search

EntrustCorporation / draft-rats-pkix-evidence

An IETF Internet Draft specifying a standardized attestation evidence format intended for HSMs and other cryptographic devices
Other
1 stars 1 forks source link

Remove NestedEvidences and just use EAT submods #13

Open ounsworth opened 2 months ago

ounsworth commented 2 months ago

I believe that what I have in there as "NestedEvidences" is identical in spirit to EAT submods, so we just need to flesh out the submods claim and remove NestedEvidences.

nedmsmith commented 2 months ago

"NestedEvidences"

RFC9334 describes "layered attester" which could be realized by DICE layering, TCG "trust chain" extended into PCRs, EAT submods, etc. There was a discussion early on about how sophisticated HSMs actually are. Are they roots-of-trust where the entire HSM is considered to be both Attesting Environment and Target Envronment or is there a layering aspect?

If HSMs are considered roots of trust, then the use of nested evidence / submods is actually describing multiple elements within the environment rather than describing different environments.