and here says it's about "a distinguishable Attester". Comment > How to understand "without accompanying evidence about its validity"? Attester Identity ('attesterIdentity'): mandatory In DAA, the Attester's identity is not revealed to the verifier. The Attester is issued with a credential by the Endorser that is randomized and then used to anonymously confirm the validity of their evidence. The evidence is verified using the Endorser's public key. Comment > I think here means the DAA credential represents the Attester Identity. Comment > There is ambiguity of "that is randomized", does it mean randomized Endorser or randomized credential? Comment > For "confirm the validity of their evidence", what does "their" refer to? And what does "the validity of evidence" mean? Authentication Secret IDs ('authSecID'): mandatory A statement representing an identifier list that MUST be associated with corresponding Authentication Secrets used to protect Evidence. Comment > Previous section says "Authentication Secret" is used to protect Claims, but here says it's used to protect Evidence. Comment > As I understand, if Authentication Secret represents the identity of Attesting Environment, then it's not mandatory, at least in our implementation. Authentication Secret IDs ('authSecID'): mandatory In DAA, Authentication Secret IDs are represented by the Endorser (DAA issuer)'s public key that MUST be used to create DAA credentials for the corresponding Authentication Secrets used to protect Evidence. In DAA, an Authentication Secret ID does not identify a unique Attesting Environment but associated with a group of Attesting Environments. This is because an Attesting Environment should not be distinguishable and the DAA credential which represents the Attesting Environment is randomised each time it used. Comment > In my understanding, here says that the DAA credential identities the Attesting Environment. Compared with the description in the "Attester Identity" part, what does the DAA credential represent actually? Reference Claims ('refClaims') mandatory Reference Claims are components of Reference Values as defined in [I-D.ietf-rats-architecture]. [Editor's Note: Definition might become obsolete, if replaced by Reference Values. Is there a difference between Claims and Values here? Analogously, why is not named Reference Claims in the RATS arch?] Comment > I suggest using Reference Values to keep consistent with the RATS arch. Reference Claims are used to appraise the Claims received from an Attester via appraisal by direct comparison. Comment > "Direct comparison" isn't the correct expression, the comparison can have other rules. Claim Selection ('claimSelection'): optional A statement that represents a (sub-)set of Claims that can be created by an Attester. Claim Selections can act as filters that can specify the exact set of Claims to be included in Evidence. An Attester MAY decide whether or not to provide all Claims as requested via a Claim Selection. Comment > The "all Claims" may be ambiguous, I'd like to double check, does it refer to all Claims that the Attester can create or refer to all Claims requested in the Claim Selection? Section 8.1 Challenge/Response Remote Attestation Comment > In the sequence diagram, some elements in the bracket are not defined in the "Information Elements" section, such as targetEnvironment, collectedClaims, eventLog. Should these elements be defined? Section 9 Additional Application-Specific Requirements Depending on the use cases covered, there can be additional requirements. An exemplary subset is illustrated in this section. Comment > Here starts to talk about "additional requirements", but I wonder there is no other places in this draft talking about requirement, so what are the basic requirements? Regards & Thanks! Wei Pan

_optional_  <ins> A (sub-)set of Claims which can be created by an Attester. </ins>  <ins> Claim Selections act as filters to specify the exact set of Claims to be included in Evidence.  In a remote attestation process, a Verifier sends a Claim Selection, among other elements, to an Attester.  An Attester MAY decide whether or not to provide all requested Claims from a Claim Selection to the Verifier. </ins> _mandatory_


associated with corresponding Authentication Secrets used to protect Claims included in Evidence. <del> Each Authentication Secret is uniquely associated with a distinguishable Attesting Environment.  Consequently, an Authentication Secret ID also identifies an Attesting Environment. </del>  _mandatory_

Based on URL Does the Authentication Secret represent the identity of the Attesting Environment?
How to understand the Authentication Secret, and is it necessary all the time? For example, in our implementation, during the router booting up, the BIOS measures the BootLoader and records the measured hash value into the TPM, and the BootLoader measures the OS Kernel and records the measured hash value into the TPM as well. From the Layered Attestation perspective, I think (BIOS + TPM) is the Attesting Environment and (BootLoader + TPM) is also the Attesting Environment. But the Claims (measured hash values) aren’t protected separately, and they finally becomes the Evidence (TPM Quote) and it’s only protected by the TPM’s AIK. So, what is the Authentication Secret?
This comment also addresses . TL;DR: A TPM AIK is an Authentication Secret. In the first draft, I named this element just "Secret". And yes, an AIK (Attestation Identity Key) in TPM 1.2 terminology, or AK (Attestation Key) in TPM 2.0 terminology, can be such a "Secret". The "Secret ID" basically is a key identifier/ID, e.g., the fingerprint/hash of such a key or the public part of the AK. The TPM FAPI uses key paths, such as "HS/SRK/RSASignKey". These are also valid key/secret identifiers/IDs. There is no official (unique) way of identifying keys, except for the FAPI key -- but: You need to use the FAPI for that purpose which is not available on embedded devices with no OS (because it needs at least a filesystem). In summary, it can be stated that "Secret IDs" are application-specific. Now, what is the matter with "Authentication Secret" and "Authentication Secret ID"? In a later draft I replaced "Secret (ID)" with "Authentication Secret (ID)" intentionally, after talking to a crypto colleague. "Authentication Secret" is more specific than just "secret". And, in fact, its purpose is to provide authentication, i.e. evidence must provide the security property of "authentication", so that one knows it originates from a valid/specific source, e.g. TPM. This can also be some kind of group key (or DAA key). "Authentication Secret": This element must be present in the attesting environment as it signs evidence (and a digital signature provides integrity and authentication). "Authentication Secret ID(s)": This element must be mandatory as it identifies the "Authentication Secret(s)".
In our implementation, during the router booting up, the BIOS measures the BootLoader and records the measured hash value into the TPM, then the BootLoader measures the OS Kernel and records the measured hash value into the TPM as well. Based on our implementation, I can see some inconsistencies from two different aspects: According to the definition of Layered Attestation, I think the Attesting Environments are BIOS and Bootloader. But, according to the definition of "Authentication Secret", because the TPM's AIK/AK signs Evidence so the TPM's AIK/AK is the Authentication Secret, and because "Each Authentication Secret is uniquely associated with a distinguishable Attesting Environment" so the TPM should be the Attesting Environment. So, which one is correct?
After talking with Wei I came to realize (again) that the use of a TPM creates this "interesting" setup of the two layers of Attesting Environments: Both the first layer that is the BIOS and the second layer that is the Bootloader share an Attesting Envirment component that is the TPM. In acronyms, the BIOS 's claim collection capability and the TPM that is an RTS and RTR compose the first Attesting Environment. The Bootloader's claim collection capability in combination with the identical TPM compose the seceond Attesting Environment. As a result, I agree that the sentence "Each Authentication Secret is uniquely associated with a distinguishable Attesting Environment" does not really allow for that scnerario and needs some help.
fixed in Hi Henk, I've reviewed the reference interaction models I-D recently, I hope the comments below can help improve the draft before the IETF110 draft submission cut-off. Section 3 Disambiguation Comment > This section is talking about the disambiguation of terminology, so I suggest making it a sub-section of Section 2 Terminology. Examples of these types of co-located environments include: a Trusted Execution Environment (TEE), Baseboard Management Controllers (BMCs), as well as other physical or logical protected/isolated/shielded Computing Environments (e.g. embedded Secure Elements (eSE) or Trusted Platform Modules (TPM)). Comment > About "these types of co-located environments", The previous sentences are about the Verifier and Attester don't need to be remote. So "these" is weird here, because here is about the attesting environment and target environment. Section 5 Direct Anonymous Attestation Comment > I think it's better to move this section to the bottom of the draft. DAA doesn't introduce a new information elements, and only augments the scope/definition of Attester Identity and Authentication Secret IDs, describing it after the introduction of all the 3 basic interaction models would be better. Putting DAA in the middle makes me feel the basic interaction models rely upon DAA, but actually it's not. This document extends the duties of the Endorser role as defined by the RATS architecture with respect to the provision of these Attester Identity documents to Attesters. The existing duties of the Endorser role and the duties of a DAA Issuer are quite similar as illustrated in the following subsections. Comment > Without DAA, I think the Endorser also needs to provision the Attester Identity to Attesters. And as I understand, the DAA Issuer is a supply chain entity before the Attester being shipped, so it is the Endorser when DAA is used, right? If yes, then in the next sentence, the comparison between Endorser and DAA Issuer doesn't make sense to me. Section 5.1 Endorsers Comment > Does this section have difference with the definition of Endorser in architecture draft? If not, is it necessary to keep this section? Comment > This section only describes the Layered Attestation, but the scope of Endorsement is more than what's described here. Endorsement indicates the Attester's various capabilities such as Claims collection and Evidence signing. For other situations than Layered Attestation, the Endorser and Endorsement are also needed. So why only mention Layered Attestation here? I don't see any special relationship between DAA and Layered Attestation. Section 5.2 Endorsers for Direct Anonymous Attestation In order to enable the use of DAA, an Endorser role takes on the duties of a DAA Issuer in addition to its already defined duties. DAA Issuers offer zero-knowledge proofs based on public key certificates used for a group of Attesters [DAA]. Effectively, these certificates share the semantics of Endorsements, with the following exceptions: Comment > In the first sentence, I suggest saying that "a DAA Issuer takes on the role of an Endorser". o The associated private keys are used by the DAA Issuer to provide an Attester with a credential that it can use to convince the Verifier that its Evidence is valid. To keep their anonymity the Attester randomizes this credential each time that it is used. Comment > How to understand "Evidence is valid"? Does it mean the Evidence is sent from an authentic Attester and not tampered during the conveyance? Or does it mean the Evidence comes from a RoT and is trustable (although the Evidence can diverge from the Reference Values)? Comment > When saying "Attester randomizes this credential", how many credentials does an Attester have? 1) Can a DAA Issuer have multiple key pairs and use them for one Attester? 2) Can a DAA Issuer use one key pair to generate multiple credentials for one Attester? o A credential is conveyed from an Endorser to an Attester in combination with the conveyance of the public key certificates from Endorser to Verifier. Comment > Is there another way to convey the public key certificate, for example, can the public key certificates be conveyed from Endorser to Attester first and then from Attester to Verifier? The zero-knowledge proofs required cannot be created by an Attester alone - like the Endorsements of RoTs - and have to be created by a trustable third entity - like an Endorser. Due to that semantic overlap, the Endorser role is augmented via the definition of DAA duties as defined below. This augmentation enables the Endorser to convey trustable third party statements both to Verifier roles and Attester roles. Comment > For "the definition of DAA duties as defined below", what is the definition of DAA duties? Comment > In the last sentence, the Endorsement with its original definition is the third party statement for Verifier and Attester, isn't it? So, "augmentation" isn't the correct expression. Section 6 Normative Prerequisites Attester Identity: The provenance of Evidence with respect to a distinguishable Attesting Environment MUST be correct and unambiguous. Comment > The Attester Identity is to identify which Attester the Evidence comes from. But if the Attester has multiple Attesting Environments, what should be the Attester Identity? Comment > The TPM's AIK certificate is one kind of Attester Identity, right? Attestation Evidence Authenticity: Attestation Evidence MUST be correct and authentic. Comment > Is it appropriate to say "correct Evidence"? If saying so, I think it means that the Evidence satisfies the Attestation Policy for Evidence. Authentication Secret: An Authentication Secret MUST be available exclusively to an Attester's Attesting Environment. The Attester MUST protect Claims with that Authentication Secret, thereby proving the authenticity of the Claims included in Evidence. The Authentication Secret MUST be established before RATS can take place. Comment > Does the Authentication Secret represent the identity of the Attesting Environment? Comment > How to understand the Authentication Secret, and is it necessary all the time? For example, in our implementation, during the router booting up, the BIOS measures the BootLoader and records the measured hash value into the TPM, and the BootLoader measures the OS Kernel and records the measured hash value into the TPM as well. From the Layered Attestation perspective, I think (BIOS + TPM) is the Attesting Environment and (BootLoader + TPM) is also the Attesting Environment. But the Claims (measured hash values) aren't protected separately, and they finally becomes the Evidence (TPM Quote) and it's only protected by the TPM's AIK. So, what is the Authentication Secret? Section 7 Generic Information Elements Attester Identity ('attesterIdentity'): mandatory A statement about a distinguishable Attester made by an Endorser without accompanying evidence about its validity - used as proof of identity. Comment > Previous section says "Attester Identity" is about "a distinguishable Attesting Environment", and here says it's about "a distinguishable Attester". Comment > How to understand "without accompanying evidence about its validity"? Attester Identity ('attesterIdentity'): mandatory In DAA, the Attester's identity is not revealed to the verifier. The Attester is issued with a credential by the Endorser that is randomized and then used to anonymously confirm the validity of their evidence. The evidence is verified using the Endorser's public key. Comment > I think here means the DAA credential represents the Attester Identity. Comment > There is ambiguity of "that is randomized", does it mean randomized Endorser or randomized credential? Comment > For "confirm the validity of their evidence", what does "their" refer to? And what does "the validity of evidence" mean? Authentication Secret IDs ('authSecID'): mandatory A statement representing an identifier list that MUST be associated with corresponding Authentication Secrets used to protect Evidence. Comment > Previous section says "Authentication Secret" is used to protect Claims, but here says it's used to protect Evidence. Comment > As I understand, if Authentication Secret represents the identity of Attesting Environment, then it's not mandatory, at least in our implementation. Authentication Secret IDs ('authSecID'): mandatory In DAA, Authentication Secret IDs are represented by the Endorser (DAA issuer)'s public key that MUST be used to create DAA credentials for the corresponding Authentication Secrets used to protect Evidence. In DAA, an Authentication Secret ID does not identify a unique Attesting Environment but associated with a group of Attesting Environments. This is because an Attesting Environment should not be distinguishable and the DAA credential which represents the Attesting Environment is randomised each time it used. Comment > In my understanding, here says that the DAA credential identities the Attesting Environment. Compared with the description in the "Attester Identity" part, what does the DAA credential represent actually? Reference Claims ('refClaims') mandatory Reference Claims are components of Reference Values as defined in [I-D.ietf-rats-architecture]. [Editor's Note: Definition might become obsolete, if replaced by Reference Values. Is there a difference between Claims and Values here? Analogously, why is not named Reference Claims in the RATS arch?] Comment > I suggest using Reference Values to keep consistent with the RATS arch. Reference Claims are used to appraise the Claims received from an Attester via appraisal by direct comparison. Comment > "Direct comparison" isn't the correct expression, the comparison can have other rules. Claim Selection ('claimSelection'): optional A statement that represents a (sub-)set of Claims that can be created by an Attester. Claim Selections can act as filters that can specify the exact set of Claims to be included in Evidence. An Attester MAY decide whether or not to provide all Claims as requested via a Claim Selection. Comment > The "all Claims" may be ambiguous, I'd like to double check, does it refer to all Claims that the Attester can create or refer to all Claims requested in the Claim Selection? Section 8.1 Challenge/Response Remote Attestation Comment > In the sequence diagram, some elements in the bracket are not defined in the "Information Elements" section, such as targetEnvironment, collectedClaims, eventLog. Should these elements be defined? Section 9 Additional Application-Specific Requirements Depending on the use cases covered, there can be additional requirements. An exemplary subset is illustrated in this section. Comment > Here starts to talk about "additional requirements", but I wonder there is no other places in this draft talking about requirement, so what are the basic requirements? Regards & Thanks! Wei Pan

associated with corresponding Authentication Secrets used to protect Claims included in Evidence.  <ins> Each distinguishable Attesting Environment has access to a protected capability that provides an Authentication Secret associated with that Attesting Environment.  Consequently, an Authentication Secret ID can also identify an Attesting Environment. </ins> _mandatory_


an Attester, which enables Relying Parties, for example, to assess an Attester's trustworthiness.  7.2. Uni-Directional Remote Attestation procedures can be initiated both

NAME : Please let me know, your views as to how is the information flow and anything else, we need to add?

an Attester, which enables Relying Parties, for example, to assess an Attester's trustworthiness. <ins> 7.1.1. According to the RATS Architecture, two reference models for Challenge/Response Attestation have been proposed.  This section highlights the information flows bewteen the Attester, Verifier and Relying Party undergoing Remote Attestation Procedure, using these models. Passport Model The passport model is so named because of its resemblance to how nations issue passports to their citizens.  In this Model, the attestation sequence is a two step procedure.  In the first step, an Attester conveys Evidence to a Verifier which compares the Evidence against its appraisal policy.  The Verifier then gives back an Attestation Result to the Attester, which simply caches it.  In the second step, the Attester presents the Attestation Result (and possibly additional Claims/evidence) to a Relying Party, which then compares this information against its own appraisal policy to establish the trustworthiness of the attestor. BackGround Check Model The background-check model is so named because of the resemblance of how employers and volunteer organizations perform background checks. In this model, the attestation sequence is initiated by a Relying Party.  The Attester conveys Evidence to the Relying Party, which does not process its payload, but realys the message and optionally check its signature against a policed trust anchor store.  Upon receiving the evidence the Relying Party initiates a session with the Verifier.  Once session is established, it forwards the received Evidence to the Verfier.  The Verifier, appraises the received Evidence according to its appraisal policy for Evidence and returns a corresponding Attestation Result to the Relying Party.  The Relying Party then checks the Attestation Result against its own appraisal policy to conclude attestation. </ins> 7.2. Uni-Directional Remote Attestation procedures can be initiated both